Security & Testing Agent Skills

Secure Exa API keys, implement content moderation, and manage domain

Executes authorized attack simulations against Active Directory environments

Executes authorized phishing simulation campaigns to assess an organization''s

Build the foundational red team engagement plan - scope definition, Rules

Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s

BloodHound is a graph-based Active Directory reconnaissance tool that

Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP…

Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them…

Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced…

Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or…

Identifies and exploits insecure local data storage vulnerabilities

Identifies and exploits IPv6-specific vulnerabilities including SLAAC

Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to…

Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan)…

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's…

Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278

Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB,

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations

Identifies and exploits SMB protocol vulnerabilities using Metasploit

Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities

Exploits PHP type juggling vulnerabilities caused by loose (==) comparison