agentHack-skills

Identify and exploit Linux cron job misconfigurations to escalate privileges from a low-privilege user to root. Covers writable cron scripts, world-writable PATH entries, wildcard injection, and cron-based reverse shells in isolated lab environments.

Identify and exploit OS command injection vulnerabilities in web applications where user-supplied input is passed unsanitized to a shell command. Covers in-band, blind, and out-of-band command injection techniques against deliberately vulnerable targets in isolated lab environments.

Perform ARP spoofing and man-in-the-middle (MITM) attacks within isolated LAN environments using arpspoof and ettercap to intercept traffic between two hosts. Covers ARP cache poisoning, traffic forwarding, and credential sniffing in a controlled Docker lab network.

Enumerate DNS infrastructure by requesting full zone transfers (AXFR) from misconfigured authoritative DNS servers using dig, nslookup, and fierce. Covers zone transfer mechanics, subdomain harvesting, and identifying exposed internal hostnames in isolated lab environments.

Enumerate SMB shares, users, and sessions on Windows and Linux targets using smbclient and enum4linux within isolated lab environments. Covers null session attacks, share listing, file retrieval, and user enumeration against misconfigured Samba and Windows SMB services.

Analyze JSON Web Tokens (JWTs) for common security vulnerabilities including algorithm confusion attacks (RS256 to HS256), none algorithm bypass, weak secret brute-forcing, and claim manipulation. Practice in isolated lab environments to understand authentication bypass and privilege escalation via token forgery.

Analyze PCAP files and live network captures using Wireshark and tshark to extract credentials, reconstruct HTTP sessions, identify malicious traffic patterns, and detect protocol anomalies in isolated lab environments. Core network forensics and traffic analysis skill for security professionals.

Enumerate and exploit sudo misconfigurations on Linux systems to escalate privileges. Covers NOPASSWD entries, wildcard abuse, sudo -l enumeration, LD_PRELOAD injection, and GTFOBins lookup for allowed commands in isolated lab environments. Core skill for Linux privilege escalation phases.

Analyze HTTP response headers for security misconfigurations including missing Content Security Policy, HSTS, X-Frame-Options, and information disclosure via Server/X-Powered-By headers. Covers manual inspection and automated scanning to identify header-based vulnerabilities and recommend remediations.

Identify and crack weak password hashes (MD5, SHA1, NTLM, bcrypt) using dictionary attacks, rainbow tables, and rule-based mutations with Hashcat and John the Ripper inside an isolated lab environment. Covers hash identification, wordlist selection, and password policy auditing for security assessments.

Detect insecure deserialization vulnerabilities in Java, Python (pickle), and PHP applications that allow remote code execution through crafted serialized objects. Covers gadget chain identification, ysoserial tool usage, and detection techniques in isolated lab environments. OWASP A08:2021.

Detect Local File Inclusion (LFI) and path traversal vulnerabilities in web applications that allow reading arbitrary files from the server. Covers manual payload testing, encoding bypasses, log poisoning for RCE, and PHP wrapper techniques in isolated Docker lab environments.

Detect and confirm SQL injection vulnerabilities in web application input fields using manual payloads and automated scanning inside isolated lab environments. Covers error-based, boolean-based, and time-based blind SQLi detection techniques.

Detect Server-Side Request Forgery (SSRF) vulnerabilities that allow attackers to make the server issue HTTP requests to internal or external resources. Covers basic SSRF detection, cloud metadata endpoint access, blind SSRF via out-of-band channels, and filter bypass techniques in safe lab environments.

Identify SUID (Set User ID) binary misconfigurations on Linux systems that allow unprivileged users to escalate to root. Covers manual enumeration, GTFOBins technique lookup, and exploitation in isolated lab environments. Essential skill for Linux privilege escalation during penetration testing engagements.

Detect reflected, stored, and DOM-based Cross-Site Scripting (XSS) vulnerabilities in web applications using manual payloads and browser-based analysis inside isolated lab environments. Covers OWASP A03 injection and sanitization bypass.

Conduct Open Source Intelligence (OSINT) reconnaissance on a simulated target organization using public information sources, DNS enumeration, certificate transparency logs, and Google dorks. All reconnaissance is performed against a fully simulated, consent-given lab target with no real personal data involved.

Execute controlled password spray attacks against simulated authentication services in isolated lab environments to understand how attackers test large numbers of accounts with a small set of common passwords. Covers SSH, web login, and API endpoint spraying with rate-limit awareness and detection evasion understanding for defensive security purposes.

Perform TCP and UDP port scanning against isolated lab targets using Nmap to discover open services, identify running software versions, and enumerate the attack surface. Covers SYN scans, version detection, and OS fingerprinting techniques exclusively in controlled Docker lab environments.

Discover hidden directories, files, and endpoints on web servers using wordlist-based fuzzing with tools like ffuf, gobuster, and dirb inside isolated lab environments. Covers recursive enumeration, extension fuzzing, virtual host discovery, and filtering strategies for reducing noise in results.