其他技能

Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.

中文简介正在准备中。当前显示原文说明。

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

中文简介正在准备中。当前显示原文说明。

Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or applying LLL/BKZ reduction to cryptographic constructions.

中文简介正在准备中。当前显示原文说明。

Exploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the `alg` header set to `none`, allowing attackers to forge tokens without a valid signature.

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.

中文简介正在准备中。当前显示原文说明。

Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.

中文简介正在准备中。当前显示原文说明。

PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.

中文简介正在准备中。当前显示原文说明。

Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

中文简介正在准备中。当前显示原文说明。

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

中文简介正在准备中。当前显示原文说明。

Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.

中文简介正在准备中。当前显示原文说明。

Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Understand the mechanics of Border Gateway Protocol (BGP) Hijacking, where an attacker creatively manipulates Internet routing tables to intercept, monitor, or drop massive volumes of network traffic destined for legitimate Autonomous Systems (AS).

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.

中文简介正在准备中。当前显示原文说明。

Inspects a skill's SKILL.md and its observations/runs.md log, identifies failure patterns, and proposes a targeted amendment to improve the skill. Trigger on: "improve this skill", "fix this skill", "update this skill", "why does X keep failing", "this skill is wrong", "add this to the skill", or automatically when observations/<skill-name>/runs.md contains 3 or more failure entries. Outputs the amendment as a diff the user can review before applying. Records the amendment rationale in observations/<skill-name>/runs.md after user confirmation.

中文简介正在准备中。当前显示原文说明。

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.

中文简介正在准备中。当前显示原文说明。

Advanced Lightning App Builder usage: component visibility filters, custom page templates, Dynamic Forms, Dynamic Actions, page performance optimization, LWC targetConfig constraints on record pages. Use when building complex record pages or custom app templates. NOT for Dynamic Forms basics — use admin/dynamic-forms-and-actions. NOT for exposing an LWC via js-meta.xml targets — use lwc/lwc-app-builder-config.

中文简介正在准备中。当前显示原文说明。

Use this skill to configure and manage Field Service Lightning workforce capacity — covering ServiceResourceCapacity for individual resource caps, WorkCapacityLimit for territory-level demand throttling, and reporting strategies for capacity vs. utilization analysis. NOT for resource skills, certifications, or preference setup — use admin/fsl-resource-management. NOT for work rules and service objectives — use admin/fsl-scheduling-policies. NOT for Omni-Channel agent capacity — use architect/omni-channel-capacity-model.

中文简介正在准备中。当前显示原文说明。

Flow Orchestration admin: stage configuration, step assignment, background steps, interactive steps, evaluation flows, work items, pause/resume. NOT for approval routing a standard approval process would handle — use admin/approval-processes.

中文简介正在准备中。当前显示原文说明。