Menu
Skills in this repository
SkillsMP has collected 1,033 skills from nexuslinkproductions/yuri-os. Open a skill to review its source and details.
nexuslinkproductions/yuri-osShowing 40 of 1,033 collected skills.
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files,…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Exploits JWT algorithm confusion vulnerabilities where the server''s token verification library accepts the algorithm specified in the JWT header rather than…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security…
[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password…
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.
Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule…
Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts…
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
Deploy a Velociraptor server and agents and write VQL hunts across a fleet.
Produce and ingest CycloneDX and SPDX SBOMs and correlate them to vulnerability intelligence.
Produce Sigma-based EVTX timelines and summaries with Hayabusa.
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products…
Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas
Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing…
Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit…
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating…
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.