Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker,

The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7.

Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure

'Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows

Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts

Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic

'Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder,

'Implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy

'Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software

'Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through

Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to discover memory corruption, input handling,

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations,

'Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant

'Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443,

Patch management is the systematic process of identifying, testing, deploying, and verifying software updates

'Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets,

'This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD

'Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences

'Uses Postman to perform structured API security testing by building collections that test for OWASP API Security

'Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy

Develop and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization based

'Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations

'Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments

'Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library.

Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting

Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking

'Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate

Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations,

Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit

Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on

'Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during

'Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging,

Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure

'Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized

'Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting

Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket

'This skill covers conducting cybersecurity assessments specific to oil and gas facilities including upstream

Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators

'Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments

'This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including

'Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege

Linux privilege escalation involves elevating from a low-privilege user account to root access on a compromised

'Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis across the

'Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making,

'Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based

'Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to

Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover