All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Exploiting Sudo Suid And Cron MisconfigurationsLocal privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.Votes: 0GitHub stars: 2
- Webapp Exploiting Template Injection VulnerabilitiesDetecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.Votes: 0GitHub stars: 2
- Webapp Exploiting Type Juggling VulnerabilitiesExploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.Votes: 0GitHub stars: 2
- Webapp Exploiting Vulnerabilities With Metasploit FrameworkThe Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7.Votes: 0GitHub stars: 2
- Webapp Exploiting Websocket VulnerabilitiesTesting WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.Votes: 0GitHub stars: 2
- Webapp Exploiting Xpath InjectionExploiting XPath injection where applications build XPath/XQuery expressions from unsanitized user input to query XML documents, allowing authentication bypass and blind extraction of the entire XML document (users, passwords, schema) plus out-of-band exfiltration.Votes: 0GitHub stars: 2
- Webapp Exploiting Xslt Server Side InjectionExploiting server-side XSLT injection where an application transforms XML with attacker-influenced stylesheets, enabling processor fingerprinting, local file read, SSRF, file write, and remote code execution via processor-specific extension functions (libxslt/lxml, Saxon, Xalan, .NET msxsl:script…Votes: 0GitHub stars: 2
- Webapp Extracting Config From Agent Tesla RatExtract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.Votes: 0GitHub stars: 2
- Webapp Extracting Iocs From Malware SamplesExtracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation.Votes: 0GitHub stars: 2
- Webapp Extracting Memory Artifacts With RekallUses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images.Votes: 0GitHub stars: 2
- Webapp File Processing Pipeline TestingModel and attack the full file processing pipeline - upload, validation, storage, transformation, scanning, preview, import, processing, serving - hunting parser confusion, archive extraction abuse, traversal, decompression issues, access-control gaps between stages, and content-type mismatches.Votes: 0GitHub stars: 2
- Webapp Find Security Vulnerabilities In CodeFind security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of…Votes: 0GitHub stars: 2
- Webapp Fix Security Vulnerabilities WithFix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit.Votes: 0GitHub stars: 2
- Webapp Generating Threat Intelligence ReportsGenerates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts.Votes: 0GitHub stars: 2
- Webapp Graphql Api SecurityGraphQL API security testing covering introspection, field-level authorization, BOLA/BFLA, batching abuse, depth/complexity attacks, mutations, and…Votes: 0GitHub stars: 2
- Webapp Grpc Api SecuritygRPC API security testing covering reflection, service enumeration, method-level authorization, message tampering, and transcoded REST…Votes: 0GitHub stars: 2
- Webapp Hardening Docker Containers For ProductionHardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce…Votes: 0GitHub stars: 2
- Webapp Hardening Docker Daemon ConfigurationHarden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.Votes: 0GitHub stars: 2
- Webapp Hardening Linux Endpoint With Cis BenchmarkHardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.Votes: 0GitHub stars: 2
- Webapp Hardening Windows Endpoint With Cis BenchmarkHardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements.Votes: 0GitHub stars: 2
- Webapp Hunting Advanced Persistent ThreatsProactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts.Votes: 0GitHub stars: 2
- Webapp Hunting For Anomalous Powershell ExecutionHunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events.Votes: 0GitHub stars: 2
- Webapp Hunting For Beaconing With Frequency AnalysisIdentify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.Votes: 0GitHub stars: 2
- Webapp Hunting For Cobalt Strike BeaconsDetect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.Votes: 0GitHub stars: 2
- Webapp Hunting For Command And Control BeaconingDetect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.Votes: 0GitHub stars: 2
- Webapp Hunting For Data Exfiltration IndicatorsHunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.Votes: 0GitHub stars: 2
- Webapp Hunting For Data Staging Before ExfiltrationDetect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process…Votes: 0GitHub stars: 2
- Webapp Hunting For Dcom Lateral MovementHunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) correlation, WMI event analysis, RPC endpoint mapper traffic on port 135, and…Votes: 0GitHub stars: 2
- Webapp Hunting For Dns Based PersistenceHunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.Votes: 0GitHub stars: 2
- Webapp Hunting For Dns Tunneling With ZeekDetect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.Votes: 0GitHub stars: 2
- Webapp Hunting For Lateral Movement Via WmiDetect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.Votes: 0GitHub stars: 2
- Webapp Hunting For Living Off The Cloud TechniquesHunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.Votes: 0GitHub stars: 2
- Webapp Hunting For Living Off The Land BinariesProactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.Votes: 0GitHub stars: 2
- Webapp Hunting For Lolbins Execution In Endpoint LogsHunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.Votes: 0GitHub stars: 2
- Webapp Hunting For Persistence Mechanisms In WindowsSystematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.Votes: 0GitHub stars: 2
- Webapp Hunting For Persistence Via Wmi SubscriptionsHunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.Votes: 0GitHub stars: 2
- Webapp Hunting For Process Injection TechniquesDetect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process…Votes: 0GitHub stars: 2
- Webapp Hunting For Registry Persistence MechanismsHunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.Votes: 0GitHub stars: 2
- Webapp Hunting For Registry Run Key PersistenceDetect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.Votes: 0GitHub stars: 2
- Webapp Hunting For Scheduled Task PersistenceHunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.Votes: 0GitHub stars: 2
- Webapp Hunting For Shadow Copy DeletionHunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.Votes: 0GitHub stars: 2
- Webapp Hunting For Startup Folder PersistenceDetect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, analyzing autoruns entries, and using Python watchdog for real-time filesystem monitoring.Votes: 0GitHub stars: 2
- Webapp Hunting For Supply Chain CompromiseHunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.Votes: 0GitHub stars: 2
- Webapp Hunting For Suspicious Scheduled TasksHunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.Votes: 0GitHub stars: 2
- Webapp Hunting For T1098 Account ManipulationHunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs.Votes: 0GitHub stars: 2
- Webapp Hunting For Unusual Network ConnectionsHunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.Votes: 0GitHub stars: 2
- Webapp Hunting For Unusual Service InstallationsDetect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.Votes: 0GitHub stars: 2
- Webapp Hunting For Webshell ActivityHunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.Votes: 0GitHub stars: 2
- Webapp Identity FederationSecurity assessment of federated identity and authentication protocols including SAML and OIDC.Votes: 0GitHub stars: 2
- Webapp Implementing Anti Ransomware Group PolicyConfigures Windows Group Policy Objects (GPO) to prevent ransomware execution and limit its spread. Implements AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings.Votes: 0GitHub stars: 2