autohandai/community-skills - الصفحة ٦

implementing-zero-trust-with-beyondcorp

Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal…

لغة النص الأصلي: الإنجليزية

implementing-zero-trust-with-hashicorp-boundary

Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.

لغة النص الأصلي: الإنجليزية

performing-bluetooth-security-assessment

Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities

لغة النص الأصلي: الإنجليزية

building-patch-tuesday-response-process

Establish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updates within risk-based remediation SLAs.

لغة النص الأصلي: الإنجليزية

building-vulnerability-aging-and-sla-tracking

Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against severity-based timelines and drive accountability.

لغة النص الأصلي: الإنجليزية

building-vulnerability-dashboard-with-defectdojo

Deploy DefectDojo as a centralized vulnerability management dashboard with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.

لغة النص الأصلي: الإنجليزية

building-vulnerability-exception-tracking-system

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.

لغة النص الأصلي: الإنجليزية

bypassing-authentication-with-forced-browsing

Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.

لغة النص الأصلي: الإنجليزية

exploiting-broken-link-hijacking

Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.

لغة النص الأصلي: الإنجليزية

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

لغة النص الأصلي: الإنجليزية

exploiting-idor-vulnerabilities

Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.

لغة النص الأصلي: الإنجليزية

exploiting-insecure-deserialization

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.

لغة النص الأصلي: الإنجليزية

exploiting-mass-assignment-in-rest-apis

Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.

لغة النص الأصلي: الإنجليزية

exploiting-nosql-injection-vulnerabilities

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.

لغة النص الأصلي: الإنجليزية

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

لغة النص الأصلي: الإنجليزية

exploiting-prototype-pollution-in-javascript

Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.

لغة النص الأصلي: الإنجليزية

exploiting-race-condition-vulnerabilities

Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.

لغة النص الأصلي: الإنجليزية

exploiting-server-side-request-forgery

Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.

لغة النص الأصلي: الإنجليزية

exploiting-sql-injection-with-sqlmap

Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

لغة النص الأصلي: الإنجليزية

exploiting-template-injection-vulnerabilities

Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.

لغة النص الأصلي: الإنجليزية

exploiting-type-juggling-vulnerabilities

Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.

لغة النص الأصلي: الإنجليزية

exploiting-vulnerabilities-with-metasploit-framework

The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modules

لغة النص الأصلي: الإنجليزية

exploiting-websocket-vulnerabilities

Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.

لغة النص الأصلي: الإنجليزية

implementing-attack-path-analysis-with-xm-cyber

Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets.

لغة النص الأصلي: الإنجليزية

implementing-cloud-vulnerability-posture-management

Implement Cloud Security Posture Management using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud vulnerability detection.

لغة النص الأصلي: الإنجليزية

implementing-continuous-security-validation-with-bas

Deploy Breach and Attack Simulation tools to continuously validate security control effectiveness by safely emulating real-world attack techniques across the kill chain.

لغة النص الأصلي: الإنجليزية

implementing-epss-score-for-vulnerability-prioritization

Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30 days.

لغة النص الأصلي: الإنجليزية

implementing-patch-management-workflow

Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patc

لغة النص الأصلي: الإنجليزية

implementing-rapid7-insightvm-for-scanning

Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.

لغة النص الأصلي: الإنجليزية

implementing-vulnerability-management-with-greenbone

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

لغة النص الأصلي: الإنجليزية

implementing-vulnerability-remediation-sla

Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs

لغة النص الأصلي: الإنجليزية

implementing-vulnerability-sla-breach-alerting

Build automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.

لغة النص الأصلي: الإنجليزية

implementing-web-application-logging-with-modsecurity

Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures…

لغة النص الأصلي: الإنجليزية

performing-active-directory-vulnerability-assessment

Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.

لغة النص الأصلي: الإنجليزية

performing-agentless-vulnerability-scanning

Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.

لغة النص الأصلي: الإنجليزية

performing-asset-criticality-scoring-for-vulns

Develop and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.

لغة النص الأصلي: الإنجليزية

performing-authenticated-scan-with-openvas

Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.

لغة النص الأصلي: الإنجليزية

performing-authenticated-vulnerability-scan

Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett

لغة النص الأصلي: الإنجليزية

performing-blind-ssrf-exploitation

Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.

لغة النص الأصلي: الإنجليزية

performing-clickjacking-attack-test

Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.

لغة النص الأصلي: الإنجليزية