[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FEDC9QR13CMVR40HW26BX":3,"skill-same:01M71FEDC9QR13CMVR40HW26BX":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M71FEDC9QR13CMVR40HW26BX","net-layer3-ipv6",null,"--| | mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts | | WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications | | Domain Admin Relay | SUCCESS | Created rogue domain admin account | | IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |  ### Recommendations 1.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-layer3-ipv6\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"ipv6","net layer3 ipv6","cybersecurity","admin","dns","open","takeover","ports","Rules","scan","domain","recommendations","port","relay","hosts","for","2026-11-10 10:12:30",false,"---\nname: net-layer3-ipv6\ndescription: \"--| | mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts | | WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications | | Domain Admin Relay | SUCCESS | Created rogue domain admin account | | IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |  ### Recommendations 1.\"\ndomain: cybersecurity\n---\n\n--|\n| mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts |\n| WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications |\n| Domain Admin Relay | SUCCESS | Created rogue domain admin account |\n| IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |\n\n### Recommendations\n1. Deploy RA Guard on all access-layer switches (Critical)\n2. Configure IPv6 ACLs mirroring IPv4 firewall rules (Critical)\n3. Disable DHCPv6 client via Group Policy where IPv6 is not needed\n4. Block IPv6 tunneling protocols (6to4, Teredo) at the firewall\n5. Deploy IPv6-aware IDS rules for NDP spoofing detection\n```\n","--|\n| mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts |\n| WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications |\n| Domain Admin Relay | SUCCESS | Created rogue domain admin account |\n| IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |\n\n### Recommendations\n1. Deploy RA Guard on all access-layer switches (Critical)\n2. Configure IPv6 ACLs mirroring IPv4 firewall rules (Critical)\n3. Disable DHCPv6 client via Group Policy where IPv6 is not needed\n4. Block IPv6 tunneling protocols (6to4, Teredo) at the firewall\n5. Deploy IPv6-aware IDS rules for NDP spoofing detection\n```\n",{"name":5,"domain":21,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnet-layer3-ipv6","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill net-layer3-ipv6",{"tool":53,"command":54},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill net-layer3-ipv6",{"tool":56,"command":57},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill net-layer3-ipv6","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-layer3-ipv6\u002FSKILL.md",true,[61],{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"index.json","REFERENCE","参考文档",644,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-layer3-ipv6\u002Findex.json",[68,93,116,138,160,176],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":35},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,21,92],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":35},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[100,75,101,78,102,103,104,21,105,106,107,108,109,110,80,111,112,113,114,115],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":35},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[123,124,125,126,127,128,21,105,129,106,130,131,80,113,132,133,134,135,136,137],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":35},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[76,145,146,147,148,149,150,81,151,21,92,152,153,154,155,156,157,158,159,80],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":35},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[167,168,76,169,147,149,170,81,171,151,21,92,106,172,173,174,175,159,80,82],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":35},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[183,76,147,184,170,81,185,186,21,92,187,188,189,190,191,192,80,82,193,194],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]