All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,805
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,225–19,248 of 31,805 skills
- Hunting For Dcom Lateral MovementHunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) correlation, WMI event analysis, RPC endpoint mapper traffic on port 135, and DCOM-specific parent-child process relationships.Votes: 0GitHub stars: 61
- Hunting Credential Stuffing AttacksDetects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.Votes: 0GitHub stars: 61
- Hardening Windows Endpoint With Cis BenchmarkHardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.Votes: 0GitHub stars: 61
- Hardening Docker Containers For ProductionHardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leasVotes: 0GitHub stars: 61
- Github ApiOrchestrates comprehensive GitHub API access across all services. Intelligently routes API operations to specialized resource files covering authentication, repositories, issues/PRs, workflows, security, and more. Use when implementing GitHub integrations, automating operations, or building applications that interact with GitHub.Votes: 0GitHub stars: 61
- Fix ReviewReview security fixes and patches for completeness and correctness.Votes: 0GitHub stars: 61
- Extracting Windows Event Logs ArtifactsExtract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.Votes: 0GitHub stars: 61
- Extracting Memory Artifacts With RekallUses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.Votes: 0GitHub stars: 61
- Extracting Credentials From Memory DumpExtract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.Votes: 0GitHub stars: 61
- Extracting Config From Agent Tesla RatExtract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.Votes: 0GitHub stars: 61
- Extracting Browser History ArtifactsExtract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.Votes: 0GitHub stars: 61
- Exploiting Zerologon Vulnerability Cve 2020 1472Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.Votes: 0GitHub stars: 61
- Exploiting Websocket VulnerabilitiesTesting WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.Votes: 0GitHub stars: 61
- Exploiting Vulnerabilities With Metasploit FrameworkThe Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modulesVotes: 0GitHub stars: 61
- Exploiting Type Juggling VulnerabilitiesExploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.Votes: 0GitHub stars: 61
- Exploiting Template Injection VulnerabilitiesDetecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.Votes: 0GitHub stars: 61
- Exploiting Sql Injection With SqlmapDetecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.Votes: 0GitHub stars: 61
- Exploiting Sql Injection VulnerabilitiesIdentifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testi...Votes: 0GitHub stars: 61
- Exploiting Smb Vulnerabilities With MetasploitIdentifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.Votes: 0GitHub stars: 61
- Exploiting Server Side Request ForgeryIdentifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.Votes: 0GitHub stars: 61
- Exploiting Oauth MisconfigurationIdentifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.Votes: 0GitHub stars: 61
- Exploiting Nosql Injection VulnerabilitiesDetect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.Votes: 0GitHub stars: 61
- Exploiting Nopac Cve 2021 42278 42287Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.Votes: 0GitHub stars: 61
- Exploiting Ms17 010 Eternalblue VulnerabilityMS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, itVotes: 0GitHub stars: 61