All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,147
- 1,298
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 15,121–15,144 of 31,147 skills
- Cyber Exploiting Adcs With CertipyEnumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.Votes: 0GitHub stars: 2
- Cyber Exploiting Active Directory With BloodhoundBloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attacVotes: 0GitHub stars: 2
- Cyber Exploiting Active Directory Certificate Services Esc1Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.Votes: 0GitHub stars: 2
- Cyber Bypassing Authentication With Forced BrowsingDiscovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.Votes: 0GitHub stars: 2
- Cyber Attacking Oauth With Device Code PhishingRun OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.Votes: 0GitHub stars: 2
- Cyber Attacking Entra Id With RoadtoolsEnumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.Votes: 0GitHub stars: 2
- Cyber Abusing Shadow Credentials For PrivescTake over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.Votes: 0GitHub stars: 2
- Cyber Abusing Dpapi For Credential AccessExtract DPAPI-protected secrets such as credentials and browser data offline and online.Votes: 0GitHub stars: 2
- Nexus Security HardeningWave-2 security hardening for Nexus Link — runs the diagnostic tools, dispatches the MURE build, verifies the gates. Invoke for \"wave 2\", \"security hardening\", \"nexus security\", \"pre-customer security\", \"rls audit\", \"audit chain verify\", \"antipattern scan\".Votes: 0GitHub stars: 2
- Nex VaultSecure local contract and document vault for managing business agreements with automatic expiration tracking, renewal deadline alerts, and compliance monitoring. Use when the user says \"track my contracts\", \"when does this lease expire\", \"add a new contract\", \"show me upcoming renewals\", \"what's my total subscription cost\", or when managing business agreements, leases, insurance policies, and SLAs with deadline awareness.Votes: 0GitHub stars: 2
- Cyber Triaging Vulnerabilities With Ssvc FrameworkTriage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.Votes: 0GitHub stars: 2
- Cyber Testing Jwt Token SecurityAssessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.Votes: 0GitHub stars: 2
- Cyber Testing For Xxe Injection VulnerabilitiesDiscovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.Votes: 0GitHub stars: 2
- Cyber Testing For Xss Vulnerabilities With BurpsuiteIdentifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.Votes: 0GitHub stars: 2
- Cyber Testing For Xml Injection VulnerabilitiesTest web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.Votes: 0GitHub stars: 2
- Cyber Testing For Sensitive Data ExposureIdentifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.Votes: 0GitHub stars: 2
- Cyber Testing For Open Redirect VulnerabilitiesIdentify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.Votes: 0GitHub stars: 2
- Cyber Testing For Json Web Token VulnerabilitiesTest JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.Votes: 0GitHub stars: 2
- Cyber Testing For Host Header InjectionTest web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.Votes: 0GitHub stars: 2
- Cyber Testing For Business Logic VulnerabilitiesIdentifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.Votes: 0GitHub stars: 2
- Cyber Testing For Broken Access ControlSystematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.Votes: 0GitHub stars: 2
- Cyber Testing Api For Mass Assignment VulnerabilityTests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2Votes: 0GitHub stars: 2
- Cyber Testing Api For Broken Object Level AuthorizationTests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically replaces them with IDs belonging to other users to determVotes: 0GitHub stars: 2
- Cyber Securing Serverless FunctionsThis skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.Votes: 0GitHub stars: 2