All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,697
- 1,321
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 20,401–20,424 of 31,697 skills
- Configuring Oauth2 Authorization FlowConfigures secure OAuth 2.0 authorization flows, including AuthorizationVotes: 0GitHub stars: 67
- Configuring Network Segmentation With Vlans'Designs and implements VLAN-based (802.1Q) network segmentation onVotes: 0GitHub stars: 67
- Configuring Multi Factor Authentication With DuoDeploys Cisco Duo multi-factor authentication across enterprise applications,Votes: 0GitHub stars: 67
- Configuring Ldap Security HardeningHardens LDAP directory services against credential harvesting, LDAPVotes: 0GitHub stars: 67
- Configuring Identity Aware Proxy With Google Iap'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforceVotes: 0GitHub stars: 67
- Configuring Hsm For Key StorageConfigures Hardware Security Modules for cryptographic key storageVotes: 0GitHub stars: 67
- Configuring Certificate Authority With OpensslBuild a two-tier PKI Certificate Authority hierarchy (offline Root CAVotes: 0GitHub stars: 67
- Configuring Active Directory Tiered ModelImplement Microsoft's Enhanced Security Admin Environment (ESAE) tieredVotes: 0GitHub stars: 67
- Conducting Social Engineering Pretext CallPlan and execute authorized vishing (voice phishing) pretext calls toVotes: 0GitHub stars: 67
- Conducting Social Engineering Penetration TestDesign and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.Votes: 0GitHub stars: 67
- Conducting Phishing Incident ResponseRespond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.Votes: 0GitHub stars: 67
- Conducting Pass The Ticket AttackPerform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.Votes: 0GitHub stars: 67
- Conducting Internal Reconnaissance With Bloodhound CeConduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.Votes: 0GitHub stars: 67
- Conducting Full Scope Red Team EngagementPlan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.Votes: 0GitHub stars: 67
- Conducting Domain Persistence With DcsyncPerform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.Votes: 0GitHub stars: 67
- Collecting Volatile Evidence From Compromised HostCollect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.Votes: 0GitHub stars: 67
- Building Vulnerability Exception Tracking SystemBuild a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.Votes: 0GitHub stars: 67
- Building Vulnerability Dashboard With DefectdojoDeploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.Votes: 0GitHub stars: 67
- Building Vulnerability Aging And Sla TrackingImplement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.Votes: 0GitHub stars: 67
- Building Soc Playbook For Ransomware'Builds a structured SOC incident response playbook for ransomware attacksVotes: 0GitHub stars: 67
- Building Soc Escalation MatrixBuild a structured SOC escalation matrix defining severity tiers, responseVotes: 0GitHub stars: 67
- Building Red Team C2 Infrastructure With HavocDeploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMBVotes: 0GitHub stars: 67
- Websocket EngineerUse when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.Votes: 0GitHub stars: 20
- Terraform EngineerUse when implementing infrastructure as code with Terraform across AWS, Azure, or GCP. Invoke for module development (create reusable modules, manage module versioning), state management (migrate backends, import existing resources, resolve state conflicts), provider configuration, multi-environment workflows, and infrastructure testing.Votes: 0GitHub stars: 20