← all publishers

purpleailab

@purpleailab source repo

Report this profile Claim this profile

• 351 skills
• 0 followers
• 19 hours ago last updated

1. ▌
   Reverser Firmware · purpleailab

   Router / IoT firmware extraction pipeline — unpack nested filesystems, locate web server, identify backdoor credentials.
   0
   installs
2. ▌
   Wpa2 Psk · purpleailab

   WPA/WPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer/SMB encryption mode in 2026.
   0
   installs
3. ▌
   Wpa3 Sae · purpleailab

   WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.
   0
   installs
4. ▌
   Bloodhound Bhce · purpleailab

   Operate BloodHound Community Edition v9.2.2 via Decepticon's bhce_* tools — health check, Cypher passthrough, SharpHound ZIP ingest. Replaces the in-house ingest + ESC* post-process pipeline per ADR-0005.
   0
   installs
5. ▌
   Patch Diff Research · purpleailab

   Authorized patch-diff workflow for deriving and validating vulnerability variants from a known vulnerable-to-fixed source change.
   0
   installs
6. ▌
   AWS Iam Enum · purpleailab

   Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.
   0
   installs
7. ▌
   Crypto · purpleailab

   Web crypto exploitation — padding-oracle (Vaudenay), AES-CBC bit-flipping / IV manipulation, AES-ECB pattern attacks (cut-and-paste, prefix/suffix recovery), HMAC bypass, hash-length extension, JWT alg confusion. Covers detection signals, working in-file Python harnesses (concurrent.futures, timeout=5, python3 -u, bounded request budget), and the confirm-oracle gate that must fire before iteration.
   0
   installs
8. ▌
   Nosqli · purpleailab

   NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.
   0
   installs
9. ▌
   Dynamic · purpleailab

   iOS dynamic instrumentation on jailbroken device — Frida/Objection setup, SSL Kill Switch pinning bypass, jailbreak-detection bypass, keychain dump, biometric/LAContext bypass, and ObjC runtime method hooking.
   0
   installs
10. ▌
    Macos Post Exploitation · purpleailab

    macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.
    0
    installs
11. ▌
    Active Recon · purpleailab

    Active target probing — port scanning, service detection, vulnerability scanning, banner grabbing, web directory fuzzing, SSL/TLS analysis.
    0
    installs
12. ▌
    Iot Security · purpleailab

    IoT device security reconnaissance — firmware extraction, embedded analysis, protocol identification, default credential checking, vulnerability scanning, device fingerprinting.
    0
    installs
13. ▌
    Rop Chain · purpleailab

    ROP/JOP gadget hunting and exploit-chain construction — for NX/DEP bypass on x86/x64/ARM binaries.
    0
    installs
14. ▌
    Bloodhound Query · purpleailab

    BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
    0
    installs
15. ▌
    Auth Bypass · purpleailab

    Hunt authentication/authorization bypass in route guards, role checks, tenant boundaries, and state-machine transitions.
    0
    installs
16. ▌
    Entra Privesc · purpleailab

    Entra ID privilege escalation + persistence — app role/owner abuse, service-principal credential addition, dynamic group membership abuse, Administrative Unit role assignment, hybrid identity attacks (Connect, PHS, PTA, Seamless SSO, Golden SAML), Graph API privesc paths.
    0
    installs
17. ▌
    Ics Dnp3 · purpleailab

    DNP3 attack — TCP/20000 (or 19999 serial-over-TCP) outstation enumeration, binary input / analog input poll, control relay output block (CROB) actuation, unsolicited reporting abuse, DNP3 Secure Authentication (DNP3-SA) downgrade, vendor-specific objects.
    0
    installs
18. ▌
    Supplychain Overview · purpleailab

    Supply-chain attack category — dependency confusion, typosquatting, package-registry abuse, build-pipeline poisoning, SBOM manipulation.
    0
    installs
19. ▌
    GRAPHQL · purpleailab

    GraphQL exploitation — introspection, injection, authorization bypass, and data exfiltration through GraphQL APIs.
    0
    installs
20. ▌
    Binwalk Extract · purpleailab

    Firmware image extraction with binwalk and firmware-mod-kit — recursive archive carving, squashfs/jffs2/ubifs mounting, entropy analysis to detect packed/encrypted regions, and nested container handling. Entry point for all static filesystem analysis after a raw binary image is acquired.
    0
    installs
21. ▌
    Hardcoded Creds · purpleailab

    Systematic hunt for hardcoded credentials, API keys, certificates, and default passwords in extracted IoT firmware. Covers /etc/shadow and passwd parsing, busybox httpd configs, telnet/dropbear stanzas, MQTT/cloud API key extraction, and cross-referencing against known default-credential databases.
    0
    installs
22. ▌
    Ros2 Dds Attack · purpleailab

    ROS2/DDS network attack: unauthenticated topic enumeration, message injection, and telemetry interception against robotic platforms and autonomous systems.
    0
    installs
23. ▌
    Passive Recon · purpleailab bundle

    Passive intelligence gathering without touching the target — DNS, WHOIS, subdomain enumeration, Certificate Transparency, technology fingerprinting, ASN mapping.
    0
    installs
24. ▌
    Ctf Triage · purpleailab

    CTF challenge triage and solve methodology — category detection, tool selection, and multi-step solve chains across pwn/rev/crypto/forensics/web/misc.
    0
    installs
25. ▌
    Reverser IOS Static · purpleailab

    iOS IPA static analysis — class-dump-z / class-dump-ng, Hopper / IDA / Ghidra for Mach-O ARM64, Objective-C runtime introspection, Swift demangling, App Transport Security check, plist analysis, embedded provisioning profile parse. For dynamic Frida/Objection see mobile/SKILL.md.
    0
    installs
26. ▌
    Deauth Pmf · purpleailab

    Targeted and broadcast 802.11 deauthentication / disassociation, 802.11w/PMF posture detection, and action-frame attack variants. Reusable by wpa2-psk (handshake), wpa3-sae (downgrade), and evil-twin (roaming coercion).
    0
    installs
27. ▌
    Ad Certipy Esc Chain · purpleailab

    ADCS abuse via Certipy — find vulnerable templates (ESC1-ESC15), request a certificate, authenticate as the target, dump the krbtgt. Full chain in 4 commands. Covers ESC1 (any SAN), ESC2 (any-purpose EKU), ESC3 (enrollment-agent), ESC4 (vulnerable ACL), ESC8 (NTLM relay to CA), ESC9/10/11/13.
    0
    installs
28. ▌
    Supply Chain · purpleailab

    Hunt LLM supply-chain compromise (OWASP LLM03:2025) — malicious or backdoored models, datasets, adapters, plugins, MCP servers, and tokenizer / framework dependencies that ship inside an AI-integrated product.
    0
    installs
29. ▌
    Flash Loan · purpleailab

    Flash-loan exploit patterns — callback reentrancy, oracle amplification, governance attacks, unauthenticated callback handlers.
    0
    installs
30. ▌
    Reentrancy · purpleailab

    Hunt and validate reentrancy bugs — classic cross-function, same-function, read-only, and cross-contract variants.
    0
    installs
31. ▌
    Opcua · purpleailab

    OPC-UA (TCP 4840) attack playbook — endpoint enumeration, SecurityPolicy mapping, anonymous/weak-auth abuse, address-space browsing and tag read, HistoryRead exfiltration, Method call for control actions, session-exhaustion DoS. Modern IT/OT DMZ convergence protocol replacing legacy fieldbus.
    0
    installs
32. ▌
    Xs Leaks · purpleailab

    XS-Leaks — cross-site information leaks via timing, frame counting, navigation, error oracles. Side-channel attacks against same-origin authenticated state.
    0
    installs
33. ▌
    Bootloader Uboot · purpleailab

    U-Boot bootloader attack playbook — console interrupt to break the autoboot countdown, environment variable inspection and manipulation, bootargs override to spawn init=/bin/sh, secure-boot bypass techniques, and fault-injection basics (voltage and clock glitching). Covers MIPS, ARM, and AArch64 targets.
    0
    installs
34. ▌
    Zigbee Touchlink · purpleailab

    Touchlink commissioning abuse on Zigbee Light Link (ZLL) devices using the well-known ZLL transport key, ZCL command injection (toggle/move/step), network key extraction, and factory reset via touchlink. Toolchain covers KillerBee, zbstumbler, zbreplay, and Sonoff Zigbee 3.0 Dongle E running Wireshark live capture.
    0
    installs
35. ▌
    Bounty Report Formatter · purpleailab

    Bug bounty report formatting for HackerOne, Bugcrowd, Immunefi, and GitHub Security Advisories. Load after validate_finding succeeds and the finding needs to be submitted to a bounty program.
    0
    installs
36. ▌
    SQL Injection · purpleailab

    Hunt SQL injection (CWE-89) via source-level taint tracking. Covers string concat, format-string, ORM raw queries, second-order injection, and NoSQL injection in MongoDB/DynamoDB.
    0
    installs
37. ▌
    API Soap Wsdl · purpleailab

    SOAP / WSDL exploitation — WSDL enumeration via ?wsdl, XXE in SOAP envelope, WS-Addressing replay, WS-Security UsernameToken brute, SAML token injection in WS-Trust, schema validation bypass.
    0
    installs
38. ▌
    API Websocket · purpleailab

    WebSocket exploitation — origin-bypass (CSWSH cross-site WebSocket hijacking), missing per-message auth, message-type confusion, msg-flood DoS, ws→wss downgrade, hidden RPC routes in the WS frame layer.
    0
    installs
39. ▌
    Ics Bacnet · purpleailab

    BACnet/IP attack — UDP/47808 discovery via Who-Is broadcast, ReadProperty / WriteProperty without auth, BBMD abuse for remote reach, vendor-specific I-Am responses, COV (Change Of Value) subscription flood, Building Automation HMI pivot.
    0
    installs
40. ▌
    Ics Modbus · purpleailab

    Modbus TCP attack — port 502 enumeration, coil/holding-register read/write without auth, function-code abuse (FC8 diagnostic, FC43 read-device-id), Modbus-over-Serial via TCP gateway, write-with-no-confirm DoS, value tampering against PLCs.
    0
    installs
41. ▌
    Ics S7comm · purpleailab

    Siemens S7 PLC attack — TCP/102 ISO-TP+S7-COMM, snap7 / python-snap7 enumeration, DB/M/E/A area read+write, PLC stop/start/run, password bypass (S7-300/400 vs S7-1200/1500 differences), CVE chain (e.g., Stuxnet's legacy primitives, CVE-2019-10936).
    0
    installs
42. ▌
    Smuggling · purpleailab

    HTTP Request Smuggling (HRS) — front-end / back-end parser disagreement attacks that desync the proxy stack. Covers CL.TE, TE.CL, TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te), pipelining, and connection-state pinning. Includes a confirm-desync gate, header obfuscation catalog, and minimal raw-socket Python harnesses (no smuggler.py available in sandbox).
    0
    installs
43. ▌
    Il2cpp · purpleailab

    Unity IL2CPP game reversing — Il2CppDumper metadata recovery, global-metadata.dat decryption, IDA/Ghidra symbol restore via generated scripts, Frida method hooking, IAP/license bypass, and zygisk-il2cpp-dumper for obfuscated metadata.
    0
    installs
44. ▌
    C2 Havoc · purpleailab

    Havoc C2 framework (C5pider/Havoc) — modern Sliver/CS alternative, Demon agent with indirect syscalls, sleep obfuscation (Ekko/Zilean/FOLIAGE), Donut PIC loader integration, profile-driven HTTP comms, MaterialUI web client. Best when you need modern OPSEC without Cobalt Strike cost.
    0
    installs
45. ▌
    Mobile Security · purpleailab

    Mobile application security reconnaissance — APK/IPA analysis, permission enumeration, certificate validation, hardcoded secret detection, insecure storage identification, network security analysis.
    0
    installs
46. ▌
    Reverser Yara Hunting · purpleailab

    YARA rule authoring + hunting — `condition:` syntax, hex patterns with wildcards, `for`/`any of them`, PE module, ELF module, hash module, math module. Build per-family signatures, hunt at scale via VT/MalwareBazaar/Hybrid Analysis. Avoid common pitfalls (collisions, slow rules, regex traps).
    0
    installs
47. ▌
    Bounty Hunting Methodology · purpleailab

    Bug bounty white-box hunting methodology. Load when the target is an open-source project with a security advisory program, bug bounty, or responsible disclosure policy.
    0
    installs
48. ▌
    Misinformation · purpleailab

    Hunt LLM misinformation / overreliance (OWASP LLM09:2025) — confident-but-wrong outputs that flow into downstream automated decisions, compliance reports, customer communications, or autonomous code commits without verification.
    0
    installs
49. ▌
    Path Traversal · purpleailab

    Hunt directory traversal and archive traversal (ZipSlip/TarSlip) from user input to filesystem operations.
    0
    installs
50. ▌
    Trust Boundary Analysis · purpleailab

    Trust boundary mapping and startup sequence audit for developer tools, CLI apps, and plugin systems. Load when the target is a developer tool, CLI, IDE extension, or any application that loads config from the current directory.
    0
    installs
51. ▌
    Contracts Mev Sandwich · purpleailab

    MEV sandwich attacks — front-run + back-run a victim swap on Uniswap V2/V3, Curve, Balancer; mempool monitoring via Flashbots / private RPC, slippage tolerance exploitation, JIT liquidity sandwich, multi-block MEV.
    0
    installs