Individual skill

network-appliance-offensive

Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC, safe firmware/patch-level inference for FortiGate/PAN-OS/Cisco ASA/Citrix feeding CVE applicability, NTLM Type-2 target-info decode, handshake-completion TLS-version probing, and an RST-TTL forgery discriminator. The active/offensive counterpart to the static firewall-review skill. Use when a perimeter firewall/VPN/appliance is in scope and you must test it (not just audit a config), without reinventing raw-socket protocol tooling each engagement.

skills/network-appliance-offensive/SKILL.md

Read pinned source

Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 613
Repository last updated: Jul 29, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bounty-hunters Repository topic
hackerone Repository topic
pentest Repository topic
pentest-tool Repository topic
security Repository topic
security-research Repository topic
security-tools Repository topic
testing Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 5,824 bytes

Read excerpt


# Network-Appliance Offensive

`firewall-review` audits a *config* statically; `infrastructure` covers *generic* ports/DNS/SMB. Neither tests a live perimeter **appliance** or its **VPN crypto** — so IKE builders, SIC/OPSEC fingerprinting, and TTL discriminators were reinvented from raw sockets each engagement, often shallowly, and CVE applicability was left UNDETERMINED across whole estates. This skill provides the deterministic, tested tools and the precondition-gated methodology. **Non-destructive only** — every tool observes/decodes/infers; none fires an exploit, and CVE applicability is a *precondition check*, never a blind "vulnerable."

## Tools

| Tool | Does | Anti-footgun |
|------|------|--------------|
| [`tools/ike_enum.py`](../../tools/ike_enum.py) | IKEv1 aggressive-mode detection, IKEv1/IKEv2 transform + DH-group enum, NOTIFY / NAT-T decode (wraps `ike-scan`, raw ISAKMP SA_INIT builder fallback) | Aggressive-mode support (PSK-hash leak) is the finding; enumerate, don't crack in-band |
| [`tools/checkpoint_sic_opsec.py`](../../tools/checkpoint_sic_opsec.py) | Fingerprint SIC (18190/1), OPSEC LEA/ELA (18183/4), CA (18192/18210), FW1 (256/264), Gaia Portal; emit a CVE-**precondition** map incl. CVE-2024-24919 | CVE-2024-24919 is `applicable` ONLY when the RA/Mobile-Access marker is observed — else `undetermined` |
| [`tools/appliance_version_infer.py`](../../tools/appliance_version_infer.py) | Safe firmware/patch-level inference for FortiGate / PAN-OS / Cisco ASA / Citrix from headers, login markers, cert CN/serial → CVE applicability | Never asserts `applicable` on a low-confidence / unknown version — returns `undetermined` |
| [`tools/tls_handshake_probe.py`](../../tools/tls_handshake_probe.py) | Which TLS versions are supported, by **completed handshake** per pinned protocol | Fixes the `openssl s_client` exit/SECLEVEL false-positive — an aborted handshake ≠ support |
| [`tools/ntlm_decode.py`](../../tools/ntlm_decode.py) | Decode an NTLM Type-2 (CHALLENGE) AV_PAIR block → NetBIOS/DNS host, domain, forest, OS build | Info-leak finding from an unauthenticated challenge; no auth attempted |
| [`tools/perimeter_forensics.py`](../../tools/perimeter_forensics.py) | RST-TTL forgery discriminator (real host vs firewall forging a RST) + IKE NOTIFY decode | Never asserts "internal host behind FW" on RSTs alone — a firewall forges RSTs indistinguishably at this layer; returns `undetermined` without an open-service TTL baseline |