[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GY6DB9B7028M0SH2FK0FT":3,"skill-same:01M71GY6DB9B7028M0SH2FK0FT":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":6,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M71GY6DB9B7028M0SH2FK0FT","pentest-burpsuite-analyze",null,"Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fpentest\u002Fburpsuite\u002Fanalyze\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"pentest","burpsuite","pentest burpsuite analyze","analyze","api security testing","read","burp-suite","de","communication","server","communications","api","analysis","Bash","when","cybersecurity","traffic","testing","authentication","cm","2026-11-10 10:12:30",false,"---\nname: pentest-burpsuite-analyze\ndescription: Intercepts and analyzes HTTP\u002FHTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.\ndomain: cybersecurity\nsubdomain: mobile-security\ntags:\n- mobile-security\n- android\n- ios\n- burp-suite\n- traffic-interception\n- penetration-testing\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1404\ncapec: []\n---\n\n# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n","# Intercepting Mobile Traffic with Burp Suite\n\n## When to Use\n\nUse this skill when:\n- Testing mobile application API endpoints for authentication, authorization, and injection vulnerabilities\n- Analyzing data transmitted between mobile apps and backend servers during penetration tests\n- Evaluating certificate pinning implementations and their bypass difficulty\n- Identifying sensitive data leakage in mobile network traffic\n\n**Do not use** this skill to intercept traffic from applications you are not authorized to test -- traffic interception without authorization violates computer fraud laws.\n\n## Prerequisites\n\n- Burp Suite Professional or Community Edition installed on testing workstation\n- Android device\u002Femulator or iOS device on the same network as Burp Suite host\n- Burp Suite CA certificate installed on the target device\n- For Android 7+: Network security config modification or Magisk module for system CA trust\n- For SSL pinning bypass: Frida + Objection or custom Frida scripts\n- Wi-Fi network where proxy configuration is possible\n\n## Workflow\n\n### Step 1: Configure Burp Suite Proxy Listener\n\n```\nBurp Suite > Proxy > Options > Proxy Listeners:\n- Bind to address: All interfaces (or specific IP)\n- Bind to port: 8080\n- Enable \"Support invisible proxying\"\n```\n\nVerify the listener is active and note the workstation's IP address on the shared network.\n\n### Step 2: Configure Mobile Device Proxy\n\n**Android:**\n```\nSettings > Wi-Fi > [Network] > Advanced > Manual Proxy\n- Host: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n**iOS:**\n```\nSettings > Wi-Fi > [Network] > Configure Proxy > Manual\n- Server: \u003Cburp_workstation_ip>\n- Port: 8080\n```\n\n### Step 3: Install Burp Suite CA Certificate\n\n**Android (below API 24):**\n```bash\n# Export Burp CA from Proxy > Options > Import\u002FExport CA Certificate\n# Transfer to device and install via Settings > Security > Install from storage\n```\n\n**Android (API 24+ \u002F Android 7+):**\nApps targeting API 24+ do not trust user-installed CAs by default. Options:\n```bash\n# Option A: Modify app's network_security_config.xml (requires APK rebuild)\n# Add to res\u002Fxml\u002Fnetwork_security_config.xml:\n# \u003Cnetwork-security-config>\n#   \u003Cdebug-overrides>\n#     \u003Ctrust-anchors>\n#       \u003Ccertificates src=\"user\" \u002F>\n#     \u003C\u002Ftrust-anchors>\n#   \u003C\u002Fdebug-overrides>\n# \u003C\u002Fnetwork-security-config>\n\n# Option B: Install as system CA (rooted device)\nopenssl x509 -inform DER -in burp-ca.der -out burp-ca.pem\nHASH=$(openssl x509 -inform PEM -subject_hash_old -in burp-ca.pem | head -1)\ncp burp-ca.pem \"$HASH.0\"\nadb push \"$HASH.0\" \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F\nadb shell chmod 644 \u002Fsystem\u002Fetc\u002Fsecurity\u002Fcacerts\u002F$HASH.0\n\n# Option C: Magisk module (MagiskTrustUserCerts)\n```\n\n**iOS:**\n```\n1. Navigate to http:\u002F\u002F\u003Cburp_ip>:8080 in Safari\n2. Download Burp CA certificate\n3. Settings > General > VPN & Device Management > Install profile\n4. Settings > General > About > Certificate Trust Settings > Enable full trust\n```\n\n### Step 4: Intercept and Analyze Traffic\n\nWith proxy configured, open the target app and navigate through its functionality:\n\n**Burp Suite > Proxy > HTTP History**: Review all captured requests and responses.\n\nKey areas to analyze:\n- **Authentication tokens**: JWT structure, token expiration, refresh mechanisms\n- **API endpoints**: RESTful paths, GraphQL queries, parameter patterns\n- **Sensitive data in transit**: PII, credentials, financial data\n- **Response headers**: Security headers (HSTS, CSP, X-Frame-Options)\n- **Error responses**: Stack traces, debug information, internal paths\n\n### Step 5: Test API Vulnerabilities Using Burp Repeater\n\nForward intercepted requests to Repeater for manual testing:\n\n```\nRight-click request > Send to Repeater\n\nTest categories:\n- Authentication bypass: Remove\u002Fmodify auth tokens\n- IDOR: Modify user IDs, object references\n- Injection: SQL injection, NoSQL injection in parameters\n- Rate limiting: Rapid request replay for brute force assessment\n- Business logic: Modify prices, quantities, permissions in requests\n```\n\n### Step 6: Automate Testing with Burp Scanner\n\n```\nRight-click request > Do active scan (Professional only)\n\nScanner checks:\n- SQL injection (error-based, blind, time-based)\n- XSS (reflected, stored)\n- Command injection\n- Path traversal\n- XML\u002FJSON injection\n- Authentication flaws\n```\n\n### Step 7: Handle Certificate Pinning\n\nIf traffic is not visible due to certificate pinning:\n\n```bash\n# Frida-based bypass (generic)\nfrida -U -f com.target.app -l ssl-pinning-bypass.js\n\n# Objection bypass\nobjection --gadget com.target.app explore\nios sslpinning disable  # or\nandroid sslpinning disable\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MITM Proxy** | Man-in-the-middle proxy that terminates and re-establishes TLS connections to inspect encrypted traffic |\n| **Certificate Pinning** | Client-side validation that restricts accepted server certificates beyond the OS trust store |\n| **Network Security Config** | Android XML configuration controlling app trust anchors, cleartext traffic policy, and certificate pinning |\n| **Invisible Proxying** | Burp feature handling non-proxy-aware clients that don't send CONNECT requests |\n| **IDOR** | Insecure Direct Object Reference -- accessing resources by manipulating identifiers without authorization checks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Full-featured web application security testing proxy with active scanner\n- **Burp Suite Community**: Free version with manual interception and basic tools\n- **Frida**: Dynamic instrumentation for runtime SSL pinning bypass\n- **mitmproxy**: Open-source alternative to Burp Suite for programmatic traffic analysis\n- **Charles Proxy**: Alternative HTTP proxy with mobile-friendly certificate installation\n\n## Common Pitfalls\n\n- **Android 7+ CA trust**: User-installed certificates are not trusted by apps targeting API 24+. Must use system CA installation or app modification.\n- **Certificate transparency**: Some apps use Certificate Transparency logs to detect MITM. Check for CT enforcement in the app.\n- **Non-HTTP protocols**: Burp Suite only handles HTTP\u002FHTTPS. Use Wireshark for WebSocket, MQTT, gRPC, or custom binary protocols.\n- **VPN-based apps**: Apps using VPN tunnels bypass device proxy settings. May need iptables rules on a rooted device to redirect traffic.\n",{"name":5,"tags":52,"capec":58,"model":59,"tools":60,"domain":42,"maxTurns":64,"nist_csf":65,"subdomain":53,"description":7,"mitre_attack":70},[53,54,55,33,56,57],"mobile-security","android","ios","traffic-interception","penetration-testing",[],"sonnet",[61,40,62,63],"Read","Glob","Grep",20,[66,67,68,69],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09",[71],"T1404","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fpentest\u002Fburpsuite\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill pentest-burpsuite-analyze",{"tool":85,"command":86},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill pentest-burpsuite-analyze",{"tool":88,"command":89},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill pentest-burpsuite-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fpentest\u002Fburpsuite\u002Fanalyze\u002FSKILL.md",true,[93],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"index.json","REFERENCE","参考文档",706,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fpentest\u002Fburpsuite\u002Fanalyze\u002Findex.json",[100,123,142,162,184,199],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":47},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[107,108,109,110,111,34,46,112,113,114,115,116,117,118,119,120,121,42,122],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":47},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[130,107,131,110,132,133,43,42,40,39,134,135,136,137,34,138,139,32,140,141],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":47},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,42,40,155,39,30,156,34,32,157,158,159,160,161,59],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":47},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[108,169,170,171,172,173,174,46,175,42,122,176,177,178,179,180,181,182,183,34],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":47},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,108,193,171,173,194,46,195,175,42,122,39,38,196,197,198,183,34,112],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":47},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[206,108,171,207,194,46,208,209,42,122,210,211,212,213,214,215,34,112,216,217],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]