All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,691
- 1,321
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 20,353–20,376 of 31,691 skills
- Exploiting Jwt Algorithm Confusion AttackExploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.Votes: 0GitHub stars: 67
- Exploiting Insecure DeserializationIdentifying and exploiting insecure deserialization vulnerabilities inVotes: 0GitHub stars: 67
- Exploiting Idor VulnerabilitiesIdentifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.Votes: 0GitHub stars: 67
- Exploiting Http Request SmugglingDetects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.Votes: 0GitHub stars: 67
- Exploiting Constrained Delegation AbuseExploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.Votes: 0GitHub stars: 67
- Exploiting Broken Link HijackingDiscovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, and checking DNS/CNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.Votes: 0GitHub stars: 67
- Exploiting Active Directory With BloodhoundBloodHound is a graph-based Active Directory reconnaissance tool thatVotes: 0GitHub stars: 67
- Executing Red Team Exercise'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''sVotes: 0GitHub stars: 67
- Executing Red Team Engagement PlanningBuild the foundational red team engagement plan - scope definition, RulesVotes: 0GitHub stars: 67
- Executing Phishing Simulation Campaign'Executes authorized phishing simulation campaigns to assess an organization''sVotes: 0GitHub stars: 67
- Eradicating Malware From Infected SystemsSystematically map and remove malware, backdoors, and attacker persistenceVotes: 0GitHub stars: 67
- Detecting T1548 Abuse Elevation Control MechanismDetect abuse of elevation control mechanisms (T1548), including Windows UACVotes: 0GitHub stars: 67
- Detecting T1003 Credential Dumping With EdrDetect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAMVotes: 0GitHub stars: 67
- Detecting Supply Chain Attacks In Ci Cd'Scans GitHub Actions workflows and CI/CD pipeline configurations forVotes: 0GitHub stars: 67
- Detecting Stuxnet Style Attacks'Detects sophisticated cyber-physical attacks that follow the StuxnetVotes: 0GitHub stars: 67
- Detecting Spearphishing With Email GatewayDetect and block spearphishing emails that use personalized, researchedVotes: 0GitHub stars: 67
- Detecting Shadow It Cloud UsageDetect unauthorized SaaS and cloud service usage (shadow IT) by parsingVotes: 0GitHub stars: 67
- Detecting Rdp Brute Force AttacksDetect RDP brute force attacks by parsing Windows Security Event LogsVotes: 0GitHub stars: 67
- Detecting Ransomware Precursors In Network'Detects early-stage ransomware indicators in network traffic beforeVotes: 0GitHub stars: 67
- Detecting Process Hollowing TechniqueDetect process hollowing (MITRE T1055.012) by analyzing memory-mappedVotes: 0GitHub stars: 67
- Detecting Privilege Escalation In Kubernetes PodsDetects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do n...Votes: 0GitHub stars: 67
- Detecting Pass The Ticket AttacksDetect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.Votes: 0GitHub stars: 67
- Detecting Oauth Token TheftDetect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.Votes: 0GitHub stars: 67
- Detecting Ntlm Relay With Event CorrelationDetect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.Votes: 0GitHub stars: 67