菜单
Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement -> privilege-escalation -> exfiltration -> evasion chain.
HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions
Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.
| name | infrastructure |
| description | Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment. |
Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.
| Type | Key Vectors |
|---|---|
| Port Scanning | SYN scan, UDP scan, service detection, OS fingerprinting |
| DNS | Zone transfers, cache poisoning, subdomain takeover, DNS rebinding |
| MITM | ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning |
| VLAN Hopping | Switch spoofing, double tagging |
| IPv6 | RA flooding, neighbor spoofing, tunneling attacks |
| SMB/NetBIOS | Null sessions, relay attacks, enumeration |
| Sniffing | Packet capture, credential harvesting, protocol analysis |
| DoS | Resource exhaustion, amplification, application-layer |
| ICS/SCADA | Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking |
| UPnP / IoT / CPE | rootDesc/SCPD enumeration, vendor SOAP info disclosure (GetPassword), command injection via vendor actions, cross-action auth-key reuse |
| Hardware / Embedded | Logic captures (Saleae .sal), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker |
Quickstart guides (per attack type):
reference/port-scanning-quickstart.md - Port scanning and service discoveryreference/dns-quickstart.md - DNS attacks and enumerationreference/mitm-quickstart.md - Man-in-the-middle attacksreference/vlan-hopping-quickstart.md - VLAN hopping techniquesreference/ipv6-quickstart.md - IPv6 attack vectorsreference/smb-netbios-quickstart.md - SMB/NetBIOS exploitationreference/sniffing-quickstart.md - Network sniffing and capturereference/dos-quickstart.md - DoS assessmentreference/ics-modbus-quickstart.md - ICS/SCADA Modbus PLC exploitationreference/upnp-iot-quickstart.md - UPnP / IoT / CPE firmware web UI enumeration and exploitationreference/hardware-embedded-quickstart.md - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOSScan techniques: reference/syn-scan.md, reference/udp-scan.md, reference/icmp-scan.md, reference/os-fingerprint.md
Other: reference/firewall-detection.md, reference/service-enum.md, reference/ip-reputation.md, reference/overview.md