Attacker tradecraft with the judgment, not just the commands. 40 offensive security skills for red teams and pentesters: web/API/auth exploitation (JWT, OAuth/OIDC, SAML, XXE, SSRF, deserialization, GraphQL, gRPC), Active Directory and Entra ID, AD CS ESC1-16, Kerberos delegation, Linux/Windows privilege escalation, cloud, managed Kubernetes, serverless, CI/CD, containers, mobile, wireless, Bluetooth/NFC, ICS/OT, Web3, reconnaissance, social engineering, persistence, and password cracking — plus deception-spotting and multi-day engagement discipline. Every skill fact-checked against primary sources. Pairs with secskills-core.
40 skills
The reverse-engineering and code-audit foundation both sides share. 30 dual-use security skills: native and Go/Rust/.NET/iOS/firmware reverse engineering, packers, and Flutter/React Native/Unity/Xamarin runtimes; source-code auditing with PHP-specific depth; webshell and backdoor hunting; multi-agent vulnerability-research orchestration; supply-chain, cryptography, MCP, and pull-request review; vetting third-party agent skills and MCP servers; AI/LLM security; ATT&CK technique mapping; engagement-state discipline; and findings reporting. Ships the ttp-index.json ATT&CK map. Every skill fact-checked against primary sources.
30 skills
DFIR and detection built on preserve-first, base-rate discipline. 22 defensive security skills for SOC analysts, incident responders, and detection engineers: alert triage, malware and shellcode analysis, memory/disk/network forensics, phishing-email analysis, Windows endpoint DFIR, Linux persistence hunting, AWS/Azure/GCP/M365-Entra incident investigation, Kubernetes defense, cloud posture hardening, threat hunting, detection-as-code (Sigma/YARA/Suricata) with real false-positive analysis, risk-based vulnerability management, and threat intelligence. Every skill fact-checked against primary sources. Pairs with secskills-core.
22 skills