[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFGG3JZPH7E4DG4PJV0GZ7":3,"skill-same:01M6AFGG3JZPH7E4DG4PJV0GZ7":135},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":76,"commitSha":77,"skillDirectory":78,"forksCount":79,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":83,"ownerDescription":84,"updatedAt":85,"install":86,"resources":99},"01M6AFGG3JZPH7E4DG4PJV0GZ7","intercepting-mobile-traffic-with-burpsuite",null,"Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"intercepting mobile traffic with burpsuite","burpsuite","penetration testing","analysis","applications","burp-suite","t1059","t1078","ios","mobile-security","testing","server","https","proxy","communication","authentication","pr","http","cybersecurity","android","2026-11-10 10:12:30",false,"---\nname: intercepting-mobile-traffic-with-burpsuite\ndescription: 'Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications\n  using Burp Suite proxy to identify insecure API communications, authentication flaws,\n  data leakage, and server-side vulnerabilities. Use when performing mobile application\n  penetration testing, assessing API security, or evaluating client-server communication\n  patterns. Activates for requests involving mobile traffic interception, Burp Suite\n  mobile proxy, API security testing, or mobile HTTPS analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- burp-suite\n- traffic-interception\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n---\n# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n","# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n",{"name":5,"tags":60,"author":63,"domain":53,"license":15,"version":64,"nist_csf":65,"subdomain":44,"description":70,"mitre_attack":71},[44,54,43,40,61,62],"traffic-interception","penetration-testing","mahipal","1.0.0",[66,67,68,69],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.\n",[72,73,74,75],"T1059","T1056","T1036","T1078","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fintercepting-mobile-traffic-with-burpsuite",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill intercepting-mobile-traffic-with-burpsuite",{"tool":92,"command":93},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill intercepting-mobile-traffic-with-burpsuite",{"tool":95,"command":96},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill intercepting-mobile-traffic-with-burpsuite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FSKILL.md",true,[100,106,111,117,121,125,131],{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"assets\u002Ftemplate.md","ASSET","资产文件",1493,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fassets\u002Ftemplate.md",{"path":107,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002FLICENSE",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fapi-reference.md","REFERENCE","参考文档",1756,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fapi-reference.md",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fstandards.md",2319,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fstandards.md",{"path":122,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fworkflows.md",4174,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Freferences\u002Fworkflows.md",{"path":126,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fagent.py","SCRIPT","脚本",6548,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fscripts\u002Fagent.py",{"path":132,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fprocess.py",9891,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fintercepting-mobile-traffic-with-burpsuite\u002Fscripts\u002Fprocess.py",[136,162,186,210,236,263],{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[142],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[144,145,146,147,148,53,149,150,51,151,152,153,154,155,156,157,158,159,160,161],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[168],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[170,158,171,172,148,173,53,51,174,175,176,177,178,179,180,181,182,183,184,185],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":194,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[192,193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[180,195,196,197,45,53,198,199,174,200,201,202,203,204,205,42,206,207,208,209],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[216],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,53,221,222,223,224,225,226,227,228,229,230,231,232,177,233,234,235],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[242],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[244,245,246,53,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[269],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[148,271,53,272,273,274,275,276,277,278,279,42,280,206,38,281,282,283,284,285],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]