### Install and Start Sliver Server

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/red-teaming/building-c2-infrastructure-with-sliver-framework/SKILL.md

Commands to install the Sliver framework and initiate the server daemon.

```bash
curl https://sliver.sh/install | sudo bash
```

```bash
systemctl start sliver
# Or run interactively
sliver-server
```

--------------------------------

### Initialize Pacu Session and Configure Credentials

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/cloud-security/performing-cloud-penetration-testing-with-pacu/SKILL.md

Install Pacu, start a session, and configure target credentials to begin the engagement.

```bash
# Install Pacu
pip install pacu

# Start Pacu
pacu

# Create a new session for the engagement
Pacu > set_keys --key-alias pentest-target
# Enter Access Key ID: AKIA...
# Enter Secret Access Key: ...

# Verify identity
Pacu > whoami

# Review available modules
Pacu > list
Pacu > search iam
Pacu > search ec2
Pacu > search s3
```

--------------------------------

### Execute Development Tasks

Source: https://github.com/xalgord/xalgorix/blob/main/README.md

Common commands for installing dependencies, building the project, running tests, and starting the development server.

```bash
make webui-install
```

```bash
make build
```

```bash
go test ./...
```

```bash
go run ./cmd/xalgorix --web
```

```bash
make webui-dev
```

--------------------------------

### Install GVM on Kali Linux or Debian

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/vulnerability-management/performing-authenticated-scan-with-openvas/SKILL.md

Commands to install, initialize, and start the GVM service stack.

```bash
# Install GVM package
sudo apt update && sudo apt install -y gvm

# Run initial setup (creates admin account, syncs feeds)
sudo gvm-setup

# Check installation status
sudo gvm-check-setup

# Start all GVM services
sudo gvm-start

# Access Greenbone Security Assistant at https://127.0.0.1:9392
```

--------------------------------

### Install and Activate Pre-commit

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/application-security/implementing-devsecops-security-scanning/SKILL.md

Commands to install the pre-commit framework and initialize it in the local repository.

```bash
pip install pre-commit
pre-commit install
pre-commit run --all-files  # Test against existing codebase
```

--------------------------------

### Install Cosign via CLI

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/supply-chain-security/implementing-sigstore-for-software-signing/SKILL.md

Commands to install the Cosign binary on Linux systems.

```bash
curl -LO https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 && chmod +x cosign-linux-amd64 && sudo mv cosign-linux-amd64 /usr/local/bin/cosign
```

--------------------------------

### Install gau

Source: https://github.com/xalgord/xalgorix/blob/main/tools.md

Installs the gau tool to get all URLs.

```bash
go install github.com/lc/gau/v2/cmd/gau@latest
```

--------------------------------

### Prepare Destination and Document Source

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md

Setup the case directory structure and record hardware metadata and initial source hashes.

```bash
# Create case directory structure
mkdir -p /cases/case-2024-001/{images,hashes,logs,notes}

# Document source drive information
hdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt

# Record the serial number and model
smartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt

# Pre-hash the source device
sha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt
```

--------------------------------

### RESTler Installation and Setup

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/api-security/performing-api-fuzzing-with-restler/SKILL.md

Commands to clone, build, and verify the RESTler fuzzer installation.

```bash
# Clone and build RESTler
git clone https://github.com/microsoft/restler-fuzzer.git
cd restler-fuzzer

# Build RESTler
python3 ./build-restler.py --dest_dir /opt/restler

# Verify installation
/opt/restler/restler/Restler --help

# Alternative: Use pre-built release
# Download from https://github.com/microsoft/restler-fuzzer/releases
```

--------------------------------

### Run Web UI

Source: https://github.com/xalgord/xalgorix/blob/main/README.md

Start the web interface on the default or a custom port.

```bash
xalgorix --web
```

```text
http://127.0.0.1:9137
```

```bash
xalgorix --web --port 8080
```

--------------------------------

### Run Xalgorix Setup Wizard

Source: https://github.com/xalgord/xalgorix/blob/main/README.md

Configures the provider, model, and API key for the Xalgorix agent.

```bash
xalgorix --setup
```

--------------------------------

### Install Wazuh Agent on Windows

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/endpoint-security/configuring-host-based-intrusion-detection/SKILL.md

Downloads and installs the Wazuh agent MSI package, registers it with the manager, and starts the service.

```powershell
# Download and install Wazuh agent
Invoke-WebRequest -Uri "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi" `
  -OutFile "wazuh-agent.msi"
msiexec /i wazuh-agent.msi /q WAZUH_MANAGER="wazuh-manager.corp.com" `
  WAZUH_REGISTRATION_SERVER="wazuh-manager.corp.com" WAZUH_AGENT_GROUP="windows-workstations"
net start WazuhSvc
```

--------------------------------

### Install and Configure Velociraptor Server

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/incident-response/implementing-velociraptor-for-ir-collection/SKILL.md

Commands to download the binary, generate the configuration file, and start the server or install it as a systemd service.

```bash
# Download latest release
wget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-linux-amd64

# Generate server configuration
./velociraptor-linux-amd64 config generate -i

# Start the server
./velociraptor-linux-amd64 --config server.config.yaml frontend

# Or run as systemd service
sudo cp velociraptor-linux-amd64 /usr/local/bin/velociraptor
sudo velociraptor --config /etc/velociraptor/server.config.yaml service install
```

--------------------------------

### ANY.RUN Task Configuration Parameters

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/malware-analysis/performing-dynamic-analysis-with-any-run/SKILL.md

Configuration settings for setting up a sandbox environment, including OS selection, network connectivity, and privacy options.

```text
ANY.RUN Task Configuration:
━━━━━━━━━━━━━━━━━━━━━━━━━━
OS Selection:        Windows 10 x64 (recommended default)
                     Windows 7 x64 (for legacy malware)
                     Windows 11 x64 (for modern samples)
Execution Time:      60 seconds (default) / 120-300 for slow-acting malware
Network:             Connected (captures real C2 traffic)
                     Residential Proxy (bypasses geo-blocking)
Privacy:             Public (free tier) / Private (paid - not indexed)
MITM Proxy:          Enable for HTTPS traffic decryption
Fake Net:            Enable to simulate internet services if sample checks connectivity
```

--------------------------------

### Detect SQLi in URI

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/security-operations/analyzing-web-server-logs-for-intrusion/SKILL.md

Example of a malicious SQL injection payload embedded within a GET request URI.

```text
192.168.1.100 - - [15/Jan/2024:10:30:45 +0000] "GET /products?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 4532
```

--------------------------------

### Install Volatility 3 and Prepare Environment

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/performing-memory-forensics-with-volatility3/SKILL.md

Commands to install the framework, download necessary symbol tables, and acquire memory dumps.

```bash
# Install Volatility 3
pip install volatility3

# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .

# Download Windows symbol tables (ISF packs)
# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/

# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip

# Memory acquisition tools (for live systems):
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (Linux Memory Extractor)
sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"

# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw
```

--------------------------------

### Initialize Brand Monitor

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/threat-intelligence/performing-brand-monitoring-for-impersonation/SKILL.md

Example instantiation and execution of the brand monitoring workflow.

```python
monitor = BrandMonitor({
    "name": "MyCompany",
    "domains": ["mycompany.com", "mycompany.org"],
    "keywords": ["mycompany", "mybrand", "myproduct"],
    "executives": ["CEO Name", "CTO Name"],
})
monitor.scan_domain_squatting()
report = monitor.generate_monitoring_report()
```

--------------------------------

### Install and Initialize Boundary

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/zero-trust-architecture/implementing-zero-trust-with-hashicorp-boundary/SKILL.md

Commands to install the Boundary binary on Debian-based systems and initialize the database.

```bash
# Install Boundary
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
sudo apt-get update && sudo apt-get install boundary

# Initialize the database
boundary database init \
  -config=/etc/boundary/controller.hcl

# Start the controller
boundary server -config=/etc/boundary/controller.hcl
```

--------------------------------

### HTTP Request for IDOR Vulnerability

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/penetration-testing/performing-web-application-penetration-test/SKILL.md

Example of an HTTP GET request used to exploit an Insecure Direct Object Reference by incrementing the order ID.

```http
GET /api/v1/orders/10452 HTTP/1.1
Host: staging.example.com
Authorization: Bearer eyJhbGc....[User A's token]
```

--------------------------------

### Install and Verify Zeek

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/network-security/performing-network-traffic-analysis-with-zeek/SKILL.md

Commands to install Zeek on Ubuntu and verify the installation version.

```bash
# Install Zeek on Ubuntu
sudo apt-get install -y zeek

# Or install from Zeek repository
echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | \
    sudo tee /etc/apt/sources.list.d/zeek.list
sudo apt-get update && sudo apt-get install -y zeek-lts

# Verify installation
zeek --version
```

--------------------------------

### Start Havoc Teamserver

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/red-teaming/building-red-team-c2-infrastructure-with-havoc/SKILL.md

Execute the teamserver binary pointing to the configuration profile.

```bash
# Start the Havoc Teamserver with the profile
./havoc server --profile ./profiles/havoc.yaotl -v

# Expected output:
# [*] Havoc Framework [Version: 0.7]
# [*] Teamserver started on: 0.0.0.0:40056
# [*] HTTPS Listener started on: 0.0.0.0:443
```

--------------------------------

### Install Suricata on Ubuntu

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/network-security/implementing-network-intrusion-prevention-with-suricata/SKILL.md

Commands to add the official repository, install the package, and verify the installation.

```bash
# Add Suricata PPA (Ubuntu)
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install -y suricata suricata-update

# Verify installation
suricata --build-info
suricata -V
```

--------------------------------

### Create local environment file

Source: https://github.com/xalgord/xalgorix/blob/main/README.md

Command to initialize the user-specific configuration file.

```bash
nano ~/.xalgorix.env
```

--------------------------------

### Install Grype CLI

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/container-security/scanning-container-images-with-grype/SKILL.md

Commands to install Grype via script or Homebrew and verify the installation.

```bash
# Install via script
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
grype version

# Install via Homebrew (macOS/Linux)
brew install grype
```

--------------------------------

### Install and Deploy kube-bench

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/container-security/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md

Install the binary locally or deploy kube-bench as a Kubernetes Job or Pod to perform cluster-wide security scans.

```bash
# Binary installation
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.7.3/kube-bench_0.7.3_linux_amd64.tar.gz | tar xz
sudo mv kube-bench /usr/local/bin/

# Run as Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

# Run as a pod with host access
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-master.yaml
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-node.yaml
```

--------------------------------

### Install YARA and Python Bindings

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/threat-hunting/performing-threat-hunting-with-yara-rules/SKILL.md

Commands to install YARA on Linux, the Python bindings, and verify the installation.

```bash
# Linux
sudo apt update && sudo apt install -y yara

# Python bindings
pip install yara-python

# Verify installation
yara --version
python3 -c "import yara; print(yara.YARA_VERSION)"
```

--------------------------------

### Manual UPX Unpacking Procedure in x64dbg

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/malware-analysis/analyzing-packed-malware-with-upx-unpacker/SKILL.md

A step-by-step guide for identifying the OEP and dumping the unpacked binary using x64dbg.

```text
Manual UPX Unpacking with x64dbg:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Load packed sample in x64dbg
2. Run to the entry point (system breakpoint then F9)
3. UPX unpacking stub pattern:
   a. PUSHAD (saves all registers)
   b. Decompression loop (processes packed sections)
   c. Resolves imports (LoadLibrary/GetProcAddress calls)
   d. POPAD (restores registers)
   e. JMP to OEP (original entry point)
4. Set hardware breakpoint on ESP after PUSHAD:
   - After PUSHAD, right-click ESP in registers -> Follow in Dump
   - Set hardware breakpoint on access at [ESP] address
   - Run (F9) - breaks at POPAD before JMP to OEP
5. Step forward (F7/F8) until you reach the JMP to OEP
6. At OEP: Use Scylla plugin to dump and fix imports:
   - Plugins -> Scylla -> OEP = current EIP
   - Click "IAT Autosearch" -> "Get Imports"
   - Click "Dump" to save unpacked binary
   - Click "Fix Dump" to repair import table
```

--------------------------------

### Semgrep Installation and Verification

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/devsecops/implementing-semgrep-for-custom-sast-rules/SKILL.md

Commands to install Semgrep via package managers or Docker and verify the installation.

```bash
# Install via pip
pip install semgrep

# Install via Homebrew
brew install semgrep

# Run via Docker
docker run -v "${PWD}:/src" returntocorp/semgrep semgrep --config auto /src

# Verify
semgrep --version
```

--------------------------------

### Setup Environment and Attach Frida

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/mobile-security/performing-ios-app-security-assessment/SKILL.md

Commands to verify Frida connectivity, spawn applications, patch non-jailbroken apps, and attach the Objection runtime explorer.

```bash
# For jailbroken device: verify Frida server is running
frida-ps -U

# Spawn target app with Frida
frida -U -f com.target.app --no-pause

# For non-jailbroken device: patch IPA with Frida Gadget
objection patchipa --source target.ipa --codesign-signature "Apple Development: tester@example.com"

# Install patched IPA
ideviceinstaller -i target-patched.ipa

# Attach Objection to running app
objection --gadget "com.target.app" explore
```

--------------------------------

### Install and Verify Cartography

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/cloud-security/performing-cloud-asset-inventory-with-cartography/SKILL.md

Install the package via pip and verify the installation using the help command.

```bash
# Install Cartography
pip install cartography

# Verify installation
cartography --help
```

--------------------------------

### Install and Verify TruffleHog

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/cloud-security/detecting-aws-credential-exposure-with-trufflehog/SKILL.md

Commands to install TruffleHog via pip or binary and verify the installation against a test repository.

```bash
# Install TruffleHog v3
pip install trufflehog

# Or install from binary release
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
trufflehog --version

# Test with a known test repository
trufflehog git https://github.com/trufflesecurity/test_keys --only-verified
```

--------------------------------

### Prepare Device and Install Forensic Tools

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/performing-mobile-device-forensics-with-cellebrite/SKILL.md

Commands to install necessary open-source forensic parsers and utilities on a workstation.

```bash
pip install aleapp    # Android Logs Events And Protobuf Parser
pip install ileapp    # iOS Logs Events And Properties Parser
sudo apt-get install libimobiledevice-utils  # iOS acquisition on Linux
```

--------------------------------

### Install PhotoRec and Prepare Environment

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/recovering-deleted-files-with-photorec/SKILL.md

Commands to install the TestDisk suite and set up the directory structure for forensic recovery.

```bash
# Install TestDisk (includes PhotoRec) on Debian/Ubuntu
sudo apt-get install testdisk

# On RHEL/CentOS
sudo yum install testdisk

# On macOS
brew install testdisk

# Verify installation
photorec --version

# Create output directory structure
mkdir -p /cases/case-2024-001/recovered/{all,documents,images,databases}

# Verify the forensic image
file /cases/case-2024-001/images/evidence.dd
ls -lh /cases/case-2024-001/images/evidence.dd
```

--------------------------------

### Install and Prepare Plaso Environment

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/performing-timeline-reconstruction-with-plaso/SKILL.md

Commands to install Plaso via package managers, pip, or Docker, and verify the installation.

```bash
# Install Plaso on Ubuntu/Debian
sudo add-apt-repository ppa:gift/stable
sudo apt-get update
sudo apt-get install plaso-tools

# Or install via pip
pip install plaso

# Or use Docker (recommended for dependency isolation)
docker pull log2timeline/plaso

# Verify installation
log2timeline.py --version
psort.py --version

# Create output directory
mkdir -p /cases/case-2024-001/timeline/

# Verify the forensic image
img_stat /cases/case-2024-001/images/evidence.dd
```

--------------------------------

### Initialize Rekall Session and Run Basic Analysis

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/security-operations/extracting-memory-artifacts-with-rekall/SKILL.md

Demonstrates how to create a Rekall session with automatic profile detection and execute basic process listing and malware detection plugins.

```python
from rekall import session
from rekall import plugins

# Create a Rekall session with a memory image
s = session.Session(
    filename="/path/to/memory.raw",
    autodetect=["rsds"],
    profile_path=["https://github.com/google/rekall-profiles/raw/master"]
)

# List processes
for proc in s.plugins.pslist():
    print(proc)

# Detect injected code
for result in s.plugins.malfind():
    print(result)
```

--------------------------------

### Install and Configure Foremost

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/digital-forensics/performing-file-carving-with-foremost/SKILL.md

Commands to install Foremost, verify the installation, and create a custom configuration file with additional file signatures.

```bash
# Install Foremost
sudo apt-get install foremost

# Verify installation
foremost -V

# Review default configuration
cat /etc/foremost.conf

# The default foremost.conf supports:
# jpg, gif, png, bmp - Image formats
# avi, exe, mpg, wav - Media and executables
# riff, wmv, mov, pdf - Documents and video
# ole (doc/xls/ppt), zip, rar - Office and archives
# htm, cpp, java - Text/code files

# Create custom configuration for additional file types
cp /etc/foremost.conf /cases/case-2024-001/custom_foremost.conf

# Add custom file signatures
cat << 'EOF' >> /cases/case-2024-001/custom_foremost.conf
# Custom additions for investigation
# Format: extension  case_sensitive  max_size  header  footer
    docx    y    10000000    \x50\x4b\x03\x04    \x50\x4b\x05\x06
    xlsx    y    10000000    \x50\x4b\x03\x04    \x50\x4b\x05\x06
    pptx    y    10000000    \x50\x4b\x03\x04    \x50\x4b\x05\x06
    sqlite  y    50000000    \x53\x51\x4c\x69\x74\x65\x20\x66\x6f\x72\x6d\x61\x74
    pst     y    500000000   \x21\x42\x44\x4e
    eml     y    1000000     \x46\x72\x6f\x6d\x3a    \x0d\x0a\x0d\x0a
    evtx    y    50000000    \x45\x6c\x66\x46\x69\x6c\x65
EOF
```

--------------------------------

### Install Xalgorix via Shell Script

Source: https://github.com/xalgord/xalgorix/blob/main/README.md

Downloads the prebuilt binary for Linux amd64/arm64 systems.

```bash
curl -sSL https://www.xalgorix.com/install | bash
```

--------------------------------

### Install shuffledns

Source: https://github.com/xalgord/xalgorix/blob/main/tools.md

Installs the shuffledns tool for DNS bruteforce.

```bash
go install github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest
```

--------------------------------

### Initialize Metasploit Environment

Source: https://github.com/xalgord/xalgorix/blob/main/internal/tools/skills/data/vulnerability-management/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md

Commands to start the database service, launch the console, and import scan data.

```bash
# Start PostgreSQL and initialize database
sudo systemctl start postgresql
sudo msfdb init

# Launch msfconsole
msfconsole -q

# Verify database connection
msf6> db_status
msf6> workspace -a vuln_validation_2025

# Import vulnerability scan results
msf6> db_import /path/to/nessus_scan.nessus
msf6> hosts
msf6> vulns
```

--------------------------------

### Install paramspider

Source: https://github.com/xalgord/xalgorix/blob/main/tools.md

Installs the paramspider tool for parameter discovery.

```bash
pipx install paramspider
```

--------------------------------

### Install hakrawler

Source: https://github.com/xalgord/xalgorix/blob/main/tools.md

Installs the hakrawler tool for web crawling.

```bash
go install github.com/hakluke/hakrawler@latest
```