安全
安全审查、认证、权限和风险检查
Skills 列表
analyzing-command-and-control-communication
'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
mukul975analyzing-linux-audit-logs-for-intrusion
'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities
mukul975analyzing-network-traffic-with-wireshark
'Captures and analyzes network packet data using Wireshark and tshark
mukul975testing-jwt-token-security
Assessing JSON Web Token implementations for cryptographic weaknesses,
mukul975testing-api-for-broken-object-level-authorization
'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR,
mukul975testing-for-broken-access-control
Systematically tests web applications and APIs for broken access control
mukul975analyzing-bootkit-and-rootkit-samples
'Analyzes bootkit and advanced rootkit malware infecting the Master
mukul975analyzing-azure-activity-logs-for-threats
'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
mukul975exploiting-sql-injection-vulnerabilities
'Identifies and exploits SQL injection vulnerabilities in web applications
mukul975analyzing-indicators-of-compromise
'Analyzes indicators of compromise (IOCs) including IP addresses, domains,
mukul975analyzing-linux-system-artifacts
Examine Linux system artifacts (auth logs, cron/systemd persistence,
mukul975analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
mukul975testing-api-authentication-weaknesses
'Tests API authentication mechanisms for weaknesses including broken
mukul975analyzing-linux-elf-malware
'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,
mukul975analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
mukul975analyzing-linux-kernel-rootkits
Detect kernel-level rootkits in Linux memory dumps using Volatility3
mukul975analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '
mukul975abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
mukul975analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
mukul975analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
mukul975analyzing-network-packets-with-scapy
Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.
mukul975reverse-engineering-android-malware-with-jadx
'Reverse engineers malicious Android APK files using the JADX decompiler
mukul975analyzing-network-traffic-for-incidents
'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including
mukul975analyzing-sbom-for-supply-chain-vulnerabilities
'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON
mukul975