26zl
- 844 skills
- 0 followers
- 23 hours ago last updated
- ▌ Building Identity Federation With Saml Azure Ad · 26zl bundleEstablish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.
- ▌ Implementing Google Workspace Sso Configuration · 26zl bundleConfigure SAML 2.0 single sign-on for Google Workspace with a third-party identity provider, enabling centralized authentication and enforcing organization-wide access policies.
- ▌ Implementing Identity Governance With Sailpoint · 26zl bundleDeploy SailPoint IdentityNow or IdentityIQ for identity governance and administration. Covers identity lifecycle management, access request workflows, certification campaigns, role mining, SOD policy
- ▌ Implementing Zero Trust With Hashicorp Boundary · 26zl bundleImplement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.
- ▌ Building Ransomware Playbook With Cisa Framework · 26zl bundleBuilds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.
- ▌ Configuring Identity Aware Proxy With Google Iap · 26zl bundleConfiguring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.
- ▌ Implementing Mimecast Targeted Attack Protection · 26zl bundleDeploy Mimecast Targeted Threat Protection including URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect to defend against advanced phishing and spearphishing attacks.
- ▌ Performing Entitlement Review With Sailpoint Iiq · 26zl bundlePerforms entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification.
- ▌ Performing Paste Site Monitoring For Credentials · 26zl bundleMonitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
- ▌ Detecting AWS Credential Exposure With Trufflehog · 26zl bundleDetecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
- ▌ Implementing Google Workspace Phishing Protection · 26zl bundleConfigure Google Workspace advanced phishing and malware protection settings including pre-delivery scanning, attachment protection, spoofing detection, and Enhanced Safe Browsing.
- ▌ Implementing Identity Verification For Zero Trust · 26zl bundleImplement continuous identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model.
- ▌ Reverse Engineering Ransomware Encryption Routine · 26zl bundleReverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.
- ▌ Implementing Passwordless Auth With Microsoft Entra · 26zl bundleImplements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.
- ▌ Implementing Azure Ad Privileged Identity Management · 26zl bundleConfigure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles.
- ▌ Performing Adversary In The Middle Phishing Detection · 26zl bundleDetect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.
- ▌ Implementing Privileged Access Management With Cyberark · 26zl bundleDeploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure. This skill covers vault architecture, session isolation, c
- ▌ Coding Style · 26zl bundleKeep code comments and docstrings concise, neutral, human-authored in tone, and written in English unless another language is required. Use when writing, refactoring, or reviewing code where comments, identifiers, or docstrings may be added or changed; do not use to shorten required public API documentation, safety notes, or legal notices.
- ▌ No AI Traces · 26zl bundleKeep delivered work free of AI self-reference, with no Co-Authored-By trailers or generated-with footers in commits and pull requests, and no comments, documentation, or changelog entries that narrate AI involvement, prompts, or the editing session. Use when writing commits, merge or squash messages, pull requests, release notes, changelogs, code comments, or documentation; do not use to bypass a policy that explicitly requires AI disclosure.
- ▌ Simplify Code · 26zl bundleSimplify recently changed or user-selected code while preserving observable behavior, public APIs, tests, and required safeguards. Use when asked to simplify, clean up, refactor for clarity, reduce nesting, remove duplication, or review an implementation for unnecessary complexity.
- ▌ Secret Hygiene · 26zl bundleNever write, echo, or commit secret values such as API keys, tokens, passwords, or private keys; reference them through environment variables or a secret manager, and report discovered secrets without reproducing the value. Use when writing code, tests, configuration, documentation, logs, or shell commands that touch credentials; do not use to weaken cryptographic material handling that the product itself must perform.
- ▌ Verify Changes · 26zl bundleVerify code or configuration changes with focused tests, static checks, and diff inspection before reporting completion. Use after implementing or modifying a repository; do not use for read-only explanations or when no files changed.
- ▌ Data Minimization · 26zl bundleKeep real personal and confidential data out of code, tests, fixtures, logs, error messages, examples, and prompts; use synthetic data, and mask identifiers when a real record is unavoidable. Use when writing tests, fixtures, seed data, logging, debugging output, or documentation, or when moving data between systems; do not use to remove lawful data processing that the product itself performs.
- ▌ Docs Consolidation · 26zl bundleKeep project documentation in a small set of canonical files; extend an existing document instead of creating a new Markdown file, and merge overlapping documents rather than adding another. Use when writing, updating, or reorganizing documentation, or when a task would create a new .md file such as a summary, notes, plan, or per-feature guide; do not use to merge files a convention requires to stand alone, such as README, LICENSE, CHANGELOG, or generated references.
- ▌ License Compliance · 26zl bundleCheck the license before copying or vendoring third-party code, preserve required notices and attribution, and flag copyleft or unknown licenses before they enter the codebase. Use when copying code from other projects, adding dependencies, vendoring files, or maintaining attribution documents; do not use as legal advice beyond flagging conflicts for review.
- ▌ Supply Chain Pinning · 26zl bundleAdd dependencies deliberately by justifying each new one, pinning versions or commits, respecting lockfiles, and never executing unpinned remote code. Use when adding or updating packages, container images, GitHub Actions, install scripts, or vendored code; do not use to block upgrades the user explicitly requested.
- ▌ Surgical Implementation · 26zl bundleMake the smallest justified code or configuration change, surface material assumptions, avoid unrelated cleanup, fix rather than silently skip defects found along the way, and define verifiable success criteria. Use when implementing features, fixes, refactors, or configuration changes in an existing repository; do not use for read-only analysis or broad rewrites the user explicitly requested.
- ▌ Destructive Ops Approval · 26zl bundleObtain explicit confirmation before irreversible or outward-facing operations such as force-pushes, history rewrites, mass deletion, data migrations, or production changes, and prefer the reversible alternative when one exists. Use when an action could destroy data, rewrite shared history, or change systems other people depend on; do not use to stall routine, easily reversible work.
- ▌
- ▌ Meme Coin Audit · 26zl bundleMeme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, MCP-driven red-flag scanning (grep/run_pipeline over contract source), and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.
- ▌ Module Scaffold · 26zlUse when creating a brand new module file in modules/ for a new tool category. Generates the boilerplate with correct array prefix, install_module_<name>() function, and ensures it integrates with install.sh, profiles, and MCP server. Triggers on "new module", "add a module for X", "scaffold module".
- ▌ Offensive Cloud · 26zlCloud security attack methodology for AWS, Azure, and GCP: credential harvesting (IMDS, ~/.aws, env vars, CI secrets, instance roles), enumeration (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation (IAM PassRole, AssumeRole chains, Lambda/Functions flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence (IAM keys, AAD app registration, GCP svc account keys, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL), lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE paths to node and metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when scope is cloud accounts, when you hold cloud credentials, or when assessing cloud posture. Authorized security research, training, or assessment only.
- ▌ Offensive OAUTH · 26zlOAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty. Use only for authorized security research, training, or assessment.
- ▌ Offensive Osint · 26zlComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map. Use only for authorized security research, training, or assessment.
- ▌ Evidence Hygiene · 26zlSanitize security evidence before sharing, reporting, or writing up findings. Use for bug bounty reports, guided MCP assessments, pentest/DFIR notes, screenshots, HAR files, curl commands, request/response logs, PoC output, terminal transcripts, writeups, and any evidence that may contain cookies, bearer tokens, API keys, session IDs, PII, customer data, credentials, internal hostnames, or excessive exploit output.
- ▌ Offensive Mobile · 26zlMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance. Use only for authorized security research, training, or assessment.
- ▌ Offensive Toctou · 26zlTime-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators. Use only for authorized security research, training, or assessment.
- ▌ Offensive Z Wave · 26zlZ-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting Z-Wave smart home devices (door locks, sensors, garage controllers) — common in mid-2010s smart home deployments still in production. Use only for authorized security research, training, or assessment.
- ▌ Security Arsenal · 26zl bundleSecurity payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
- ▌ Variant Analysis · 26zl bundleFind similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
- ▌ Writeup Template · 26zlUse after completing any substantive security workflow with this project, including CTF, bug bounty, CVE validation, guided MCP assessment, DFIR, pentest/recon, or troubleshooting. Generates a writeup at writeups/<category>/<descriptive-case-name>.md following the project's mandatory structure. Triggers on "write writeup", "document this challenge", "write up the solve", "document this finding", or right after a flag/finding/result is confirmed.
- ▌ AI Threat Testing · 26zl bundleOffensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.
- ▌ Credential Attack · 26zlPassword spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated hunt chain pattern. Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls.
- ▌ Cve Poc Generator · 26zl bundleCVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.
- ▌ Guided Assessment · 26zlPick and run the right MCP tools for an authorized security task. Default companion mode auto-detects the workflow/problem type, classifies target/finding input, returns triage gates, recommended skills, reporting next steps, selects from all modules/profiles, recommends the next command, and guides step-by-step; opt-in autonomous starts an auto-solver loop over the full MCP toolchain via run_tool/run_pipeline/run_script, including AI-created scoped helper scripts when tools/pipelines are not enough, under policy. Use for "what tools for this", "classify this finding", "triage this report", "run the right tools for me", "assess/triage this authorized target", or - when explicitly asked - "autonomously solve this". Clears authorization-gate once, then stays strictly in scope and never bypasses MCP policy.
- ▌ Insecure Defaults · 26zl bundleDetects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
- ▌ Offensive Fuzzing · 26zlPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes. Use only for authorized security research, training, or assessment.
- ▌ Offensive GRAPHQL · 26zlGraphQL security testing checklist: introspection abuse, batching attacks, query depth/complexity DoS, field suggestion enumeration, IDOR via GraphQL, injection through arguments, authorization bypass. Use when assessing GraphQL endpoints in web app tests or bug bounty. Use only for authorized security research, training, or assessment.
- ▌ Security Payloads · 26zlUse when you need a specific exploit payload — XSS, SQLi, SSTI, SSRF, XXE, file upload bypass, auth bypass, command injection. Points to PayloadsAllTheThings + SecLists/Fuzzing locations, plus inline canonical payloads for the most common cases. Triggers on "xss payload", "sqli payload", "ssti payload", "ssrf bypass", "xxe payload", "command injection".
- ▌ Triage Validation · 26zlFinding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
- ▌ Web2 Vuln Classes · 26zl bundleComplete reference for 22 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). Use when hunting a specific vuln class or studying what makes bugs pay.
- ▌ Authorization Gate · 26zlUse as the pre-flight authorization check before any offensive, intrusive, or simulation activity — pentest, red team, exploitation, phishing simulation, wireless attacks, social engineering, C2, scanning a target you don't own. Confirms written authorization, scope boundaries, lawful basis, and target ownership before a single packet is sent, and defines the hard refusals (mass targeting, supply-chain compromise, malicious evasion). Run this gate at the top of any offensive or simulation workflow before acting.
- ▌ Offensive Wpa2 Psk · 26zlWPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode. Use only for authorized security research, training, or assessment.
- ▌ Offensive Wpa3 Sae · 26zlWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec. Use only for authorized security research, training, or assessment.
- ▌ Security Wordlists · 26zlUse when you need wordlists for fuzzing, password cracking, content discovery, username enumeration, or pattern matching. Points to SecLists, PayloadsAllTheThings, and seclists-rolling that are already cloned by this installer. Triggers on "wordlist", "rockyou", "fuzz list", "common passwords", "directory wordlist", "subdomain wordlist".
- ▌ Blockchain Security · 26zl bundleSmart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.
- ▌ Differential Review · 26zl bundlePerforms security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
- ▌ Karpathy Guidelines · 26zlBehavioral coding-agent guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.
- ▌ Offensive Evil Twin · 26zlEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal. Use only for authorized security research, training, or assessment.
- ▌ Offensive Reporting · 26zlPenetration test and red team report writing methodology: executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, scope, narrative, reproduction, impact, remediation, references), CVSS v3.1/v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping actions), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions, retest and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM), client-customer-deliverable separation, and common mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, restructuring a draft for executive readability, or building a reusable report template. Authorized security research, training, or assessment only.
- ▌ Offensive Shellcode · 26zlShellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques. Use only for authorized security research, training, or assessment.
- ▌ Yara Rule Authoring · 26zl bundleGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
- ▌ Offensive Waf Bypass · 26zlWAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests. Use only for authorized security research, training, or assessment.
- ▌ Offensive Wifi Recon · 26zlWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each. Use only for authorized security research, training, or assessment.
- ▌ Semgrep Rule Creator · 26zl bundleCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
- ▌ Offensive AI Security · 26zlAI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, LLM-assisted attack automation, and AI system reconnaissance. Use when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors. Use only for authorized security research, training, or assessment.
- ▌ Offensive Edr Evasion · 26zlEDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques. Use only for authorized security research, training, or assessment.
- ▌ Offensive File Upload · 26zlFile upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty. Use only for authorized security research, training, or assessment.
- ▌ Offensive Mitigations · 26zlSecurity mitigation reference and bypass catalog: ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, seccomp. Covers both detection of enabled mitigations and known bypass techniques. Use when assessing target hardening or planning exploit mitigation bypasses. Use only for authorized security research, training, or assessment.
- ▌ Skill Curation Router · 26zlUse when choosing, ranking, curating, pruning, or de-duplicating Claude cybersecurity skills; when a broad cybersecurity task could match many skills; or when deciding which skill should be loaded first.
- ▌ AI LLM Security Review · 26zlUse for AI/LLM security assessments, prompt injection, RAG security, agent/tool permissioning, model supply chain, LLM red teaming, AI governance, eval design, data leakage, jailbreak testing, and secure AI application review.
- ▌ Constant Time Analysis · 26zl bundleDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
- ▌ Offensive Vuln Classes · 26zl bundleExploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit dev knowledge. Use only for authorized security research, training, or assessment.
- ▌ Skill Dependency Audit · 26zlUse when auditing optional Python dependencies for vendored Claude skill helper scripts, checking missing imports, deciding whether dependencies belong in MCP runtime, or troubleshooting a skill script that fails with ModuleNotFoundError.
- ▌ Offensive Bluetooth Ble · 26zlBluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE. Use only for authorized security research, training, or assessment.
- ▌ Offensive Fast Checking · 26zlSpeed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping. Use only for authorized security research, training, or assessment.
- ▌ Offensive Open Redirect · 26zlOpen redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery. Use only for authorized security research, training, or assessment.
- ▌ Offensive Business Logic · 26zlBusiness logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact. Use only for authorized security research, training, or assessment.
- ▌ Offensive Fuzzing Course · 26zlWeek 2 of the exploit development curriculum. Covers fuzzing methodology: target selection, corpus generation, coverage-guided fuzzing with AFL++/libFuzzer, structured fuzzing, and triage/deduplication. Use when setting up fuzz campaigns, selecting harness strategies, or triaging fuzzer output. Use only for authorized security research, training, or assessment.
- ▌ Offensive Initial Access · 26zlInitial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements. Use only for authorized security research, training, or assessment.
- ▌ Offensive Keylogger Arch · 26zlLow-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis. Use only for authorized security research, training, or assessment.
- ▌ Offensive Race Condition · 26zlRace condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs. Use only for authorized security research, training, or assessment.
- ▌ Offensive Wpa Enterprise · 26zlWPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated. Use only for authorized security research, training, or assessment.
- ▌ Offensive Deauth Disassoc · 26zlDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture. Use only for authorized security research, training, or assessment.
- ▌ Offensive Deserialization · 26zlInsecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits. Use only for authorized security research, training, or assessment.
- ▌ Offensive Lorawan Sub Ghz · 26zlLoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment). Use only for authorized security research, training, or assessment.
- ▌ Supply Chain Risk Auditor · 26zl bundleIdentifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
- ▌ Offensive Active Directory · 26zlActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments. Use only for authorized security research, training, or assessment.
- ▌ Offensive Advanced Redteam · 26zlPractical advanced red team operations guide: OPSEC discipline, C2 infrastructure design, living-off-the-land techniques, lateral movement, persistence, data exfiltration, and evading modern defenses. Use for planning advanced red team engagements or understanding APT TTPs. Use only for authorized security research, training, or assessment.
- ▌ Offensive Bluetooth Classic · 26zlBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories. Use only for authorized security research, training, or assessment.
- ▌ Offensive Krack Fragattacks · 26zlKRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence. Use only for authorized security research, training, or assessment.
- ▌ Offensive Osint Methodology · 26zlStructured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology. Use only for authorized security research, training, or assessment.
- ▌ Offensive Request Smuggling · 26zlHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations. Use only for authorized security research, training, or assessment.
- ▌ Sap Erp Security Assessment · 26zlUse for SAP and ERP security assessments, S/4HANA, NetWeaver, ABAP, HANA DB, RFC trust, SAP Gateway, ICM, transports, default users, authorization roles, SoD, patching, and business-critical ERP control review.
- ▌ Offensive Bug Identification · 26zlSystematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines. Use only for authorized security research, training, or assessment.
- ▌ Offensive Exploit Dev Course · 26zlFull exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers. Use only for authorized security research, training, or assessment.
- ▌ Mainframe Security Assessment · 26zlUse for mainframe, z/OS, RACF, ACF2, Top Secret, CICS, IMS, DB2, JCL, JES, APF libraries, USS, TN3270, privileged dataset, and legacy enterprise security assessment work.
- ▌ Offensive Exploit Development · 26zlExploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment. Use only for authorized security research, training, or assessment.
- ▌ Offensive Parameter Pollution · 26zlHTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws. Use only for authorized security research, training, or assessment.
- ▌ Grc Compliance Privacy Program · 26zlUse for governance, risk, compliance, privacy, audit readiness, control mapping, SOC 2, ISO 27001, NIST CSF, CIS, GDPR, legal/regulatory scoping, policy evidence, vendor risk, and security program maturity work.