ogrodev

This skill should be used when the user mentions "brute force", "password cracking", "hydra", "hashcat", "john the ripper", "credential stuffing", "password spray", "password spraying", "hash cracking", "wordlist", "dictionary attack", "mask attack", "rainbow table", "NTLM", "NTLMv2", "bcrypt", "Kerberoast", "Kerberoasting", "AS-REP roasting", "AS-REP roast", "golden ticket", "silver ticket", "tic

Activate this skill when the user mentions ANY of: "YARA", "YARA rules", "YARA signature", "write YARA", "detection rule", "packer detection", "packer identification", "packed binary", "UPX", "Themida", "VMProtect", "ASPack", "crypter", "obfuscated binary", "entropy", "entropy analysis", "section entropy", "high entropy", "malware family", "malware classification", "malware triage", "classify samp

This skill should be used when the user mentions "dump database", "acquire data", "download dump", "extract records", "mongodump", "elasticdump", "mongoexport", "database dump", "data extraction", "redis dump", "couch dump", or discusses safely pulling data from an open database, converting database export formats, setting extraction limits, or monitoring dump progress. It routes data acquisition

This skill should be used when the user mentions "harden", "hardening", "sysctl", "kernel parameters", "SSH config", "sshd_config", "firewall rules", "iptables", "nftables", "ufw", "fail2ban", "file permissions", "SUID", "SGID", "service minimization", "disable services", "auditd", "SELinux", "AppArmor", "CIS benchmark", "security baseline", "OS hardening", "attack platform", "operator machine", "

This skill should be used when the user mentions "Google dork", "search operator", "inurl:", "filetype:", "intitle:", "site:", "intext:", "dork pattern", "breach forum", "BreachForums", "Exploit.in", "XSS.is", "RaidForums", "forum intelligence", "forum navigation", "seller credibility", "paste site", "Pastebin", "Ghostbin", "paste search", "paste monitoring", "Telegram leak", "Telegram channel", "

This skill should be used when the user mentions "generate report", "opsec report", "engagement report", "pentest report", "red team report", "purple team report", "security assessment", "hardening report", "compliance report", "audit report", "findings report", "evidence handling", "chain of custody", "redaction", "redact", "report delivery", "secure delivery", "debrief", "debrief prep", "post-en

This skill activates when the user mentions "XSS", "cross-site scripting", "reflected XSS", "stored XSS", "DOM XSS", "blind XSS", "SQL injection", "SQLi", "blind SQLi", "union injection", "error-based injection", "time-based injection", "stacked queries", "second-order injection", "SSRF", "server-side request forgery", "cloud metadata", "IMDS", "internal service access", "IDOR", "insecure direct o

Activate this skill whenever the user mentions API endpoint, REST API, RESTful, GraphQL, GraphQL introspection, GraphQL mutation, gRPC, gRPC reflection, WebSocket, WebSocket upgrade, WS endpoint, API security, API fuzzing, API enumeration, API versioning, API gateway, API rate limit, JWT, JSON Web Token, bearer token, access token, refresh token, API key, OAuth, OAuth2, OIDC, OpenID Connect, PKCE,

This skill should be used when the user mentions "new engagement", "setup engagement", "initialize workspace", "start operation", "new pentest", "setup project", "create workspace", "engagement setup", "initialize engagement", "new investigation", "start campaign", "new operation", "workspace init", "set up a new operation", "begin engagement", or discusses setting up a new offensive security enga

Activate this skill whenever the user mentions cloud lateral movement, cloud privilege escalation, cloud post-exploitation, cloud red team, multi-cloud attack, cloud pentesting, AWS, Amazon Web Services, EC2, S3, Lambda, IAM, STS, SSM, Systems Manager, CloudTrail, GuardDuty, CloudShell, Secrets Manager, Parameter Store, RDS, ECS, EKS, Fargate, ECR, CodeBuild, CodePipeline, Glue, SageMaker, instanc

This skill should be used when the user mentions "payment", "payment gateway", "checkout", "IDOR payment", "payment bypass", "Stripe", "MercadoPago", "Binance Pay", "PIX", "PayPal", "Adyen", "Braintree", "Square", "Razorpay", "Mollie", "webhook", "payment webhook", "price manipulation", "amount tampering", "currency manipulation", "e-commerce", "shopping cart", "cart manipulation", "checkout flow"

This skill should be used when the user mentions "Shodan", "Censys", "MongoDB exposed", "Elasticsearch open", "Redis no auth", "open database", "unauthenticated database", "exposed MongoDB", "exposed Elasticsearch", "exposed Redis", "exposed CouchDB", "exposed MySQL", "exposed PostgreSQL", "port 27017", "port 9200", "port 6379", "port 5984", "port 3306", "port 5432", "find open databases", "databa