CSI

Enumerate subdomains, exposed endpoints, and technology stack of a target web application before deeper testing.

Perform passive and active reconnaissance on https://target.example.com.
Enumerate subdomains, identify the tech stack, map exposed endpoints,
and list any login panels or admin interfaces found. Summarize findings
as a prioritised attack surface report.

Test a target application for the most critical web vulnerabilities: injections, broken auth, misconfigurations, and more.

Run an OWASP Top 10 assessment against https://target.example.com.
Test for SQL injection, XSS, broken authentication, IDOR, and
security misconfigurations. For each finding report: severity (CVSS),
evidence, and a recommended remediation step.

Scan open ports on a target host, fingerprint services, check for known CVEs, and attempt safe proof-of-concept exploitation.

Scan 192.168.1.100 for open TCP ports. Fingerprint each service and
version. Cross-reference against known CVEs (CVSS >= 7.0). For the
top 3 vulnerabilities, provide a safe PoC exploitation plan and
the exact Metasploit module or command if available.

After initial access, identify privilege escalation paths on a Linux host using standard enumeration techniques.

I have a low-privilege shell on a Linux box (Ubuntu 22.04).
Enumerate all privilege escalation vectors: SUID binaries, writable
cron jobs, weak sudo rules, world-writable paths, and kernel exploits.
Rank each vector by exploitability and provide the exact command
to exploit the top finding.

Review iptables or nftables rules for overly permissive entries, redundant rules, or missing egress controls.

Audit the attached iptables ruleset for security issues.
Flag any rules that allow unrestricted inbound access, missing egress
filtering, permit traffic from 0.0.0.0/0 to sensitive ports, or
contradict a least-privilege model. Output a hardened ruleset diff.

Analyse a batch of SIEM alerts to identify true positives, suppress noise, and prioritise incidents for response.

Analyse the following 50 SIEM alerts from the past 24 hours [paste alerts].
Classify each as true positive, false positive, or needs investigation.
Group related alerts into incidents, assign a severity (Critical / High /
Medium / Low), and recommend the immediate containment action for each
true positive.

Given a scanner report, rank findings by exploitability and business impact to build a realistic patching roadmap.

Given the attached Nessus/OpenVAS scan report for our production
environment, prioritise all findings with CVSS >= 6.0. Factor in:
public exploit availability, internet exposure, and asset criticality.
Output a patching roadmap with estimated remediation effort per item.

Review and harden SSH daemon configuration against common attack vectors such as brute force and weak ciphers.

Review the attached /etc/ssh/sshd_config. Identify misconfigurations:
permitted root login, weak ciphers/MACs, password auth enabled,
missing idle timeouts, or absent AllowUsers restriction. Output
a hardened config with inline comments explaining each change.

Perform static and behavioural analysis on a suspicious binary and produce a structured IOC report.

Analyse the suspicious binary at /samples/unknown.exe (SHA-256: <hash>).
Perform static analysis: strings, imports, PE headers, entropy.
Identify IOCs: C2 addresses, registry keys, file drops, mutex names.
Classify the malware family if possible and output a MISP-compatible
IOC list in JSON format.

Correlate logs from multiple sources to build a chronological attack timeline from initial access to impact.

I have auth.log, syslog, and web access logs from a potentially
compromised server covering 2026-05-28 to 2026-06-01 [paste logs].
Reconstruct a chronological attack timeline: initial access vector,
lateral movement, persistence mechanisms, and data accessed.
Output as a Markdown table with timestamp, event, and MITRE ATT&CK TTP.

Investigate network flow data or proxy logs for signs of large-scale or stealthy data exfiltration.

Analyse the attached network flow logs (NetFlow/PCAP) for signs of
data exfiltration over the past 7 days. Look for: large outbound
transfers to unknown IPs, DNS tunnelling patterns, beaconing at
regular intervals, and connections to known C2 ranges. Estimate
the volume exfiltrated and identify the destination endpoints.

Investigate a potentially hijacked user account by correlating authentication and activity logs.

Investigate the account jdoe@example.com for signs of compromise.
Correlate Azure AD sign-in logs, MFA events, and mail access logs
from the past 30 days. Identify: impossible travel, new device
registrations, inbox rule creation, and abnormal send volume.
Provide a yes/no verdict on compromise and recommended remediation steps.