All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Analyzing Ransomware Leak Site IntelligenceMonitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.Votes: 0GitHub stars: 2
- Webapp Analyzing Ransomware Network IndicatorsIdentify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow…Votes: 0GitHub stars: 2
- Webapp Analyzing Ransomware Payment WalletsTraces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution.Votes: 0GitHub stars: 2
- Webapp Analyzing Sbom For Supply Chain VulnerabilitiesParses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API.Votes: 0GitHub stars: 2
- Webapp Analyzing Security Logs With SplunkLeverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis.Votes: 0GitHub stars: 2
- Webapp Analyzing Supply Chain Malware ArtifactsInvestigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.Votes: 0GitHub stars: 2
- Webapp Analyzing Threat Intelligence FeedsAnalyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context.Votes: 0GitHub stars: 2
- Webapp Analyzing Threat Landscape With MispAnalyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time.Votes: 0GitHub stars: 2
- Webapp Analyzing Tls Certificate Transparency LogsQueries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance.Votes: 0GitHub stars: 2
- Webapp Analyzing Typosquatting Domains With DnstwistDetect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.Votes: 0GitHub stars: 2
- Webapp Analyzing Web Server Logs For IntrusionParse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns.Votes: 0GitHub stars: 2
- Webapp Analyzing Windows Event Logs In SplunkAnalyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques.Votes: 0GitHub stars: 2
- Webapp Api Authentication SessionAPI authentication and session testing — unauthenticated endpoint exposure, token lifecycle (logout revocation, refresh rotation, expiry), credential flows, password policy, account enumeration, and API key weaknesses (OWASP…Votes: 0GitHub stars: 2
- Webapp Api BflaBroken Function Level Authorization (BFLA) testing — invoking administrative API functions with lower-privilege sessions via method, version, path-normalization, and override-header variants (OWASP…Votes: 0GitHub stars: 2
- Webapp Api BolaBroken Object Level Authorization (BOLA/IDOR) testing for REST and GraphQL APIs — object ID harvesting and swapping across paths, query, body, batch, and nested resources with two-account differential evidence (OWASP…Votes: 0GitHub stars: 2
- Webapp Api BoplaBroken Object Property Level Authorization testing covering unauthorized property reads (excessive data exposure) and writes (mass assignment) with differential…Votes: 0GitHub stars: 2
- Webapp Api Business Flow AbuseTesting and exploiting automatable business operations including coupons, referrals, OTPs, reservations, purchases, trials, and pricing at unauthorized…Votes: 0GitHub stars: 2
- Webapp Api DiscoveryAPI endpoint discovery including OpenAPI/Swagger detection, GraphQL, versioned routes, and API surface mapping from multiple…Votes: 0GitHub stars: 2
- Webapp Api Fuzzing RestlerStateful REST API fuzzing with RESTler — compiling an OpenAPI spec into a fuzzing grammar, running test/fuzz-lean/fuzz modes with custom dictionaries, destructive sequences, bug-bucket triage, and coverage…Votes: 0GitHub stars: 2
- Webapp Api InjectionAPI injection testing — SQL and NoSQL operator injection through JSON bodies, query params, sort/filter fields, and headers, with boolean, time-based, error-based, and OOB…Votes: 0GitHub stars: 2
- Webapp Api Offensive Api AbuseAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation.Votes: 0GitHub stars: 2
- Webapp Api Offensive Api SecurityComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration.Votes: 0GitHub stars: 2
- Webapp Api Resource ConsumptionUnrestricted resource consumption testing (OWASP API4) — rate limit bypass via header/key drift, races, method and identity rotation, plus expensive-query, oversized payload, batch, export, and streaming abuse with threshold-based…Votes: 0GitHub stars: 2
- Webapp Api Security MisconfigurationOffensive testing for API security misconfigurations including verbose errors, debug endpoints, dangerous methods, CORS, and exposed management…Votes: 0GitHub stars: 2
- Webapp Api Security TestingSecurity-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR)…Votes: 0GitHub stars: 2
- Webapp Api SecuritySecurity evaluation and vulnerability identification across REST, GraphQL, and WebSocket APIs.Votes: 0GitHub stars: 2
- Webapp Api SsrfServer-Side Request Forgery testing on API endpoints that accept URLs, webhooks, callbacks, or file…Votes: 0GitHub stars: 2
- Webapp Api Unsafe Third Party ConsumptionTesting whether the target trusts data from third-party APIs, webhooks, or callbacks without sufficient validation, enabling injection, logic bypass, or data…Votes: 0GitHub stars: 2
- Webapp Application Attack Surface ModelingBuild a working model of the application as a system - roles, resources, workflows, state transitions, trust and tenant boundaries - from black-box behavior, and turn that model into prioritized hypotheses. The foundation skill that converts a recon endpoint list into application-level reasoning.Votes: 0GitHub stars: 2
- Webapp Application Data Exposure TestingDistinguish real unauthorized data exposure from harmless metadata - response field differentials by role and tenant, over-fetching, alternate serializers and exports, error responses, notifications, audit logs, cached content - requiring meaningful confidentiality or authorization impact to report.Votes: 0GitHub stars: 2
- Webapp Application Security TestingApplication security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan.Votes: 0GitHub stars: 2
- Webapp Attack Surface InventoryStructured normalization of discovered attack surface into the Endpoint Inventory note for downstream…Votes: 0GitHub stars: 2
- Webapp Auditing Cloud With Cis BenchmarksThis skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP.Votes: 0GitHub stars: 2
- Webapp Auditing Kubernetes Cluster RbacAuditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.Votes: 0GitHub stars: 2
- Webapp Auditing Terraform Infrastructure For SecurityAuditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.Votes: 0GitHub stars: 2
- Webapp Auditing Tls Certificate Transparency LogsMonitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains.Votes: 0GitHub stars: 2
- Webapp Auth Offensive JwtJWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction.Votes: 0GitHub stars: 2
- Webapp Auth Offensive OauthOAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.Votes: 0GitHub stars: 2
- Webapp Authenticated Surface MappingMapping authenticated routes, role boundaries, and session behavior for authorized access-control…Votes: 0GitHub stars: 2
- Webapp Authentication Session TestingBlack-box testing of the full authentication and session lifecycle - registration, login, MFA, password reset, recovery, email change, logout, refresh, device trust - and session token handling including fixation, invalidation, replay, and cross-context binding.Votes: 0GitHub stars: 2
- Webapp Authorization TestingApplication-level authorization methodology - horizontal, vertical, and tenant boundary testing, ownership transitions, method and route differentials. Replay legitimate privileged requests with lower privilege using authz_matrix first to produce differential evidence.Votes: 0GitHub stars: 2
- Webapp Automating Ioc EnrichmentAutomates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.Votes: 0GitHub stars: 2
- Webapp Browser AutomationHeadless browser and UI automation for web vulnerability verification and interaction replay.Votes: 0GitHub stars: 2
- SupportRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.Votes: 0GitHub stars: 2
- Webapp Browser Extension ReverseReverse engineering and security review of Chrome and Firefox browser extensions.Votes: 0GitHub stars: 2
- Webapp Building Adversary Infrastructure Tracking SystemBuild an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.Votes: 0GitHub stars: 2
- Webapp Building Automated Malware Submission PipelineBuilds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration.Votes: 0GitHub stars: 2
- Webapp Building Cloud Siem With SentinelThis skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations.Votes: 0GitHub stars: 2
- Webapp Building Detection Rule With Splunk SplBuild effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.Votes: 0GitHub stars: 2
- Webapp Building Detection Rules With SigmaBuilds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel.Votes: 0GitHub stars: 2