kiro-cybersecurity-skills - Expert methodology for offensive and defensive sec

项目说明

CyberSecurity Skills

A collection of 15 security workflows co the full offensi spectrum.
Each domain has a dedicated steering file with methodology, ready-to-run commands, output
templates, and detection/hardening references. Adapted for Kiro from the
Claude-Code-CyberSecurity-Skill
project (MIT License).

> Authorization & ethics: These workflows are for authorized security testing, research,
> CTF, and education only. The offensi (03-exploit-de, 14-red-team-ops)
> contain explicit authorization gates — confirm written scope/permission before assisting.
> Decline and explain when authorization is absent. The user is responsible for legal compliance.

Onboarding

Step 1: Optional tooling

The workflows are usable as pure guidance. For the bundled Python automation helpers in
scripts/<domain>/, ensure Python 3.10+ is a:

with: python -- (or python3 --)

Each domain lists its own pip install ... prerequisites at the top of its steering file.

Step 2: Optional external tools

Some workflows are enhanced by external tools (install only what you need):

nmap, amass, theHar (recon/network)

Ghidra / IDA Free, capstone, pwntools (reverse engineering / exploit dev)

YARA, 3 (malware / forensics)

tshark / Wireshark, Suricata / Snort (network)

Trivy, Checkov / tfsec (cloud / IaC)

sigma-cli (detection rule con)

When to Load Steering Files

Load the steering file that matches the user's task:

Reconnaissance, OSINT, subdomain enumeration, DNS analysis, tech fingerprinting → 01-recon-osint.md

Dependency/C, config review, C, reports → 02-.md

PoC de, payload crafting, shellcode, exploitation research (authorized) → 03-exploit-de.md

Binary analysis, assembly interpretation, disassembly, firmware/protocol RE, CTF → 04-re.md

Static/dynamic malware analysis, YARA rules, sandboxing, IOC extraction → 05-malware-analysis.md

IOC correlation, MITRE ATT&CK mapping, hunt hypotheses, Sigma/SIEM hunting → 06-threat-hunting.md

Incident response playbooks, e collection, forensic timelines, memory forensics → 07-incident-response.md

PCAP analysis, IDS/IPS (Suricata/Snort) rules, firewall auditing, beaconing detection → 08-network-security.md

OWASP Top 10, injection/XSS/SSRF testing, API & JWT security, security headers → 09-web-security.md

AWS/Azure/GCP auditing, Docker/Kubernetes hardening, IaC scanning, cloud compliance → 10-cloud-security.md

SOC alert triage, playbook automation, escalation workflows, shift reports, KPIs → 11-csoc-automation.md

Log parsing, anomaly detection, SIEM queries (Splunk/KQL/EQL), Sigma, correlation → 12-log-analysis.md

TLS/SSL auditing, cipher/hash analysis, crypto code review, PQC guidance → 13-crypto-analysis.md

Red team engagement planning, C2 design, lateral mo, OPSEC, reporting (authorized) → 14-red-team-ops.md

System hardening (Linux/Windows), detection engineering, baselines, patch mgmt, CIS → 15-blue-team-defense.md

Notes

Bundled automation scripts li scripts/<domain>/scripts/ and example walkthroughs under

scripts/<domain>/examples/. Run them only against systems you are authorized to test.

Steering files cross-reference each other by domain number (e.g., "→ Skill 09") to chain

workflows (recon → vuln scan → web testing → reporting).

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Expert methodology for offensive and defensive security: recon/OSINT, vulnerability assessment, exploit dev, reverse engineering, malware analysis, threat hunting, incident response, network/web/cloud security, SOC automation, log/SIEM analysis, cryptography, red team, and blue team hardening.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。