All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Red Analyzing Network Traffic With WiresharkCaptures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.Votes: 0GitHub stars: 2
- Red Analyzing Threat Actor Ttps With Mitre AttackSystematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices.Votes: 0GitHub stars: 2
- Red Analyzing Threat Actor Ttps With Mitre NavigatorMap advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles.Votes: 0GitHub stars: 2
- Red Assessing Vector And Embedding WeaknessesTest RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025.Votes: 0GitHub stars: 2
- Red Attack ChainMulti-stage attack path planning and execution across complex network environments.Votes: 0GitHub stars: 2
- Red Attacking Entra Id With RoadtoolsEnumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx.Votes: 0GitHub stars: 2
- Red Attacking Oauth With Device Code PhishingRun OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.Votes: 0GitHub stars: 2
- Red Auditing Aws S3 Bucket PermissionsSystematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.Votes: 0GitHub stars: 2
- Red Auditing Azure Active Directory ConfigurationAuditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.Votes: 0GitHub stars: 2
- Red Auditing Entra Id With AadinternalsDrive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation.Votes: 0GitHub stars: 2
- Red Auditing Foundry Smart Contract SecurityPre-deployment security audit of Solidity smart contracts in a Foundry project.Votes: 0GitHub stars: 2
- Red Auditing Gcp Iam PermissionsAuditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.Votes: 0GitHub stars: 2
- Red Auditing Kubernetes Rbac Privilege EscalationFinds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin.Votes: 0GitHub stars: 2
- Red Auditing Mcp Servers For Tool PoisoningAudit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning.Votes: 0GitHub stars: 2
- Red Aws Cloud PentestingAWS offensive testing — account and principal identification, IAM enumeration, resource discovery across all regions (S3, EC2, ECS, Lambda, API Gateway, Secrets Manager, SSM, KMS, ECR, snapshots, Cognito, CloudFormation), with AWS CLI as the baseline and Pacu/CloudFox/ScoutSuite as optional…Votes: 0GitHub stars: 2
- Red Aws Iam Privilege EscalationAWS IAM privilege escalation — CreatePolicyVersion, AttachUserPolicy, PutRolePolicy, PassRole with Lambda/EC2/Glue/SageMaker/CloudFormation/SSM, role assumption, trust-policy and resource-policy abuse, resolving boundaries/SCPs before proving the formerly denied…Votes: 0GitHub stars: 2
- Red Azure Entra Cloud PentestingAzure and Entra ID offensive testing — tenant discovery via OpenID metadata, users, service principals, managed identities, application registrations, Microsoft Graph scopes and consent grants, RBAC across subscriptions, storage, Key Vault, App Service, Automation, and Run…Votes: 0GitHub stars: 2
- Red Azure Privilege EscalationAzure and Entra ID privilege escalation — privileged Graph application permissions, application and service-principal ownership, credential addition, managed-identity abuse, role assignment capabilities, Key Vault control-plane mistakes, VM Run Command, Automation accounts, and federated identity…Votes: 0GitHub stars: 2
- Red Benchmarking Kubernetes With Kube BenchInstalls and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines.Votes: 0GitHub stars: 2
- Red Building Attack Pattern Library From Cti ReportsParse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates.Votes: 0GitHub stars: 2
- Red Building C2 Infrastructure With Sliver FrameworkBuild and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.Votes: 0GitHub stars: 2
- Red Building C2 Redirector InfrastructureBuild dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering.Votes: 0GitHub stars: 2
- Red Building Identity Federation With Saml Azure AdEstablish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO to cloud applications.Votes: 0GitHub stars: 2
- Red Building Identity Governance Lifecycle ProcessBuilds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation, role mining, access request workflows, periodic recertification, and orphaned account remediation using IGA platforms.Votes: 0GitHub stars: 2
- Red Building Phishing Reporting Button WorkflowImplement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters.Votes: 0GitHub stars: 2
- Red Building Red Team C2 Infrastructure With HavocDeploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.Votes: 0GitHub stars: 2
- Red Building Role Mining For Rbac OptimizationApply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.Votes: 0GitHub stars: 2
- Red Building Super Timelines With PlasoGenerate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch.Votes: 0GitHub stars: 2
- Red Cicd Offensive Cicd PipelineComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script…Votes: 0GitHub stars: 2
- Red Cicd Offensive Cicd SecretsComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms.Votes: 0GitHub stars: 2
- Red Cloud Attack Surface DiscoveryBlack-box discovery of a target's cloud footprint from an ordinary internet-facing domain — DNS, CNAME, headers, TLS, JavaScript, CSP, and error evidence fingerprinted to AWS, Azure, and GCP services, resources, accounts/tenants/projects, and applicable attack…Votes: 0GitHub stars: 2
- Red Cloud Credential AbuseProvider-aware credential abuse — validating found AWS keys/tokens, Azure ARM/Graph/refresh tokens, and GCP service-account credentials, identifying principals, audiences, effective permissions, and escalation paths, transitioning Xalgorix into credentialed cloud attack…Votes: 0GitHub stars: 2
- Red Cloud Cross Account Tenant TrustCross-account and cross-tenant trust testing — AWS role trust and resource policies, Azure cross-tenant applications and federated credentials, GCP IAM inheritance and service-account impersonation, requiring full trust-edge verification before claiming an attack…Votes: 0GitHub stars: 2
- Red Cloud K8sCloud infrastructure and Kubernetes security review covering container escapes and IAM policies.Votes: 0GitHub stars: 2
- Red Cloud Metadata Workload IdentityCloud metadata and workload identity abuse — SSRF/file-read to AWS IMDSv1/IMDSv2, ECS task credentials, IRSA, Azure IMDS and Managed Identity, GCP metadata and GKE Workload Identity, chained to credentials, principal identification, permission enumeration, and privilege…Votes: 0GitHub stars: 2
- Red Cloud Offensive CloudCloud security attack methodology covering AWS, Azure, and GCP.Votes: 0GitHub stars: 2
- Red Cloud Secrets Data AccessCloud secrets and data access — AWS Secrets Manager, SSM Parameter Store, Azure Key Vault, GCP Secret Manager, environment/CI-CD/deployment credentials, distinguishing visible names from retrievable values and test placeholders from live…Votes: 0GitHub stars: 2
- Red Cloud Storage Exposure TestingOffensive storage exposure testing across AWS S3, Azure Blob/ADLS, and GCP Cloud Storage - resolves s3 public access state (Block Public Access, ACLs, signed URLs) before declaring exposure - covers — existence, listing, read, write, overwrite, delete, ACL/policy modification, and signed-URL…Votes: 0GitHub stars: 2
- Red Coercing Authentication With Coercer PetitpotamTrigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB.Votes: 0GitHub stars: 2
- Red Conducting Cloud Penetration TestingThis skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments.Votes: 0GitHub stars: 2
- Red Conducting Cyber Risk Assessment With Nist 800 30Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as…Votes: 0GitHub stars: 2
- Red Conducting Domain Persistence With DcsyncPerform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.Votes: 0GitHub stars: 2
- Red Conducting External Reconnaissance With OsintConduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile.Votes: 0GitHub stars: 2
- Red Conducting Full Scope Red Team EngagementPlan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.Votes: 0GitHub stars: 2
- Red Conducting Gdpr Compliance AssessmentConduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach…Votes: 0GitHub stars: 2
- Red Conducting Internal Reconnaissance With Bloodhound CeConduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.Votes: 0GitHub stars: 2
- Red Conducting Man In The Middle Attack SimulationSimulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.Votes: 0GitHub stars: 2
- Red Conducting Pass The Ticket AttackPass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password.Votes: 0GitHub stars: 2
- Red Conducting Phishing Incident ResponseRespond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts.Votes: 0GitHub stars: 2
- Red Conducting Social Engineering Penetration TestDesign and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience.Votes: 0GitHub stars: 2