Claude Skills by mukul975

'Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication

'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated

'Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they

Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated

Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain

Systematically testing web applications for broken access control vulnerabilities including privilege escalation,

Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege

Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid

Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters,

Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage,

Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks

Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater

'Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into

Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF,

Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization

'Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication,

'Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception,

Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification,

'Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control

'Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events,

Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response

'Performs initial triage of security incidents to determine severity, scope, and required response actions using

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision

Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection,

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal,

'Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application

'Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history,

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable

'Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs,

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,

'This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS,

'Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,

'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous

'Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and

'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains

'Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using

Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS

Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library

'Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with

'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify

'Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning,