'Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell

Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty

'Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate

Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox,

'Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous

'This skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed

Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations,

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords

A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and

Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit

Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation

Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and

'Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have

Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on

'Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring

'Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during

'Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions,

Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying

'Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to

'Performs interactive dynamic malware analysis using the ANY.RUN cloud sandbox to observe real-time execution

'Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging,

'Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches,

'Performs entitlement review and access certification campaigns using SailPoint IdentityIQ including manager

Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure

Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement,

Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract

'Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives,

'Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers,

'Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover

Perform GCP security testing using GCPBucketBrute for storage bucket enumeration, gcloud IAM privilege escalation

'Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security,

Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service

'Performs GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions,

Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service

Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for cryptographic key management, signing

Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength.

Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting

'Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment,

Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session

'Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized

'Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan,

'Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection

'Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces,

Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities,

Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting

Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control