查找技能

Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.

中文简介正在准备中。当前显示英语简介。

• Planning a smart-home mesh security assessment
• Reviewing Zigbee lighting and lock controls
• Checking Thread network credential handling

Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Assessing Linux privilege escalation paths
• Practicing privilege escalation in CTF challenges
• Reviewing sudo and scheduled task configurations

Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.

中文简介正在准备中。当前显示英语简介。

• Assessing encrypted cookies and tokens
• Checking RSA keys and cryptographic settings
• Testing session token predictability

Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.

中文简介正在准备中。当前显示英语简介。

• Review secret exposure in build environments
• Search build logs and caches for leaked credentials
• Assess trust settings between pipelines and cloud services

Plan and carry out wireless security assessments, from surveying nearby networks to checking authentication weaknesses and recording findings. Covers personal and enterprise Wi-Fi, rogue access points, and testing considerations for Wi-Fi 6, 6E, and 7.

中文简介正在准备中。当前显示英语简介。

• Planning a corporate Wi-Fi security assessment
• Reviewing WPA2 and WPA3 authentication weaknesses
• Testing enterprise Wi-Fi against rogue access points

Support shellcode development for security testing: small machine-code programs executed in memory. The skill covers x86/x64 implementation, code that works regardless of its memory address, loaders, executable conversion, debugging, and platform-specific execution constraints.

中文简介正在准备中。当前显示英语简介。

• Studying address-independent x86/x64 code
• Reviewing loader memory allocation and execution
• Comparing EXE and DLL conversion tools

Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.

中文简介正在准备中。当前显示英语简介。

• Reviewing file checks before privileged operations
• Testing access revocation during long-running requests
• Investigating duplicate payments from concurrent requests

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

中文简介正在准备中。当前显示英语简介。

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.

中文简介正在准备中。当前显示英语简介。

• Reviewing Z-Wave smart home device security
• Mapping S0 and S2 security modes across devices
• Planning traffic capture during device pairing

Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.

中文简介正在准备中。当前显示英语简介。

• Reviewing order and payment workflow integrity
• Testing concurrent coupon redemption or transfers
• Assessing JWT validation and GraphQL controls

Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.

中文简介正在准备中。当前显示英语简介。

• Planning an AWS, Azure, or GCP security assessment
• Tracing privilege escalation from current permissions
• Reviewing CI/CD credentials and OIDC trust settings

Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.

中文简介正在准备中。当前显示英语简介。

• Identify authentication methods on enterprise Wi-Fi
• Review client validation of authentication server certificates
• Assess EAP-TLS certificate storage and issuance

Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.

中文简介正在准备中。当前显示英语简介。

• Assessing BLE authentication in smart locks
• Checking data access on fitness trackers
• Reviewing pairing security

Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.

中文简介正在准备中。当前显示英语简介。

• Reviewing code that restores objects from external data
• Identifying serialized data in cookies and request bodies
• Assessing message consumers and admission webhooks

Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.

中文简介正在准备中。当前显示英语简介。

• Assessing web application inputs for SQL injection
• Reviewing GraphQL and WebSocket injection risks
• Combining SQLmap automation with manual verification

Map wireless networks before a security assessment. Choose compatible adapters, configure packet capture, identify access points and clients, and record channels, encryption, and management frame protection across 2.4, 5, and 6 GHz bands.

中文简介正在准备中。当前显示英语简介。

• Building a target inventory before a wireless assessment
• Choosing an adapter for the required frequency bands
• Recording encryption and management frame protection

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

中文简介正在准备中。当前显示英语简介。

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.

中文简介正在准备中。当前显示英语简介。

• Reviewing workflow inputs and execution triggers
• Assessing pipeline permissions and credential exposure
• Checking build artifact handoffs for tampering risks

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

中文简介正在准备中。当前显示英语简介。

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

中文简介正在准备中。当前显示英语简介。

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing server protocols, encryption settings, and certificates
• Reviewing certificate validation in mobile apps
• Assessing TLS 1.3 replay risks and mutual authentication

Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.

中文简介正在准备中。当前显示英语简介。

• Compare C2 frameworks for a red team exercise
• Plan communication methods and relay infrastructure
• Review C2 detection signals from a defender's perspective

Plan and run fuzz testing, which feeds varied inputs to software to uncover bugs. The skill guides tool selection, test harness creation, input collection, coverage measurement, and crash triage for parsers, protocols, kernels, and other targets.

中文简介正在准备中。当前显示英语简介。

• Planning fuzz tests for a file parser
• Preparing test harnesses and seed inputs
• Investigating stalled test coverage

Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.

中文简介正在准备中。当前显示英语简介。

• Mapping paths to administrative access in Active Directory
• Reviewing ADCS certificate service configurations
• Assessing permissions, delegation, and group policies