[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GY0JT4YDNHT44JG2AG58F":3,"skill-same:01M71GY0JT4YDNHT44JG2AG58F":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71GY0JT4YDNHT44JG2AG58F","owasp-broken-detect",null,"Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fowasp\u002Fbroken\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"owasp","owasp broken detect","detect","broken","supply-chain","security","exploit","read","de","subdomain","references","Bash","cybersecurity","domains","t1195","takeover","cm","chain","discover","resources","2026-11-10 10:12:30",false,"---\nname: owasp-broken-detect\ndescription: Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- broken-link-hijacking\n- blh\n- subdomain-takeover\n- dead-link\n- expired-domain\n- supply-chain\n- external-resource\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1195\n- T1595.002\ncwe:\n- CWE-284\ncapec: []\n---\n\n# Exploiting Broken Link Hijacking\n\n## When to Use\n- When auditing web applications for references to expired or unclaimed external resources\n- During supply chain security assessments of third-party script and resource dependencies\n- When testing for subdomain takeover opportunities via dangling CNAME records\n- During bug bounty hunting for broken link hijacking vulnerabilities\n- When assessing the security of external resource dependencies in production applications\n\n## Prerequisites\n- Web crawler or spider for discovering all external links (Burp Suite Spider, Scrapy)\n- DNS lookup tools for checking CNAME records and domain availability\n- Domain registrar access for claiming expired domains (as proof of concept)\n- Understanding of CDN and cloud service provisioning (S3, Azure Blob, GitHub Pages)\n- blc (broken-link-checker) or similar tool for automated link validation\n- Knowledge of services vulnerable to subdomain takeover (can-i-take-over-xyz)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Crawl and Extract All External References\n```bash\n# Use broken-link-checker to find dead links\nnpx broken-link-checker http:\u002F\u002Ftarget.com --recursive --ordered \\\n  --exclude-internal --filter-level 3 -o broken_links.txt\n\n# Extract all external links from page source\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'https?:\u002F\u002F[^\"'\"'\"'\\s>]+' | sort -u > all_links.txt\n\n# Extract JavaScript sources\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'src=\"[^\"]*\"' | grep -v target.com > external_scripts.txt\n\n# Extract CSS references\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'href=\"[^\"]*\\.css\"' | grep -v target.com > external_css.txt\n\n# Use wayback machine for historical external references\ncurl -s \"https:\u002F\u002Fweb.archive.org\u002Fweb\u002Ftimemap\u002Flink\u002Fhttp:\u002F\u002Ftarget.com\" | \\\n  grep -oP 'https?:\u002F\u002F[^>]+' | sort -u > historical_links.txt\n\n# Spider with Burp Suite\n# Configure Spider scope to include target.com\n# Review Site Map > Filter by \"External\" to list all external references\n```\n\n### Step 2 — Identify Dead or Claimable Resources\n```bash\n# Check if external domains are registered\nfor domain in $(cat external_domains.txt); do\n  whois $domain 2>\u002Fdev\u002Fnull | grep -qi \"no match\\|not found\\|available\" && \\\n    echo \"[CLAIMABLE] $domain\"\ndone\n\n# Check HTTP status of external links\nwhile read url; do\n  status=$(curl -o \u002Fdev\u002Fnull -s -w \"%{http_code}\" \"$url\" --max-time 5)\n  if [ \"$status\" = \"000\" ] || [ \"$status\" = \"404\" ]; then\n    echo \"[DEAD] $url (Status: $status)\"\n  fi\ndone \u003C all_links.txt\n\n# Check for dangling CNAME records\nfor sub in $(cat subdomains.txt); do\n  cname=$(dig +short CNAME $sub)\n  if [ -n \"$cname\" ]; then\n    resolved=$(dig +short $cname)\n    if [ -z \"$resolved\" ]; then\n      echo \"[DANGLING] $sub -> $cname (UNRESOLVED)\"\n    fi\n  fi\ndone\n\n# Check cloud resource availability\n# AWS S3 bucket\naws s3 ls s3:\u002F\u002Ftarget-assets 2>&1 | grep -q \"NoSuchBucket\" && echo \"[CLAIMABLE] S3: target-assets\"\n```\n\n### Step 3 — Check Service-Specific Takeover Possibilities\n```bash\n# Check GitHub Pages takeover\n# If CNAME points to \u003Cuser>.github.io and 404 is returned\ncurl -s https:\u002F\u002Fsubdomain.target.com | grep -q \"There isn't a GitHub Pages site here\"\n\n# Check AWS S3 takeover\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"NoSuchBucket\"\n\n# Check Azure Blob Storage\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"The specified container does not exist\"\n\n# Check Heroku\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"No such app\"\n\n# Check Shopify\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"Sorry, this shop is currently unavailable\"\n\n# Use subjack for automated takeover detection\nsubjack -w subdomains.txt -c fingerprints.json -t 100 -o takeover_candidates.txt\n\n# Use nuclei takeover plugins\nsubfinder -d target.com -silent | nuclei -t http\u002Ftakeovers\u002F -o takeovers.txt\n```\n\n### Step 4 — Verify External Script Hijacking\n```bash\n# Check if external JavaScript domains are available for registration\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'src=\"https?:\u002F\u002F([^\u002F\"]+)' | \\\n  cut -d'\u002F' -f3 | sort -u | while read domain; do\n    whois \"$domain\" 2>\u002Fdev\u002Fnull | grep -qi \"no match\\|available\" && \\\n      echo \"[HIJACKABLE SCRIPT] $domain loaded by target.com\"\n  done\n\n# Check npm\u002FCDN package references\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'unpkg\\.com\u002F[^@\u002F]+' | sort -u\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'cdn\\.jsdelivr\\.net\u002Fnpm\u002F[^@\u002F]+' | sort -u\n\n# Verify if referenced packages still exist\n# Check npm registry for deprecated or removed packages\n```\n\n### Step 5 — Exploit the Broken Link (Authorized Testing Only)\n```bash\n# For expired domain: Register the domain\n# For S3 bucket: Create bucket with same name in same region\naws s3 mb s3:\u002F\u002Ftarget-expired-bucket --region us-east-1\n\n# For GitHub Pages: Create repository with matching name\n# Create \u003Corg>.github.io repository with proof-of-concept content\n\n# For unclaimed social media: Claim the handle\n# Document the takeover with benign proof-of-concept content\n\n# Serve proof-of-concept content\necho \"\u003Chtml>\u003Cbody>\u003Ch1>Broken Link Hijacking PoC - [Your Name]\u003C\u002Fh1>\u003C\u002Fbody>\u003C\u002Fhtml>\" > index.html\n# Upload to claimed resource\n```\n\n### Step 6 — Assess Impact and Report\n```bash\n# Determine impact based on resource type:\n# - External JavaScript: Full XSS on all pages loading the script\n# - External CSS: UI defacement, data exfiltration via CSS injection\n# - External image\u002Fresource: Phishing, tracking\n# - CNAME subdomain: Cookie theft, phishing, OAuth bypass\n\n# Check if hijacked resource serves cookies for parent domain\n# Check if hijacked subdomain is in OAuth redirect whitelist\n# Verify if hijacked domain receives sensitive Referer headers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Broken Link Hijacking | Claiming control of external resources referenced by target website |\n| Dangling CNAME | DNS CNAME record pointing to unclaimed or decommissioned service |\n| Subdomain Takeover | Claiming a subdomain by provisioning the service its CNAME points to |\n| External Script Hijacking | Registering expired domains that serve JavaScript loaded by target |\n| Supply Chain Attack | Compromising external dependencies to inject malicious content |\n| Dead Link | URL reference returning 404 or DNS resolution failure |\n| Resource Fingerprinting | Identifying specific cloud services from error messages and headers |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| broken-link-checker | Automated broken link discovery via web crawling |\n| subjack | Subdomain takeover detection tool |\n| nuclei | Template-based takeover detection scanner |\n| can-i-take-over-xyz | Community database of services vulnerable to takeover |\n| BadDNS | DNS auditing tool for detecting domain\u002Fsubdomain takeovers |\n| Wayback Machine | Historical URL analysis for discovering past external references |\n\n## Common Scenarios\n\n1. **JavaScript Supply Chain** — Register expired domain that serves JavaScript loaded by target; inject malicious code affecting all visitors\n2. **S3 Bucket Takeover** — Claim deleted AWS S3 bucket referenced by target; serve malicious content or steal uploaded data\n3. **GitHub Pages Hijack** — Create GitHub Pages repository matching dangling CNAME to serve phishing pages on target subdomain\n4. **Social Media Impersonation** — Claim unclaimed social media handles linked from target website for brand impersonation\n5. **CDN Package Hijack** — Claim deprecated npm packages referenced via CDN URLs to inject malicious JavaScript\n\n## Output Format\n\n```\n## Broken Link Hijacking Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Total External Links**: 145\n- **Dead Links**: 12\n- **Hijackable Resources**: 3\n\n### Findings\n| # | Resource | Type | Status | Impact |\n|---|----------|------|--------|--------|\n| 1 | analytics.expired-domain.com | JavaScript | Domain available | Full XSS |\n| 2 | assets.target.com -> S3 bucket | Static assets | Bucket deleted | Content injection |\n| 3 | blog.target.com -> GitHub Pages | Subdomain | No GitHub repo | Subdomain takeover |\n\n### Remediation\n- Remove references to decommissioned external resources\n- Delete dangling CNAME records for unused subdomains\n- Implement Subresource Integrity (SRI) for external scripts\n- Regularly audit external dependencies for availability\n- Use Content Security Policy to restrict allowed script sources\n```\n","# Exploiting Broken Link Hijacking\n\n## When to Use\n- When auditing web applications for references to expired or unclaimed external resources\n- During supply chain security assessments of third-party script and resource dependencies\n- When testing for subdomain takeover opportunities via dangling CNAME records\n- During bug bounty hunting for broken link hijacking vulnerabilities\n- When assessing the security of external resource dependencies in production applications\n\n## Prerequisites\n- Web crawler or spider for discovering all external links (Burp Suite Spider, Scrapy)\n- DNS lookup tools for checking CNAME records and domain availability\n- Domain registrar access for claiming expired domains (as proof of concept)\n- Understanding of CDN and cloud service provisioning (S3, Azure Blob, GitHub Pages)\n- blc (broken-link-checker) or similar tool for automated link validation\n- Knowledge of services vulnerable to subdomain takeover (can-i-take-over-xyz)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Crawl and Extract All External References\n```bash\n# Use broken-link-checker to find dead links\nnpx broken-link-checker http:\u002F\u002Ftarget.com --recursive --ordered \\\n  --exclude-internal --filter-level 3 -o broken_links.txt\n\n# Extract all external links from page source\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'https?:\u002F\u002F[^\"'\"'\"'\\s>]+' | sort -u > all_links.txt\n\n# Extract JavaScript sources\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'src=\"[^\"]*\"' | grep -v target.com > external_scripts.txt\n\n# Extract CSS references\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'href=\"[^\"]*\\.css\"' | grep -v target.com > external_css.txt\n\n# Use wayback machine for historical external references\ncurl -s \"https:\u002F\u002Fweb.archive.org\u002Fweb\u002Ftimemap\u002Flink\u002Fhttp:\u002F\u002Ftarget.com\" | \\\n  grep -oP 'https?:\u002F\u002F[^>]+' | sort -u > historical_links.txt\n\n# Spider with Burp Suite\n# Configure Spider scope to include target.com\n# Review Site Map > Filter by \"External\" to list all external references\n```\n\n### Step 2 — Identify Dead or Claimable Resources\n```bash\n# Check if external domains are registered\nfor domain in $(cat external_domains.txt); do\n  whois $domain 2>\u002Fdev\u002Fnull | grep -qi \"no match\\|not found\\|available\" && \\\n    echo \"[CLAIMABLE] $domain\"\ndone\n\n# Check HTTP status of external links\nwhile read url; do\n  status=$(curl -o \u002Fdev\u002Fnull -s -w \"%{http_code}\" \"$url\" --max-time 5)\n  if [ \"$status\" = \"000\" ] || [ \"$status\" = \"404\" ]; then\n    echo \"[DEAD] $url (Status: $status)\"\n  fi\ndone \u003C all_links.txt\n\n# Check for dangling CNAME records\nfor sub in $(cat subdomains.txt); do\n  cname=$(dig +short CNAME $sub)\n  if [ -n \"$cname\" ]; then\n    resolved=$(dig +short $cname)\n    if [ -z \"$resolved\" ]; then\n      echo \"[DANGLING] $sub -> $cname (UNRESOLVED)\"\n    fi\n  fi\ndone\n\n# Check cloud resource availability\n# AWS S3 bucket\naws s3 ls s3:\u002F\u002Ftarget-assets 2>&1 | grep -q \"NoSuchBucket\" && echo \"[CLAIMABLE] S3: target-assets\"\n```\n\n### Step 3 — Check Service-Specific Takeover Possibilities\n```bash\n# Check GitHub Pages takeover\n# If CNAME points to \u003Cuser>.github.io and 404 is returned\ncurl -s https:\u002F\u002Fsubdomain.target.com | grep -q \"There isn't a GitHub Pages site here\"\n\n# Check AWS S3 takeover\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"NoSuchBucket\"\n\n# Check Azure Blob Storage\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"The specified container does not exist\"\n\n# Check Heroku\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"No such app\"\n\n# Check Shopify\ncurl -s http:\u002F\u002Fsubdomain.target.com | grep -q \"Sorry, this shop is currently unavailable\"\n\n# Use subjack for automated takeover detection\nsubjack -w subdomains.txt -c fingerprints.json -t 100 -o takeover_candidates.txt\n\n# Use nuclei takeover plugins\nsubfinder -d target.com -silent | nuclei -t http\u002Ftakeovers\u002F -o takeovers.txt\n```\n\n### Step 4 — Verify External Script Hijacking\n```bash\n# Check if external JavaScript domains are available for registration\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'src=\"https?:\u002F\u002F([^\u002F\"]+)' | \\\n  cut -d'\u002F' -f3 | sort -u | while read domain; do\n    whois \"$domain\" 2>\u002Fdev\u002Fnull | grep -qi \"no match\\|available\" && \\\n      echo \"[HIJACKABLE SCRIPT] $domain loaded by target.com\"\n  done\n\n# Check npm\u002FCDN package references\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'unpkg\\.com\u002F[^@\u002F]+' | sort -u\ncurl -s http:\u002F\u002Ftarget.com | grep -oP 'cdn\\.jsdelivr\\.net\u002Fnpm\u002F[^@\u002F]+' | sort -u\n\n# Verify if referenced packages still exist\n# Check npm registry for deprecated or removed packages\n```\n\n### Step 5 — Exploit the Broken Link (Authorized Testing Only)\n```bash\n# For expired domain: Register the domain\n# For S3 bucket: Create bucket with same name in same region\naws s3 mb s3:\u002F\u002Ftarget-expired-bucket --region us-east-1\n\n# For GitHub Pages: Create repository with matching name\n# Create \u003Corg>.github.io repository with proof-of-concept content\n\n# For unclaimed social media: Claim the handle\n# Document the takeover with benign proof-of-concept content\n\n# Serve proof-of-concept content\necho \"\u003Chtml>\u003Cbody>\u003Ch1>Broken Link Hijacking PoC - [Your Name]\u003C\u002Fh1>\u003C\u002Fbody>\u003C\u002Fhtml>\" > index.html\n# Upload to claimed resource\n```\n\n### Step 6 — Assess Impact and Report\n```bash\n# Determine impact based on resource type:\n# - External JavaScript: Full XSS on all pages loading the script\n# - External CSS: UI defacement, data exfiltration via CSS injection\n# - External image\u002Fresource: Phishing, tracking\n# - CNAME subdomain: Cookie theft, phishing, OAuth bypass\n\n# Check if hijacked resource serves cookies for parent domain\n# Check if hijacked subdomain is in OAuth redirect whitelist\n# Verify if hijacked domain receives sensitive Referer headers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Broken Link Hijacking | Claiming control of external resources referenced by target website |\n| Dangling CNAME | DNS CNAME record pointing to unclaimed or decommissioned service |\n| Subdomain Takeover | Claiming a subdomain by provisioning the service its CNAME points to |\n| External Script Hijacking | Registering expired domains that serve JavaScript loaded by target |\n| Supply Chain Attack | Compromising external dependencies to inject malicious content |\n| Dead Link | URL reference returning 404 or DNS resolution failure |\n| Resource Fingerprinting | Identifying specific cloud services from error messages and headers |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| broken-link-checker | Automated broken link discovery via web crawling |\n| subjack | Subdomain takeover detection tool |\n| nuclei | Template-based takeover detection scanner |\n| can-i-take-over-xyz | Community database of services vulnerable to takeover |\n| BadDNS | DNS auditing tool for detecting domain\u002Fsubdomain takeovers |\n| Wayback Machine | Historical URL analysis for discovering past external references |\n\n## Common Scenarios\n\n1. **JavaScript Supply Chain** — Register expired domain that serves JavaScript loaded by target; inject malicious code affecting all visitors\n2. **S3 Bucket Takeover** — Claim deleted AWS S3 bucket referenced by target; serve malicious content or steal uploaded data\n3. **GitHub Pages Hijack** — Create GitHub Pages repository matching dangling CNAME to serve phishing pages on target subdomain\n4. **Social Media Impersonation** — Claim unclaimed social media handles linked from target website for brand impersonation\n5. **CDN Package Hijack** — Claim deprecated npm packages referenced via CDN URLs to inject malicious JavaScript\n\n## Output Format\n\n```\n## Broken Link Hijacking Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Total External Links**: 145\n- **Dead Links**: 12\n- **Hijackable Resources**: 3\n\n### Findings\n| # | Resource | Type | Status | Impact |\n|---|----------|------|--------|--------|\n| 1 | analytics.expired-domain.com | JavaScript | Domain available | Full XSS |\n| 2 | assets.target.com -> S3 bucket | Static assets | Bucket deleted | Content injection |\n| 3 | blog.target.com -> GitHub Pages | Subdomain | No GitHub repo | Subdomain takeover |\n\n### Remediation\n- Remove references to decommissioned external resources\n- Delete dangling CNAME records for unused subdomains\n- Implement Subresource Integrity (SRI) for external scripts\n- Regularly audit external dependencies for availability\n- Use Content Security Policy to restrict allowed script sources\n```\n",{"cwe":44,"name":5,"tags":46,"capec":53,"model":54,"tools":55,"domain":31,"maxTurns":59,"nist_csf":60,"subdomain":65,"description":7,"mitre_attack":66},[45],"CWE-284",[47,48,49,50,51,23,52],"broken-link-hijacking","blh","subdomain-takeover","dead-link","expired-domain","external-resource",[],"sonnet",[56,30,57,58],"Read","Glob","Grep",20,[61,62,63,64],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[67,68,69],"T1059","T1195","T1595.002","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fowasp\u002Fbroken\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill owasp-broken-detect",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill owasp-broken-detect",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill owasp-broken-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fowasp\u002Fbroken\u002Fdetect\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",687,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fowasp\u002Fbroken\u002Fdetect\u002Findex.json",[98,120,140,161,183,199],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,21,106,107,108,27,35,109,110,111,112,113,114,115,116,117,118,31,119],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[25,105,127,107,128,129,130,31,30,131,132,133,134,135,27,136,137,26,138,139],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[147,148,149,150,151,152,31,30,153,131,154,155,27,26,156,157,158,159,160,54],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,168,169,170,171,172,173,35,174,31,119,175,176,177,178,179,180,181,182,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[190,191,21,192,170,172,193,35,194,174,31,119,131,195,196,197,198,182,27,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[206,21,170,207,193,35,208,209,31,119,210,211,212,213,214,215,27,109,216,217],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]