AgentFlocks/flocks - الصفحة ١٨

performing-ssl-stripping-attack

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms that protect users from downgrade attacks on encrypted connections.

لغة النص الأصلي: الإنجليزية

performing-ssl-tls-inspection-configuration

Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.

لغة النص الأصلي: الإنجليزية

performing-ssl-tls-security-assessment

Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known vulnerabilities like Heartbleed and ROBOT.

لغة النص الأصلي: الإنجليزية

performing-ssrf-vulnerability-exploitation

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning…

لغة النص الأصلي: الإنجليزية

performing-static-malware-analysis-with-pe-studio

Performs static analysis of Windows PE (Portable Executable) malware samples using PEStudio to examine file headers, imports, strings, resources, and indicators without executing the binary. Identifies suspicious characteristics including packing,…

لغة النص الأصلي: الإنجليزية

performing-steganography-detection

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

لغة النص الأصلي: الإنجليزية

performing-subdomain-enumeration-with-subfinder

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.

لغة النص الأصلي: الإنجليزية

performing-supply-chain-attack-simulation

Simulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance, dependency confusion testing against private registries, package hash verification with pip, and known vulnerability scanning with pip-audit.

لغة النص الأصلي: الإنجليزية

performing-thick-client-application-penetration-test

Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite.

لغة النص الأصلي: الإنجليزية

performing-threat-emulation-with-atomic-red-team

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules,…

لغة النص الأصلي: الإنجليزية

performing-threat-hunting-with-elastic-siem

Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate…

لغة النص الأصلي: الإنجليزية

performing-threat-hunting-with-yara-rules

Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.

لغة النص الأصلي: الإنجليزية

performing-threat-intelligence-sharing-with-misp

Use PyMISP to create, enrich, and share threat intelligence events on a MISP platform, including IOC management, feed integration, STIX export, and community sharing workflows.

لغة النص الأصلي: الإنجليزية

performing-threat-landscape-assessment-for-sector

Conduct a sector-specific threat landscape assessment by analyzing threat actor targeting patterns, common attack vectors, and industry-specific vulnerabilities to inform organizational risk management.

لغة النص الأصلي: الإنجليزية

performing-threat-modeling-with-owasp-threat-dragon

Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review.

لغة النص الأصلي: الإنجليزية

performing-timeline-reconstruction-with-plaso

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

لغة النص الأصلي: الإنجليزية

performing-user-behavior-analytics

Performs User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC…

لغة النص الأصلي: الإنجليزية

performing-vlan-hopping-attack

Simulates VLAN hopping attacks using switch spoofing and double tagging techniques in authorized environments to test VLAN segmentation effectiveness and validate switch port security configurations against Layer 2 bypass attacks.

لغة النص الأصلي: الإنجليزية

performing-vulnerability-scanning-with-nessus

Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner…

لغة النص الأصلي: الإنجليزية

performing-web-application-firewall-bypass

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

لغة النص الأصلي: الإنجليزية

performing-web-application-penetration-test

Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses…

لغة النص الأصلي: الإنجليزية

performing-web-application-scanning-with-nikto

Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies ve

لغة النص الأصلي: الإنجليزية

performing-web-application-vulnerability-triage

Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation.

لغة النص الأصلي: الإنجليزية

performing-web-cache-deception-attack

Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve sensitive authenticated content.

لغة النص الأصلي: الإنجليزية

performing-web-cache-poisoning-attack

Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.

لغة النص الأصلي: الإنجليزية

performing-wifi-password-cracking-with-aircrack

Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.

لغة النص الأصلي: الإنجليزية

performing-windows-artifact-analysis-with-eric-zimmerman-tools

Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry hives, prefetch files, event logs, and file system metadata.

لغة النص الأصلي: الإنجليزية

performing-wireless-network-penetration-test

Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.

لغة النص الأصلي: الإنجليزية

performing-wireless-security-assessment-with-kismet

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

لغة النص الأصلي: الإنجليزية

performing-yara-rule-development-for-detection

Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.

لغة النص الأصلي: الإنجليزية

prioritizing-vulnerabilities-with-cvss-scoring

The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r

لغة النص الأصلي: الإنجليزية

processing-stix-taxii-feeds

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional…

لغة النص الأصلي: الإنجليزية

profiling-threat-actor-groups

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources.…

لغة النص الأصلي: الإنجليزية

recovering-deleted-files-with-photorec

Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.

لغة النص الأصلي: الإنجليزية

recovering-from-ransomware-attack

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset,…

لغة النص الأصلي: الإنجليزية

remediating-s3-bucket-misconfiguration

This skill provides step-by-step procedures for identifying and remediating Amazon S3 bucket misconfigurations that expose sensitive data to unauthorized access. It covers enabling S3 Block Public Access at account and bucket levels, auditing bucket policies…

لغة النص الأصلي: الإنجليزية

reverse-engineering-android-malware-with-jadx

Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions,…

لغة النص الأصلي: الإنجليزية

reverse-engineering-dotnet-malware-with-dnspy

Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests…

لغة النص الأصلي: الإنجليزية

reverse-engineering-ios-app-with-frida

Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS…

لغة النص الأصلي: الإنجليزية

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse…

لغة النص الأصلي: الإنجليزية