Security

blackpearl-ai Skill

Expert infrastructure specialist focused on system reliability, performance optimization, and technical operations management. Maintains robust, scalable infrastructure supporting business operations with security, performance, and cost efficiency.

blackpearl-ai Skill

The Agency Incident Response Runbook: SRE, DevOps, security, and root cause recovery orchestration.

blackpearl-ai Skill

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting, alert tuning, and detection-as-code pipelines for security operations teams.

blackpearl-ai Skill

Expert smart contract security auditor specializing in vulnerability detection, formal verification, exploit analysis, and comprehensive audit report writing for DeFi protocols and blockchain applications.

blackpearl-ai Skill

Expert technical compliance auditor specializing in SOC 2, ISO 27001, HIPAA, and PCI-DSS audits — from readiness assessment through evidence collection to certification.

blackpearl-ai Skill

Digital forensics and incident response specialist who leads breach investigations, contains active threats, coordinates crisis response, and writes post-mortems that prevent recurrence.

blackpearl-ai Skill

Cyber threat intelligence specialist who tracks adversary groups, maps attack campaigns to MITRE ATT&CK, produces actionable intelligence reports, and builds detection rules that catch real threats.

gl0di Skill

A blue-team detection-engineering skill that hunts for offensive AD tooling usage via Sysmon and SIEM telemetry.

jihedbfr-art Bundle

Use when an API authenticates with JSON Web Tokens — testing for algorithm confusion, none-alg, weak secrets, and unchecked claims, plus how to validate tokens correctly.

jihedbfr-art Bundle

Use when securing or testing a gRPC API — authentication, input validation, and the differences from REST that change how you attack and defend it.

jihedbfr-art Bundle

Use when an API binds request data straight onto objects — testing whether you can set fields you shouldn't, like role or ownership, and how to bind safely.

jihedbfr-art Bundle

Use when assessing or hardening a VPN — IPsec or WireGuard configuration, authentication, and the exposure a remote-access gateway creates — so the tunnel doesn't become the way in.

jihedbfr-art Bundle

Use when securing DNS infrastructure — DNSSEC, resolver filtering, and detecting tunnelling and exfiltration — because DNS is both a control point and an attacker's favourite covert channel.

jihedbfr-art Bundle

Use when building or reviewing webhook endpoints — verifying that inbound events are authentic and can't be forged, replayed, or used to attack your internal network.

jihedbfr-art Bundle

Use when checking a service's TLS configuration on the wire — protocol versions, cipher suites, and certificate validity — to find weak crypto and misconfiguration.

jihedbfr-art Bundle

Use when deploying or tuning network intrusion detection/prevention — cutting false positives without going blind, and placing sensors where they actually see the traffic.

jihedbfr-art Bundle

Use when hunting on endpoint telemetry — the process, persistence, and injection patterns that reveal compromise on hosts, using the richest data source available to a hunter.

jihedbfr-art Bundle

Use when hunting requires knowing what normal looks like — establishing baselines of normal behaviour so anomalies stand out, the foundation most hunts depend on.

jihedbfr-art Bundle

Use when testing how an API authenticates callers — token issuance, validation, expiry, and credential endpoints — for the flaws that let an attacker forge or steal identity.

jihedbfr-art Bundle

Use when deciding where and how to enforce API security controls — using the gateway as the consistent choke point for auth, rate limits, and schema instead of per-service reinvention.

jihedbfr-art Bundle

Use in an authorised assessment to bypass certificate pinning so you can inspect a mobile app's TLS traffic — and understand what pinning does and doesn't protect.

jihedbfr-art Bundle

Use when testing the backend a mobile app talks to — intercepting and testing the API, because the real attack surface is often the server, not the app on the device.

jihedbfr-art Bundle

Use when reviewing code for TOCTOU and concurrency bugs with a security impact — the double-spend, the check that goes stale before the use, the shared state two requests corrupt.

jihedbfr-art Bundle

Use when hunting for command-and-control beaconing in network telemetry — the regular-interval callbacks that reveal C2 even when the destination and payload are unknown.

jihedbfr-art Bundle

Use when hunting for attackers abusing legitimate built-in tools (LOLBins) — the PowerShell, WMI, and signed-binary abuse that blends in with normal admin activity.

jihedbfr-art Bundle

Use when tracking a threat actor over time — attributing activity, following their evolving tradecraft, and turning "who and how" into defensive advantage.

jihedbfr-art Bundle

Use when you have an iOS app (IPA) and want to read it statically for secrets, weak configuration, and binary protection gaps — without running it.

jihedbfr-art Bundle

Use when checking whether a web app reflects or stores input that executes as script in a victim's browser — covers reflected, stored, and DOM XSS plus the output-encoding fix.

jihedbfr-art Bundle

Use when an API returns more data than the client needs — testing whether responses leak fields the user shouldn't see, and how to filter at the server.

jihedbfr-art Bundle

Use when protecting stored secrets and sensitive data at rest — envelope encryption and secret managers — so a database or disk breach doesn't hand over plaintext.

jihedbfr-art Bundle

Use when hunting DNS and web-proxy logs for C2, exfiltration, and malicious domains — high-value logs that reveal what hosts are really talking to.

jihedbfr-art Bundle

Use when running a threat-intel sharing platform and exchanging intelligence — using MISP and STIX/TAXII to manage, share, and consume intel with the wider community.

jihedbfr-art Bundle

Use when designing or reviewing network segmentation — dividing a network so a foothold in one zone can't reach everything, and verifying the boundaries actually hold.

jihedbfr-art Bundle

Use when auditing a firewall rule set for overly-permissive, shadowed, or stale rules — the accumulated cruft that quietly widens what's allowed through.

jihedbfr-art Bundle

Use when testing whether an app performs state-changing actions without verifying intent — letting a malicious page act as a logged-in victim — and how to stop it.

jihedbfr-art Bundle

Use when user input reaches a server-side template engine — testing for template injection that can escalate to remote code execution, and how to render untrusted data safely.