All authors
Claude Skills by nuroctane
github.com/nuroctane628 skills2 installs1,111 views
- Performing Purple Team Atomic Testing'Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeamVotes: 0GitHub stars: 3
- Performing Ransomware Response'Executes a structured ransomware incident response from detection throughVotes: 0GitHub stars: 3
- Performing Ransomware Tabletop Exercise'Plans and facilitates tabletop exercises simulating ransomware incidents,Votes: 0GitHub stars: 3
- Performing Red Team Phishing With GophishAutomates GoPhish phishing simulation campaigns using the Python gophishVotes: 0GitHub stars: 3
- Performing Red Team With CovenantConducts red team operations using the Covenant C2 framework for authorizedVotes: 0GitHub stars: 3
- Performing Service Account Credential RotationAutomates credential rotation for service accounts across Active Directory,Votes: 0GitHub stars: 3
- Performing Soap Web Service Security TestingPerforms security testing of SOAP web services by analyzing WSDL definitionsVotes: 0GitHub stars: 3
- Performing Sqlite Database ForensicsPerforms forensic analysis of SQLite databases by examining B-tree pageVotes: 0GitHub stars: 3
- Performing Ssl Certificate Lifecycle ManagementAutomates the full SSL/TLS certificate lifecycle, including generatingVotes: 0GitHub stars: 3
- Performing Ssl Stripping AttackSimulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms. Use when performing an authorized penetration test to validate HSTS preloading and TLS certificate handling, demonstrate downgrade-attack risk to stakeholders, or train SOC teams to detect SSL stripping indicators in network traffic.Votes: 0GitHub stars: 3
- Performing Ssl Tls Inspection ConfigurationConfigure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and exfiltration detection, including deploying trusted CA certificates, managing exemptions for certificate-pinned apps, and privacy compliance. Use when setting up or auditing TLS inspection on network security devices to close the encrypted-traffic blind spot.Votes: 0GitHub stars: 3
- Performing Ssl Tls Security AssessmentAssess SSL/TLS server configurations using the sslyze Python scanning library to evaluate supported protocol versions, cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and known vulnerabilities such as Heartbleed and ROBOT. Use when conducting a security assessment of a server's TLS configuration or verifying remediation of cipher/certificate weaknesses.Votes: 0GitHub stars: 3
- Performing Ssrf Vulnerability ExploitationTests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azure at 169.254.169.254), internal network services, and protocol handlers (file://, gopher://, dict://) using a Python script, including IP-encoding bypass and DNS rebinding checks. Use during authorized penetration testing to confirm SSRF in a URL-fetching parameter and generate a vulnerability report.Votes: 0GitHub stars: 3
- Performing Static Malware Analysis With Pe StudioPerforms static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.Votes: 0GitHub stars: 3
- Performing Steganography DetectionDetects and extracts hidden data embedded in images, audio, and other media files using steganalysis tools such as StegDetect, zsteg, stegsolve, binwalk, steghide, and OpenStego to uncover covert communication channels. Use when investigating suspected data hiding or exfiltration via media files, espionage/insider-threat cases, or anomalies in media file properties found during standard file analysis.Votes: 0GitHub stars: 3
- Performing Supply Chain Attack SimulationSimulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular PyPI package names, dependency confusion testing against private registries, SHA-256 package hash verification, and known-CVE scanning with pip-audit. Use when auditing a project's dependencies for malicious or confused packages, or when assessing package-registry supply-chain risk.Votes: 0GitHub stars: 3
- Performing Threat Intelligence Sharing With MispUses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK tags and galaxy clusters, manage sharing groups and distribution levels, search existing intelligence, and export in STIX 2.1 format. Use when creating, enriching, or sharing threat intelligence events on a MISP instance, or integrating IOC feeds with other platforms.Votes: 0GitHub stars: 3
- Performing Threat Landscape Assessment For SectorConducts a sector-specific threat landscape assessment (financial, healthcare, energy, government, etc.) by profiling targeting threat actors, mapping attack vectors and MITRE ATT&CK TTPs with the attackcti/pandas Python stack, and analyzing exploited CVEs and incident trends from ISAC and vendor reports. Use when producing CTI for risk management or board-level reporting on an industry's threat exposure.Votes: 0GitHub stars: 3
- Performing Threat Modeling With Owasp Threat DragonUses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance.Votes: 0GitHub stars: 3
- Performing Timeline Reconstruction With PlasoBuilds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.Votes: 0GitHub stars: 3
- Performing Vlan Hopping AttackSimulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port security. Use during an authorized penetration test to validate trunk port hardening, confirm DTP is disabled on access ports, and demonstrate Layer 2 segmentation bypass risk to network teams.Votes: 0GitHub stars: 3
- Performing Web Application Firewall BypassBypasses Web Application Firewall protections using encoding tricks,Votes: 0GitHub stars: 3
- Performing Web Application Scanning With NiktoRuns Nikto, an open-source web server and web application scanner,Votes: 0GitHub stars: 3
- Performing Web Application Vulnerability TriageTriages web application vulnerability findings from DAST/SAST scannersVotes: 0GitHub stars: 3
- Performing Web Cache Deception AttackExecutes web cache deception attacks by exploiting path normalizationVotes: 0GitHub stars: 3
- Performing Windows Artifact Analysis With Eric Zimmerman ToolsPerforms comprehensive Windows forensic artifact analysis using EricVotes: 0GitHub stars: 3
- Performing Yara Rule Development For DetectionDevelops precise YARA and YARA-X rules for malware detection by identifyingVotes: 0GitHub stars: 3
- Recovering Deleted Files With PhotorecRecovers deleted files from disk images and storage media using PhotoRec'sVotes: 0GitHub stars: 3
- Recovering From Ransomware Attack'Executes structured ransomware incident recovery following NIST/CISAVotes: 0GitHub stars: 3
- Remediating S3 Bucket Misconfiguration'Provides step-by-step procedures for remediating Amazon S3 bucketVotes: 0GitHub stars: 3
- Reverse Engineering Android Malware With Jadx'Reverse engineers malicious Android APK files using the JADX decompilerVotes: 0GitHub stars: 3
- Reverse Engineering Dotnet Malware With Dnspy'Reverse engineers .NET malware samples using the dnSpy decompiler andVotes: 0GitHub stars: 3
- Reverse Engineering Malware With Ghidra'Reverse engineers malware binaries using NSA''s Ghidra disassembler andVotes: 0GitHub stars: 3
- Reverse Engineering Rust MalwareReverse engineers Rust-compiled malware using IDA Pro and Ghidra, coveringVotes: 0GitHub stars: 3
- Scanning Container Images With GrypeScans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds and failure gates. Use when Grype or Syft is the chosen toolchain, when scanning an existing SBOM rather than an image, or when gating a build on severity. Keywords: Grype, Syft, SBOM, NVD, GitHub Advisory, --fail-on, severity threshold. Do not use when the toolchain is Trivy - use sc...Votes: 0GitHub stars: 3
- Scanning Containers With Trivy In Cicd'Integrates Aqua Security''s Trivy scanner into CI/CD pipelines to detectVotes: 0GitHub stars: 3
- Scanning Docker Images With TrivyScans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy, image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for cluster-wide scanning or non-image targets - use performing-cont...Votes: 0GitHub stars: 3
- Scanning Kubernetes Manifests With KubesecScores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanni...Votes: 0GitHub stars: 3
- Scanning Network With Nmap Advanced'Performs advanced network recon using Nmap''s Scripting Engine (NSE),Votes: 0GitHub stars: 3
- Securing Api Gateway With Aws Waf'Secures AWS API Gateway endpoints with AWS WAF by configuring managedVotes: 0GitHub stars: 3
- Securing Aws Iam Permissions'Hardens AWS IAM configurations to enforce least-privilege access, coveringVotes: 0GitHub stars: 3
- Securing Aws Lambda Execution Roles'Hardens AWS Lambda execution roles by writing least-privilege IAM policies,Votes: 0GitHub stars: 3
- Securing Azure With Microsoft Defender'Deploys and configures Microsoft Defender for Cloud as a CNAPP forVotes: 0GitHub stars: 3
- Securing Container Registry Images'Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanningVotes: 0GitHub stars: 3
- Securing Container Registry With HarborConfigures the security features of the Harbor open-source container registry - integrated Trivy scanning, Cosign and Notary content trust policies, project-level RBAC, immutable tag and retention rules, and OIDC authentication - to enforce provenance and block deployment of vulnerable images. Use when deploying or hardening Harbor, or when compliance requires that only signed and scanned images can be pulled. Keywords: Harbor, project policy, content trust, immutable tag, retention, robot ac...Votes: 0GitHub stars: 3
- Securing Github Actions Workflows'Hardens GitHub Actions workflows against supply chain attacks, credentialVotes: 0GitHub stars: 3
- Securing Helm Chart DeploymentsSecures Helm chart deployments by verifying chart signatures and provenance, rendering and linting templates for misconfiguration, enforcing pod security contexts through values.yaml, moving secrets into an external store instead of Helm values, and scoping RBAC for Helm operations in CI/CD. Use when deploying charts to Kubernetes or reviewing chart provenance, templates, or release RBAC. Keywords: Helm, provenance file, helm verify, helm lint, values.yaml, Tiller-less, release RBAC, external...Votes: 0GitHub stars: 3
- Securing Historian Server In Ot Environment'Audits and hardens process historian servers (OSIsoft PI, Honeywell PHD,Votes: 0GitHub stars: 3
- Securing Kubernetes On Cloud'Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementingVotes: 0GitHub stars: 3
- Securing Remote Access To Ot Environment'Designs and configures secure remote access to OT/ICS environments forVotes: 0GitHub stars: 3