brucesongs/kali-claw - الصفحة ٤

darkweb-intel

Dark web intelligence gathering — Tor/onion service reconnaissance, marketplace monitoring, breach data markets, threat actor profiling, with strict OPSEC for investigators.

لغة النص الأصلي: الإنجليزية

database-attack

Direct attacks against database servers at the protocol level — distinct from web-based SQL injection (covered by web-sqli). This skill targets database listeners, authentication mechanisms, stored procedures, and protocol-level misconfigurations.

لغة النص الأصلي: الإنجليزية

digital-forensics

Digital forensics covers the complete workflow of disk forensics, memory forensics, network forensics, file recovery/carving, and chain of custody.

لغة النص الأصلي: الإنجليزية

cms-framework-attack

Targeted security assessment of Content Management Systems (WordPress, Joomla, Drupal) using specialized scanners and exploit techniques.

لغة النص الأصلي: الإنجليزية

crypto-attacks

Cryptographic Attacks target implementation flaws and algorithm weaknesses in encryption systems, covering OWASP A04: Cryptographic Failures.

لغة النص الأصلي: الإنجليزية

av-edr-evasion

AV/EDR evasion covers techniques for bypassing antivirus (AV) and Endpoint Detection/Response (EDR) solutions during payload delivery, execution, and post-exploitation.

لغة النص الأصلي: الإنجليزية

ci-cd-supply-chain-attack

CI/CD pipeline and software supply chain compromise covering Jenkins (script console, Jenkinsfile injection, shared library abuse, CVE-2024-23897 args4j), GitLab CI/CD (runner abuse, .gitlab-ci.yml injection, self-hosted runner takeover, CVE-2022-1162,…

لغة النص الأصلي: الإنجليزية

cloud-identity-attack

Cloud identity provider attacks covering Azure AD/Entra ID, Okta, Auth0, Ping, AWS IAM Identity Center, and Google Workspace — including OAuth 2.0 token theft, OIDC redirect abuse, SAML response forgery, conditional access bypass, MFA fatigue, federation…

لغة النص الأصلي: الإنجليزية

ai-fuzzing

AI-assisted fuzzing for automated vulnerability discovery. Coverage-guided fuzzing engines, AI-driven seed generation, intelligent mutation strategies, and systematic crash triage.

لغة النص الأصلي: الإنجليزية

api-security

API Security Testing covers security assessment across three major API architectures: REST, GraphQL, and gRPC, focusing on the OWASP API Security Top 10 core risks: Broken Authentication, Broken Object Level Authorization (BOLA), Excessive Data Exposure, Rate…

لغة النص الأصلي: الإنجليزية

container-security

Container security covers the complete lifecycle from image building, registry management, runtime protection, to orchestration platform (Kubernetes) security.

لغة النص الأصلي: الإنجليزية

exploit-development

Exploit development covers the full chain from vulnerability discovery through crash analysis to working exploit code, spanning buffer overflows, ROP chains, format string bugs, and shellcode injection across x86 and ARM architectures.

لغة النص الأصلي: الإنجليزية

network-pentest

Network penetration testing covering the full attack chain from reconnaissance, port scanning, and service fingerprinting through vulnerability assessment, exploitation, traffic sniffing, and MITM attacks.

لغة النص الأصلي: الإنجليزية

osint

A specialized skill for intelligence gathering using publicly available sources.

لغة النص الأصلي: الإنجليزية

post-exploitation

Post-exploitation covers the complete attack chain after obtaining initial access: privilege escalation, persistence, lateral movement, data collection and exfiltration, and covering tracks.

لغة النص الأصلي: الإنجليزية

privilege-escalation

Privilege escalation is the process of elevating access from a low-privileged user context (standard user, service account, or limited shell) to root on Linux or SYSTEM/Administrator on Windows.

لغة النص الأصلي: الإنجليزية

social-engineering

Social engineering is the art of exploiting human psychological weaknesses rather than technical vulnerabilities to execute attacks. Attack vectors encompass Phishing, Pretexting, Baiting, Tailgating, Vishing, and other techniques.

لغة النص الأصلي: الإنجليزية

web-auth-bypass

Authentication Bypass refers to attackers exploiting design flaws or implementation vulnerabilities in authentication mechanisms to bypass the normal authentication process and gain unauthorized access.

لغة النص الأصلي: الإنجليزية

web-xss

XSS (Cross-Site Scripting) is an attack that injects malicious scripts into trusted websites.

لغة النص الأصلي: الإنجليزية