Njones17
- 644 skills
- 0 followers
- 5 hours ago last updated
- ▌ Building Detection Rule With Splunk Spl · njones17 bundleBuild effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.
- ▌ Detecting Azure Service Principal Abuse · njones17 bundleDetect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.
- ▌ Detecting Compromised Cloud Credentials · njones17Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
- ▌ Detecting Email Forwarding Rules Attack · njones17 bundleDetect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
- ▌ Detecting Fileless Attacks On Endpoints · njones17 bundleDetects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.
- ▌ Detecting Privilege Escalation Attempts · njones17 bundleDetect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.
- ▌ Detecting S3 Data Exfiltration Attempts · njones17Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
- ▌ Acquiring Disk Image With Dd And Dcfldd · njones17Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.
- ▌ Analyzing Mft For Deleted File Recovery · njones17 bundleAnalyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
- ▌ Analyzing Network Traffic For Incidents · njones17Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
- ▌ Analyzing Usb Device Connection History · njones17Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
- ▌ Extracting Credentials From Memory Dump · njones17Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
- ▌ API Pentesting · njones17Use when testing APIs for security vulnerabilities, assessing REST/GraphQL/gRPC/WebSocket/SOAP endpoints, testing API authentication and authorization (OAuth2, JWT, API keys), discovering undocumented API endpoints, testing for BOLA/IDOR in API resources, performing API fuzzing, analyzing API traffic, testing rate limiting, or when the target exposes programmatic interfaces requiring security assessment per OWASP API Security Top 10.
- ▌ Writing Security Reports · njones17 bundleUse when documenting security findings, writing pentest reports, creating vulnerability advisories, drafting executive summaries for security assessments, formatting evidence for security deliverables, scoring vulnerabilities with CVSS, writing remediation guidance, or producing any security assessment documentation deliverable.
- ▌ Dispatching Parallel Agents · njones17Use when facing 2+ independent security tasks that can be worked on without shared state or sequential dependencies — parallel scans across targets, simultaneous testing of unrelated attack surfaces, or concurrent investigation of independent findings
- ▌ Nextjs Security · njones17Comprehensive security testing for Next.js applications, covering App Router, RSC, Server Actions, and common deployment misconfigurations.
- ▌ Detecting Rootkit Activity · njones17Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.
- ▌ Infra Pentesting · njones17Use when testing network infrastructure, servers, or internal/external networks. Triggers: host discovery, port scanning, service enumeration, vulnerability assessment, exploitation of network services, Active Directory attacks, password cracking, lateral movement, pivoting, privilege escalation, cloud infrastructure testing, network-level attacks like MITM or ARP spoofing. Covers TCP/UDP services including SSH, FTP, SMB, RDP, SNMP, DNS, LDAP, Kerberos, WinRM. Applies to both Linux and Windows targets in on-prem and cloud environments.
- ▌ Recon And Enumeration · njones17Use when starting a new engagement, scoping a target, gathering intelligence before exploitation, discovering attack surface, enumerating services and technologies, performing subdomain discovery, identifying entry points, or when the user asks to scan, enumerate, fingerprint, or map a target network or application.
- ▌ Triage Vuln · njones17Triages a vulnerability or CVE. Pulls CVSS score, EPSS exploitation probability, KEV status, affected versions, patch availability, and produces a prioritized remediation recommendation. Use when evaluating scanner findings or CVE notifications.
- ▌ Fastapi Security · njones17Use when assessing security for Python FastAPI applications. Focuses on Pydantic exploitation, dependency injection gaps, OpenAPI exposure, ASGI middleware security, and Python-specific vulnerabilities like template injection and SSRF.
- ▌ GRAPHQL Security · njones17Use when testing GraphQL APIs for common vulnerabilities including introspection exploitation, authorization bypasses, batching abuse, and denial of service. Covers endpoint discovery, schema analysis, and exploitation of GraphQL-specific features like federation and directives.
- ▌ Executing Red Team Exercise · njones17Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.
- ▌ Webapp Pentesting · njones17 bundleUse when testing web applications for security vulnerabilities, performing webapp penetration tests, assessing OWASP Top 10 risks, testing for XSS/SQLi/CSRF/SSRF/IDOR/auth bypass, fuzzing web endpoints, scanning web servers, intercepting HTTP traffic, testing file uploads, evaluating session management, or when the target is a browser-accessible web application requiring comprehensive security assessment.
- ▌ Analyzing Windows Shellbag Artifacts · njones17 bundleAnalyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
- ▌ Extracting Browser History Artifacts · njones17Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
- ▌ Performing Sqlite Database Forensics · njones17 bundlePerform forensic analysis of SQLite databases to recover deleted records from freelists and WAL files, decode encoded timestamps, and extract evidence from browser history, messaging apps, and mobile device databases.
- ▌ Exploiting SQL Injection With Sqlmap · njones17Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
- ▌ Exploiting Websocket Vulnerabilities · njones17Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.
- ▌ Performing JWT None Algorithm Attack · njones17Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens.
- ▌ None 2 · njones17 bundleNikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies ve
- ▌ Analyzing Cyber Kill Chain · njones17Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.
- ▌ Testing JWT Token Security · njones17Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.
- ▌ Vulnerability Verification · njones17 bundleUse when a scanner or manual testing has identified a potential vulnerability that needs confirmation, when eliminating false positives from automated scan results, when determining real-world exploitability and impact of a finding, when collecting evidence for a security report, when chaining multiple low-severity issues into a higher-impact attack, or when verifying that a patch or remediation actually fixes a vulnerability.
- ▌ Securing Kubernetes On Cloud · njones17This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.
- ▌ Ctf Web · njones17 bundleWeb exploitation techniques for CTF challenges. Use when solving web security challenges involving XSS, SQLi, SSTI, SSRF, CSRF, XXE, file upload bypasses, JWT attacks, prototype pollution, path traversal, command injection, request smuggling, DOM clobbering, Web3/blockchain, or authentication bypass.
- ▌ Ctf Misc · njones17 bundleMiscellaneous CTF challenge techniques. Use for encoding puzzles, RF/SDR signal processing, Python/bash jails, DNS exploitation, unicode steganography, floating-point tricks, QR codes, audio challenges, Z3 constraint solving, Kubernetes RBAC, WASM game patching, esoteric languages, game theory, commitment schemes, combinatorial games, or challenges that don't fit other categories.
- ▌ Ctf Osint · njones17 bundleOpen Source Intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
- ▌ Ctf Crypto · njones17 bundleCryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.
- ▌ Gen Report · njones17Generates a professional security report from findings. Supports pentest, vulnerability assessment, bug bounty, code review, and IR post-mortem formats. Pass the report type and any notes or findings as arguments.
- ▌ Ctf Malware · njones17 bundleMalware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, or extracting malware configurations and indicators of compromise.
- ▌ Ctf Reverse · njones17 bundleReverse engineering techniques for CTF challenges. Use when analyzing binaries, game clients, obfuscated code, esoteric languages, custom VMs, anti-debugging, WASM, .NET, APK, Python bytecode, Ghidra, GDB, radare2, or extracting flags from compiled executables.
- ▌ Ctf Forensics · njones17 bundleDigital forensics and signal analysis for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, or recovering deleted files and credentials.
- ▌ Severity Rate · njones17Rates the severity of a security finding by walking through CVSS v3.1 scoring, EPSS context, and real-world risk factors. Produces a justified severity rating with full CVSS vector. Use when you need to assign or challenge a severity for a finding.
- ▌ Solve Challenge · njones17Solve CTF challenges by analyzing files, connecting to services, and applying exploitation techniques. Orchestrates category-specific CTF skills for pwn, crypto, web, reverse engineering, forensics, OSINT, malware analysis, and miscellaneous challenges.
- ▌ Hunting For Shadow Copy Deletion · njones17 bundleHunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.
- ▌ Processing Stix Taxii Feeds · njones17Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.
- ▌ Securing API Gateway With AWS Waf · njones17Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
- ▌ Analyzing Windows Event Logs In Splunk · njones17Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
- ▌ Detecting Attacks On Historian Servers · njones17Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.
- ▌ Detecting Cloud Threats With Guardduty · njones17This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
- ▌ Detecting Lateral Movement With Splunk · njones17 bundleDetect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
- ▌ Detecting Process Injection Techniques · njones17Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
- ▌ Analyzing Memory Dumps With Volatility · njones17Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.
- ▌ Recovering Deleted Files With Photorec · njones17Recover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.
- ▌ Implementing Usb Device Control Policy · njones17 bundleImplements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
- ▌ Implementing Zero Trust In Cloud · njones17This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.
- ▌ Detecting Insider Threat Behaviors · njones17 bundleDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
- ▌ Performing User Behavior Analytics · njones17Performs User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.
- ▌ Triaging Security Alerts In Splunk · njones17Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.
- ▌ Auditing Cloud With Cis Benchmarks · njones17This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
- ▌ Triaging Security Incident · njones17Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.
- ▌ Analyzing Linux Elf Malware · njones17Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
- ▌ Performing Blind Ssrf Exploitation · njones17Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.
- ▌ Performing Packet Injection Attack · njones17Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.
- ▌ Hunting For Webshell Activity · njones17 bundleHunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.
- ▌ Prompt Injection Defense · njones17Defend AI systems against prompt injection and indirect prompt attacks using input controls, tool permissions, output validation, and isolation boundaries.
- ▌ Implementing Endpoint Dlp Controls · njones17 bundleImplements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.
- ▌ Analyzing Security Logs With Splunk · njones17Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
- ▌ Using Git Worktrees · njones17Use when starting security work that needs isolation from current workspace, before executing engagement plans, or when testing exploits that could affect the working tree — creates isolated git worktrees with smart directory selection and safety verification
- ▌ Stealth Techniques · njones17Use when security tools are being blocked by WAF, rate limiting, or intrusion detection systems. Provides comprehensive evasion techniques including User-Agent spoofing, header randomization, timing evasion, session mimicking, and WAF bypass patterns for stealthy security assessments.
- ▌ Using Superhackers · njones17Use when starting any security task, pentest, vulnerability assessment, code review, recon, exploit development, or security assessment. Use FIRST before loading any other superhackers skill. Use when unsure which security skill to load. Use when planning a multi-phase security engagement.
- ▌ Exploit Development · njones17 bundleUse when needing to exploit a confirmed vulnerability, generate payloads, craft reverse shells, use Metasploit modules, write custom exploit scripts, perform post-exploitation, escalate privileges, pivot through networks, bypass security controls, or when the user asks to exploit, pwn, pop a shell, gain access, or weaponize a finding.
- ▌ Mitre Map · njones17Maps a security finding, attack technique, threat actor, or malware family to the MITRE ATT&CK framework. Returns tactic, technique ID, sub-technique, detection opportunities, and data sources. Use when writing reports, building detection rules, or attributing activity.
- ▌ Security Assessment · njones17Use when planning, scoping, or executing a comprehensive security assessment, penetration test, red team engagement, or security audit. Use when the user needs to coordinate multiple security testing activities, define assessment scope and rules of engagement, perform threat modeling, rate risk using CVSS, map findings to compliance frameworks (OWASP Top 10, PCI DSS, SOC 2, ISO 27001), manage assessment lifecycle from planning through reporting, or orchestrate multiple security skills together. Use as the master coordinator when no single specialized skill covers the full task.
- ▌ Ioc Lookup · njones17Enriches an indicator of compromise (IP, domain, URL, file hash, or email). Pulls reputation data, threat intelligence, WHOIS, passive DNS, malware associations, and ATT&CK context. Use during incident response, threat hunting, or alert triage.
- ▌ Using Payload Library · njones17Guides Claude in selecting and using the right security testing payloads from the payload library. Use when testing web application vulnerabilities, choosing attack vectors, or escalating from detection to impact. Automatically loads the relevant payload file based on vulnerability type.
- ▌ Scope Check · njones17Verifies whether a target (IP, domain, URL, or system) is within the authorized scope of the current engagement before testing begins. Always run this before touching a new target. Reads scope.md from the current engagement directory if it exists.
- ▌ Assessment Orchestrator · njones17 bundleUse when orchestrating security assessments across multiple related components. Automatically detects related targets (APIs, subdomains, backend services) and triggers appropriate assessments. Use when a primary assessment request implies related sub-targets (e.g., web app → API, mobile app → backend). Expands assessment scope intelligently based on component relationships while maintaining audit trail and user control.
- ▌ Pentest Start · njones17Kicks off a penetration test engagement. Sets up scope, rules of engagement, target inventory, and working directory structure. Invoke manually at the start of any assessment.
- ▌ Writing Security Skills · njones17Use when creating new superhackers security skills, editing existing security skills, reviewing skill quality before deployment, or when a gap is discovered during a security engagement and needs to be captured as a reusable skill.
- ▌ Securing Github Actions Workflows · njones17 bundleThis skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.
- ▌ None 4 · njones17 bundleAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl
- ▌ Building Soc Escalation Matrix · njones17 bundleBuild a structured SOC escalation matrix defining severity tiers, response SLAs, escalation paths, and notification procedures for security incidents.
- ▌ Performing Ransomware Response · njones17Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.
- ▌ Executing Red Team Engagement Planning · njones17 bundleRed team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
- ▌ Exploiting Kerberoasting With Impacket · njones17 bundlePerform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.
- ▌ Exploiting Server Side Request Forgery · njones17Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
- ▌ Performing Directory Traversal Testing · njones17Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.
- ▌ Generating Threat Intelligence Reports · njones17Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
- ▌ Correlating Threat Campaigns · njones17Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
- ▌ Building Adversary Infrastructure Tracking System · njones17Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.
- ▌ Auditing AWS S3 Bucket Permissions · njones17Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
- ▌ Implementing Rsa Key Pair Management · njones17 bundleRSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating,
- ▌ Analyzing Linux System Artifacts · njones17Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
- ▌ Implementing Mobile Application Management · njones17 bundleImplements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.
- ▌ Implementing Secret Scanning With Gitleaks · njones17 bundleThis skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
- ▌ Implementing Secrets Management With Vault · njones17This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
- ▌ Containing Active Breach · njones17Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.
- ▌ Exploiting Broken Link Hijacking · njones17Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.