All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Red Detecting Misconfigured Azure StorageAudit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage.Votes: 0GitHub stars: 2
- Red Detecting Modbus Command Injection AttacksDetect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection.Votes: 0GitHub stars: 2
- Red Detecting Model Extraction AttacksDetect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability.Votes: 0GitHub stars: 2
- Red Detecting Network Anomalies With ZeekDeploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.Votes: 0GitHub stars: 2
- Red Detecting Network Scanning With Ids SignaturesDetect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.Votes: 0GitHub stars: 2
- Red Detecting Pass The Hash AttacksDetect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators.Votes: 0GitHub stars: 2
- Red Detecting Pass The Ticket AttacksDetect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM.Votes: 0GitHub stars: 2
- Red Detecting Port Scanning With Fail2banConfigures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.Votes: 0GitHub stars: 2
- Red Detecting Qr Code Phishing With Email SecurityDetect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR/QR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI).Votes: 0GitHub stars: 2
- Red Detecting Rdp Brute Force AttacksDetect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency.Votes: 0GitHub stars: 2
- Red Detecting Secure Boot BypassDetect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI.Votes: 0GitHub stars: 2
- Red Detecting Spearphishing With Email GatewayDetect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint…Votes: 0GitHub stars: 2
- Red Detecting Stuxnet Style AttacksDetects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection.Votes: 0GitHub stars: 2
- Red Detecting Supply Chain Attacks In Ci CdScans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit.Votes: 0GitHub stars: 2
- Red Detecting T1003 Credential Dumping With EdrDetect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs.Votes: 0GitHub stars: 2
- Red Detecting Typosquatting PackagesFlag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan.Votes: 0GitHub stars: 2
- Red Edr Bypass ReReverse engineering security sensors and endpoint agents to analyze bypass mechanisms.Votes: 0GitHub stars: 2
- Red Emulating Cloud Attacks With Stratus Red TeamInstall and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle, then verify the telemetry they generate.Votes: 0GitHub stars: 2
- Red Enumerating Cloud With CloudfoxRun CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploitable misconfigurations.Votes: 0GitHub stars: 2
- Red Executing Active Directory Attack SimulationExecutes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise.Votes: 0GitHub stars: 2
- Red Executing Nist Rmf Authorization To OperateDrive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously.Votes: 0GitHub stars: 2
- Red Executing Phishing Simulation CampaignExecutes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks.Votes: 0GitHub stars: 2
- Red Executing Red Team Engagement PlanningRed team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.Votes: 0GitHub stars: 2
- Red Executing Red Team ExerciseRun a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute Ratel, Mythic) through the full attack lifecycle to test SOC detection and response rather than just find vulnerabilities.Votes: 0GitHub stars: 2
- Red Exploiting Active Directory Certificate Services Esc1Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.Votes: 0GitHub stars: 2
- Red Exploiting Active Directory With BloodhoundBloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments.Votes: 0GitHub stars: 2
- Red Exploiting Adcs With CertipyUse Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth.Votes: 0GitHub stars: 2
- Red Exploiting Aws With PacuRuns the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence/backdooring modules like iam__backdoor_users_keys.Votes: 0GitHub stars: 2
- Red Exploiting Bgp Hijacking VulnerabilitiesAnalyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.Votes: 0GitHub stars: 2
- Red Exploiting Broken Function Level AuthorizationTests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering.Votes: 0GitHub stars: 2
- Red Exploiting Constrained Delegation AbuseExploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.Votes: 0GitHub stars: 2
- Red Exploiting Ipv6 VulnerabilitiesIdentifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.Votes: 0GitHub stars: 2
- Red Exploiting Jwt Algorithm Confusion AttackExploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key.Votes: 0GitHub stars: 2
- Red Exploiting Kerberoasting With ImpacketPerform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.Votes: 0GitHub stars: 2
- Red Exploiting Ms17 010 Eternalblue VulnerabilityMS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution.Votes: 0GitHub stars: 2
- Red Exploiting Nopac Cve 2021 42278 42287Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.Votes: 0GitHub stars: 2
- Red Exploiting Race Condition VulnerabilitiesDetects and exploits race condition (TOCTOU) vulnerabilities in web applications using Burp Suite's Turbo Intruder extension and its single-packet attack technique to fire parallel requests that bypass rate limits, duplicate transactions, or overrun usage limits.Votes: 0GitHub stars: 2
- Red Exploiting Smb Vulnerabilities With MetasploitIdentifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.Votes: 0GitHub stars: 2
- Red Exploiting Zerologon Vulnerability Cve 2020 1472Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.Votes: 0GitHub stars: 2
- Red Extracting Credentials From Memory DumpExtracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz.Votes: 0GitHub stars: 2
- Red Fleet Hunting With VelociraptorDeploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors.Votes: 0GitHub stars: 2
- Red Gcp Cloud PentestingGCP offensive testing — principal and project identification, org/folder/project IAM inheritance, service accounts, Cloud Asset Inventory, storage, secrets, KMS, Compute, Cloud Run and Cloud Functions, GKE boundaries, Cloud Build, and Artifact Registry with gcloud as the…Votes: 0GitHub stars: 2
- Red Gcp Iam Privilege EscalationGCP IAM privilege escalation - gcp service account impersonation primitives (actAs, getAccessToken, signBlob, signJwt), serviceAccountKeys, setIamPolicy at project/folder/org levels, custom role manipulation, — service account actAs, getAccessToken, signBlob and signJwt, serviceAccountKeys…Votes: 0GitHub stars: 2
- Red Generating And Analyzing SbomsGenerate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign.Votes: 0GitHub stars: 2
- Red Generating Forensic Timelines With HayabusaRun Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics.Votes: 0GitHub stars: 2
- Red Hunting Bootkits In Efi System PartitionBaseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes.Votes: 0GitHub stars: 2
- Red Hunting Credential Stuffing AttacksDetects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data.Votes: 0GitHub stars: 2
- Red Hunting Evtx With ChainsawRun Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON.Votes: 0GitHub stars: 2
- Red Hunting For Dcsync AttacksDetect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts.Votes: 0GitHub stars: 2
- Red Hunting For Defense Evasion Via TimestompingDetect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.Votes: 0GitHub stars: 2