implementing-api-gateway-security-controls

Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.

Zur Installation springen

Repository: mukul975/Anthropic-Cybersecurity-Skills
Letzte Quellaktivität: 2. August 2026 um 16:32
Erkannte Sprache von SKILL.md: Englisch
Sterne: 27.732
Forks: 3.366

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-api-gateway-security-controls

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

4 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

Alle aus diesem Repository ansehen

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

# kong.yml - Declarative Kong configuration with security plugins _format_version: "3.0" services: - name: user-service url: http://user-service:8080 routes: - name: user-api paths: - /api/v1/users methods: - GET - POST - PUT - PATCH - DELETE strip_path:

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

import boto3 import json apigw = boto3.client('apigatewayv2') # Create API with mutual TLS api_response = apigw.create_api( Name='secure-api', ProtocolType='HTTP', DisableExecuteApiEndpoint=True, # Force custom domain ) api_id = api_response['ApiId'] # Configure authorizer (JWT with Cognito) authorizer = apigw.create_authorizer( ApiId=api_id, AuthorizerType='JWT', IdentitySource='$request.header.Authorization', Name='cognito-jwt-authorizer', JwtConfiguration={ 'Audience': ['your-app-client-id'], 'Issuer': 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx' } ) # Create route with authorizer apigw.create_route( ApiId=api_id, RouteKey='GET /api/v1/users', AuthorizerId=authorizer['AuthorizerId'], AuthorizationType='JWT', ) # Configure throttling apigw.create_stage( ApiId=api_id, StageName='prod', DefaultRouteSettings={ 'ThrottlingBurstLimit': 100, 'ThrottlingRateLimit': 50.0, # 50 requests per second }, AccessLogSettings={ 'DestinationArn': 'arn:aws:logs:us-east-1:123456789:log-group:api-access-logs', 'Format': json.dumps({ 'requestId': '$context.requestId', 'ip': '$context.identity.sourceIp', 'caller': '$context.identity.caller', 'user': '$context.identity.user', 'requestTime': '$context.requestTime', 'httpMethod': '$context.httpMethod', 'resourcePath': '$context.resourcePath', 'status': '$context.status', 'protocol': '$context.protocol', 'responseLength': '$context.responseLength' }) } ) # WAF association waf = boto3.client('wafv2') web_acl = waf.create_web_acl( Name='api-security-acl', Scope='REGIONAL', DefaultAction={'Allow': {}}, Rules=[ { 'Name': 'AWS-AWSManagedRulesSQLiRuleSet', 'Priority': 1, 'Statement': { 'ManagedRuleGroupStatement': { 'VendorName': 'AWS', 'Name': 'AWSManagedRulesSQLiRuleSet' } }, 'OverrideAction': {'None': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'SQLiRuleSet' } }, { 'Name': 'RateLimit', 'Priority': 2, 'Statement': { 'RateBasedStatement': { 'Limit': 2000, 'AggregateKeyType': 'IP' } }, 'Action': {'Block': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'RateLimitRule' } }, ], VisibilityConfig={ 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'ApiSecurityACL' } )

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

Term	Definition
API Gateway	Centralized entry point for all API traffic that enforces authentication, authorization, rate limiting, and request validation before routing to backend services
Rate Limiting	Controlling the number of API requests per client within a time window to prevent abuse and ensure fair resource allocation
Request Validation	Verifying that incoming API requests conform to the expected schema (data types, required fields, value ranges) before forwarding to backend services
Mutual TLS (mTLS)	Two-way TLS authentication where both the client and server present certificates, providing strong identity verification for API-to-API communication
WAF Integration	Web Application Firewall rules applied at the API gateway to block common attack patterns (SQLi, XSS, path traversal)
OAuth2/OIDC	Token-based authentication protocols where the gateway validates JWT tokens against an identity provider before allowing access

implementing-api-gateway-security-controls

Installationsoptionen

Quelldateien prüfen