Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →