712 skills found ¡ Page 4 of 24
mukul975 / abusing-dpapi-for-credential-accessExtract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key.
mukul975 / abusing-shadow-credentials-for-privescTake over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset
mukul975 / analyzing-ios-app-security-with-objectionRuntime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
mukul975 / auditing-entra-id-with-aadinternalsDrive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation.
mukul975 / building-threat-intelligence-platformDesign and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards
mukul975 / building-vulnerability-dashboard-with-defectdojoDeploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API
mukul975 / coercing-authentication-with-coercer-petitpotamTrigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB.
mukul975 / conducting-cloud-incident-responseRespond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure
mukul975 / Create Fake Materials: Fake WebsiteDesign and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience
mukul975 / PhishingMonitor Certificate Transparency logs using crt.sh and Certstream to
mukul975 / assessing-vector-and-embedding-weaknessesTest RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
mukul975 / conducting-cloud-penetration-testing'This skill outlines methodologies for performing authorized penetration
mukul975 / analyzing-linux-audit-logs-for-intrusion'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities
mukul975 / analyzing-network-traffic-with-wireshark'Captures and analyzes network packet data using Wireshark and tshark
mukul975 / attacking-entra-id-with-roadtoolsEnumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and
mukul975 / building-red-team-c2-infrastructure-with-havocDeploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
mukul975 / Transfer of funds'Builds a structured SOC incident response playbook for ransomware attacks
mukul975 / bypassing-authentication-with-forced-browsingDiscovering and accessing unprotected pages, APIs, and administrative
mukul975 / conducting-man-in-the-middle-attack-simulation'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap
mukul975 / auditing-tls-certificate-transparency-logs'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate
mukul975 / collecting-open-source-intelligence'Collects and synthesizes open-source intelligence (OSINT) about threat
mukul975 / conducting-network-penetration-test'Conducts comprehensive network penetration tests against authorized
mukul975 / analyzing-supply-chain-malware-artifactsInvestigate supply chain attack artifacts including trojanized software
mukul975 / building-c2-infrastructure-with-sliver-frameworkDeploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations
mukul975 / building-threat-hunt-hypothesis-frameworkBuild a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report
mukul975 / conducting-cyber-risk-assessment-with-nist-800-30Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as aâĻ
mukul975 / conducting-domain-persistence-with-dcsyncPerform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz.
mukul975 / Phone Number Spoofing: Official Phone Number SpoofingPlan and execute authorized vishing (voice phishing) pretext calls to
mukul975 / Account Takeover: Exposed Login CredentialRun a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results.
mukul975 / conducting-wireless-network-penetration-test'Conducts authorized wireless network penetration tests to assess the
