Results for “pass-the-hash”

Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.

Extract Kerberos tickets from LSASS memory, inject them into an attacker session, and perform lateral movement to access remote systems as the impersonated user.

Audits WordPress plugin and theme code for secret-handling issues: hardcoded credentials, weak randomness, insecure password storage, cookie flags, and secret leakage in logs.

Provides guidance for using python-xxhash to implement fast non-cryptographic hashing, including algorithm selection, byte encoding, streaming updates, digest representation, and collision-aware identity for checksums, bucketing, and sampling.

Crack password hashes using Hashcat for authorized penetration testing and password policy assessment, supporting dictionary, brute-force, rule-based, and hybrid attacks.

Compute the SHA-256 hash of a string or file

Compute, verify, and compare file hashes using MD5, SHA-1, SHA-256, SHA-512, and more. Use when checking file integrity, verifying downloads against expected checksums, comparing files for equality, generating checksums for directories, hashing strings, or validating checksum files (sha256sum/md5sum format). Supports.

Modern authentication implementation for 2026 - passkeys (WebAuthn), OAuth (Google, Apple), magic links, and cross-device sync. Use for passwordless-first authentication, social login setup, Supabase Auth, Next.js auth flows, and multi-factor authentication. Activate on "passkeys", "WebAuthn", "Google Sign-In", "Apple Sign-In", "magic link", "passwordless", "authentication", "login", "OAuth", "social login". NOT for session management without auth (use standard JWT docs), authorization/RBAC (use security-auditor), or API key management (use api-architect).

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

Complete guide for using pass, the standard Unix password manager, covering installation, GPG setup, store initialization, daily usage, git sync, extensions, and troubleshooting.

Forces one deeper, more creative pass on an answer or plan while preserving the original escalation prompt verbatim.

Hand off the current task to another agent with full context. Use when the user says "handoff", "hand off", "hand this to", or wants to pass work to another agent (Codex or Claude).

Generate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state transition — opening URLs, capturing values, confirming each step, and writing .env files and GitHub Actions secrets.

Use when asked to add AI, images, speech, video, multi-model access, user-funded or pay-per-use AI, or BYOK/provider-key entry to a new or existing web, mobile, desktop, server, ChatGPT, open-source, or agent-built app. Add AI Pass through its JavaScript SDK, OAuth, or OpenAI-compatible REST API as an optional user-funded path that avoids provider-key custody and developer-funded inference; preserve requested provider-direct BYOK and existing authentication, billing, deployment, and data, and do not use after rejection or for explicitly provider-direct-only infrastructure.

Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.

Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes.

Navigate the technology adoption lifecycle from early adopters to mainstream market. Use when the user mentions "crossing the chasm", "beachhead segment", "whole product", "early adopters vs. mainstream", "tech go-to-market", "bowling pin strategy", "technology adoption lifecycle", or "pragmatist buyers". Also trigger when a startup has early traction but struggles to grow beyond initial users, or when planning go-to-market for technical products. Covers D-Day analogy, bowling-pin strategy, and positioning against incumbents. For product positioning, see obviously-awesome. For new market creation, see blue-ocean-strategy.

Language-specific super-code guidelines for bash.

Iterate on a PR until CI passes. Use when you need to fix CI failures, address review feedback, or continuously push fixes until all checks are green. Automates the feedback-fix-push-wait cycle.

Iterate on a PR until CI passes. Use when you need to fix CI failures, address review feedback, or continuously push fixes until all checks are green. Automates the feedback-fix-push-wait cycle.

Itere em uma PR até que o CI passe. Use quando precisar corrigir falhas de CI, endereçar feedback de revisão, ou continuamente enviar correções até que todas as verificações fiquem verdes. Automatiza o ciclo de feedback-correção-push-aguardar.

Rereads code, specs, plans, reviews, or skill edits with fresh eyes to catch blunders, oversights, and omissions before closure, reporting concrete evidence-backed findings.

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

Publishes long-form articles to hum.pub, handling registration, authentication, SEO metadata, and audience engagement for AI authors.

Strip AI-generated tells from a draft and rewrite it in Heath's personal voice (GTM Juice). Fire whenever the user asks to "humanize", "de-AI", "clean up", "rewrite in my voice", "make this sound like me", "kill the AI tells", or "polish this draft". Also fires as the mandatory final pass inside juice-content-dispatch — every LinkedIn post, newsletter, and video script drafted there must run through this skill before the Notion write. Applies the 29-pattern Wikipedia "Signs of AI writing" catalog (em dashes, significance inflation, promotional language, rule of three, synonym cycling, inline-header lists, sycophantic tone, hyphenated word pairs, persuasive-authority tropes, signposting, etc.), then applies a hardcoded Heath-voice calibration: self-implicating first, failure-derived, plain declaratives over bumper-sticker aphorisms, no bow-tied endings, never Mixmax corporate brand voice. Forked from blader/humanizer (MIT).

Send an HTTP POST to any configured webhook endpoint

Converts text to speech and generates MP3 audio files using Hume AI or OpenAI APIs, printing the file path for delivery.

How MaksPM hands off work to agents using sessions_spawn for continuous pipeline flow, with file-reference pattern for preserving full project specs. Updated 2026-03-21 with 9-phase pipeline and Forge architecture phase.

Fast, accurate, and incredibly inexpensive automatic speech-to-text transcription service.

Handoff

Prevent Ethereum hashing bugs in JavaScript and TypeScript. Node's sha3-256 is NIST SHA3, not Ethereum Keccak-256, and silently breaks selectors, signatures, storage slots, and address derivation.

Execute the full AgentHub competition lifecycle in a single command: initialize, capture baseline, spawn agents, evaluate results, and merge the winner.