DevOps & Infra

purpleailab Skill

Server-Side Request Forgery (SSRF) — exploiting server-side URL fetching to access internal services, cloud metadata (AWS/GCP/Azure), internal APIs, and port scanning. Covers IP bypass techniques, DNS rebinding, Gopher protocol smuggling, and redirect-based bypass.

purpleailab Skill

Detect and claim dangling S3 buckets referenced by subdomains (CNAME → s3 hostnames where bucket no longer exists).

purpleailab Bundle

Cloud infrastructure enumeration — AWS S3 buckets, Azure blob storage, GCP buckets, cloud metadata endpoints, IAM misconfigurations, CDN origin detection.

purpleailab Skill

Router / IoT firmware extraction pipeline — unpack nested filesystems, locate web server, identify backdoor credentials.

purpleailab Skill

Operate BloodHound Community Edition v9.2.2 via Decepticon's bhce_* tools — health check, Cypher passthrough, SharpHound ZIP ingest. Replaces the in-house ingest + ESC* post-process pipeline per ADR-0005.

purpleailab Skill

Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.

purpleailab Skill

Entra ID privilege escalation + persistence — app role/owner abuse, service-principal credential addition, dynamic group membership abuse, Administrative Unit role assignment, hybrid identity attacks (Connect, PHS, PTA, Seamless SSO, Golden SAML), Graph API privesc paths.

purpleailab Skill

Supply-chain attack category — dependency confusion, typosquatting, package-registry abuse, build-pipeline poisoning, SBOM manipulation.

purpleailab Skill

Systematic hunt for hardcoded credentials, API keys, certificates, and default passwords in extracted IoT firmware. Covers /etc/shadow and passwd parsing, busybox httpd configs, telnet/dropbear stanzas, MQTT/cloud API key extraction, and cross-referencing against known default-credential databases.

poly-gents Bundle

Migrate Azure ARM templates and Bicep to Pulumi.

poly-gents Bundle

Migrate AWS CDK applications to Pulumi.

poly-gents Bundle

Classify and organize Second Brain atoms into PARA/CODE structures with confidence and conflict flags.

poly-gents Bundle

Post-deploy monitoring — canary metrics, error budgets, and rollback triggers.

poly-gents Bundle

Land-and-deploy discipline — merge, deploy sequence, verification, and rollback readiness.

poly-gents Bundle

Migrate AWS CloudFormation stacks/templates to Pulumi.

poly-gents Bundle

Migrate Terraform projects to Pulumi.

poly-gents Bundle

Run a pre-release checklist before any non-trivial deploy: code, observability, rollback, comms. Block the release if any item is red.

odjaramillo Skill

CI/CD pipeline patterns for automated testing and deployment. Trigger: When configuring CI/CD pipelines.

odjaramillo Bundle

Guidelines for writing efficient and secure Dockerfiles. Trigger: When working with Dockerfile, docker-compose, or container configurations.

odjaramillo Skill

Terraform infrastructure as code patterns and best practices. Trigger: When writing Terraform infrastructure code.

odjaramillo Skill

Expert at handling file uploads and cloud storage. Covers S3, Cloudflare R2, presigned URLs, multipart uploads, and image optimization. Knows how to handle large files without blocking. Use when: file upload, S3, R2, presigned URL, multipart.

sairam0424 Skill

Skill — Deployment Workflow (Staged Production Release Pipeline)

sairam0424 Skill

Skill — Serverless Patterns

sairam0424 Skill

Skill — Data Pipeline Design

ricneves-ai Skill

25 skills e plugins avançados de engenharia para Claude Code. Design de agentes, RAG, servidores MCP, CI/CD, design de banco de dados, observabilidade, auditoria de segurança e gerenciamento de releases.

ricneves-ai Bundle

Ative este CISO virtual senior sempre que o usuario mencionar seguranca de servidores, seguranca de aplicacoes, LGPD, protecao de dados pessoais, controle de acesso, IAM, hardening, pentest, vulnerabilidades, OWASP, resposta a incidentes, DevSecOps, ISO 27001, NIST, compliance, ANPD, ataques, malware, ransomware, vazamento de dados, ou qualquer tema de ciberseguranca. Entrega analises 360 de Seguranca Minima Viavel (MVS) cobrindo conformidade regulatoria, dados, IAM, hardening, AppSec, SecOps, testes ofensivos, resposta a incidentes, DevSecOps e cloud security, com priorizacao por risco x esforco e mapeamento regulatorio. Use TAMBEM quando o contexto envolver producao, APIs publicas, dados sensiveis, infraestrutura critica, deploy de aplicacoes, arquitetura cloud ou revisao de codigo, mesmo sem pedido explicito por seguranca. Responde em portugues do Brasil com tom executivo direto.

purpleailab Skill

Legitimate RMM tool abuse — deploy or hijack Atera, ScreenConnect, AnyDesk, TeamViewer for persistence, lateral movement, and C2. Leverages trusted software to evade EDR and blend with IT admin traffic.

purpleailab Skill

Author and deploy an evilginx2 phishlet to reverse-proxy a real login and capture the post-authentication session cookie, defeating MFA via session-token theft.

purpleailab Skill

GCP organization-level privilege escalation — cross-project pivoting, org policy bypass, service account impersonation chains, Terraform state secrets, and GKE cluster compromise. Escalate from single-project access to org-wide control.

purpleailab Skill

DNS rebinding attack to bypass browser same-origin policy and reach IMDS/localhost/internal services: TTL=0 rebind mechanics, rbndr.us/singularity tooling, browser DNS cache pinning, chaining into AWS/GCP/Azure IMDS credential pivot. Use when SSRF is blocked but a victim browser can be induced to make requests, or when a localhost service is exposed. Triggers on: 'dns rebinding', 'rebind', 'DNS TTL 0', 'singularity', 'rbndr', 'localhost bypass via browser', 'imds via browser', 'SSRF via DNS'.

purpleailab Skill

Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact.

purpleailab Skill

Exploit exposed Terraform state files — secrets, cloud creds, RDS passwords, IAM keys, and infrastructure topology in plain JSON.

purpleailab Skill

Deploy and drive Kali Linux tools via MCP-Kali-Server — structured tool-call interface, SSH tunnel setup, prompt-injection hygiene for AI-assisted engagements.

purpleailab Skill

AATMF T14 — Infrastructure & Economic Warfare. Endpoint DoS via expensive prompts, model-API account exhaustion, GPU resource starvation, billing weaponization.

purpleailab Skill

AWS IAM privilege escalation via `iam:PassRole` chains — Lambda/Glue/Sagemaker/EC2/ECS PassRole to a higher-priv role, AssumeRole chains across accounts, sts:GetCallerIdentity recon, account hijack via legacy root-mfa-bypass.

purpleailab Skill

Azure Managed Identity abuse — IMDS at 169.254.169.254 from compromised VM / App Service / Function, token exchange for Graph/ARM/KeyVault, federated workload identity abuse, hybrid AAD Connect MSOL credential extraction.