All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,789
- 1,325
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,129–19,152 of 31,789 skills
- Testing For Business Logic VulnerabilitiesIdentifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.Votes: 0GitHub stars: 61
- Testing For Broken Access ControlSystematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.Votes: 0GitHub stars: 61
- Testing Cors MisconfigurationIdentifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.Votes: 0GitHub stars: 61
- Testing Api Security With Owasp Top 10Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.Votes: 0GitHub stars: 61
- Testing Api For Broken Object Level AuthorizationTests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically replaces them with IDs belonging to other users to determine if the server enforces per-object authorization. This is OWASP API Security Top 10 2023 risk ...Votes: 0GitHub stars: 61
- Testing Api Authentication WeaknessesTests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token vali...Votes: 0GitHub stars: 61
- LibfuzzerFuzzing with libFuzzer for finding vulnerabilities in code.Votes: 0GitHub stars: 61
- Iot Device ProvisioningSecure provisioning for TizenRT/ARTIK IoT devices. Coordinates certificate installation, key management, and network onboarding.Votes: 0GitHub stars: 61
- Investigating Ransomware Attack ArtifactsIdentify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.Votes: 0GitHub stars: 61
- Investigating Phishing Email IncidentInvestigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.Votes: 0GitHub stars: 61
- Investigating Insider Threat IndicatorsInvestigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.Votes: 0GitHub stars: 61
- Intercepting Mobile Traffic With BurpsuiteIntercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.Votes: 0GitHub stars: 61
- Implementing Zero Trust In CloudThis skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.Votes: 0GitHub stars: 61
- Implementing Zero Trust For Saas ApplicationsImplementing zero trust access controls for SaaS applications using CASB, SSPM, conditional access policies, OAuth app governance, and session controls to enforce identity verification, device compliance, and data protection for cloud-hosted services.Votes: 0GitHub stars: 61
- Implementing Zero Knowledge Proof For AuthenticationZero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge of a secret (such as a password or private key) without revealing the secret itself. This skill implements the Schnorr identificatiVotes: 0GitHub stars: 61
- Implementing Vulnerability Management With GreenboneDeploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.Votes: 0GitHub stars: 61
- Implementing Ticketing System For IncidentsImplements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.Votes: 0GitHub stars: 61
- Implementing Threat Intelligence Lifecycle ManagementImplement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.Votes: 0GitHub stars: 61
- Implementing Syslog Centralization With RsyslogConfigure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.Votes: 0GitHub stars: 61
- Implementing Stix Taxii Feed IntegrationSTIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.Votes: 0GitHub stars: 61
- Implementing Soar Automation With PhantomImplements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.Votes: 0GitHub stars: 61
- Implementing Siem Correlation Rules For AptWrite multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.Votes: 0GitHub stars: 61
- Implementing Scim Provisioning With OktaImplement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.Votes: 0GitHub stars: 61
- Implementing Saml Sso With OktaImplement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, aVotes: 0GitHub stars: 61