All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Red Infrastructure Offensive Windows BoundariesWindows security boundary taxonomy and attack surface enumeration: kernel/user boundary, sandbox boundaries (LPAC, AppContainer), COM/RPC boundaries, hypervisor boundary, trust level transitions.Votes: 0GitHub stars: 2
- Red Infrastructure Offensive Windows MitigationsDeep-dive on Windows exploit mitigations: ASLR, DEP/NX, CFG, CET/Shadow Stack, SEHOP, Heap Guard, ACG, Arbitrary Code Guard. Covers both the protection mechanism and known bypass techniques.Votes: 0GitHub stars: 2
- Red Investigating Phishing Email IncidentInvestigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.Votes: 0GitHub stars: 2
- Red Investigating Ransomware Attack ArtifactsForensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options.Votes: 0GitHub stars: 2
- Red Iot Offensive IotIoT and embedded device security testing methodology.Votes: 0GitHub stars: 2
- Red Llm SecuritySecurity assessment of large language model applications, prompts, and agentic workflows.Votes: 0GitHub stars: 2
- Red Managing Cloud Identity With OktaThis skill covers implementing Okta as a centralized identity provider for cloud environments, configuring SSO integration with AWS, Azure, and GCP, deploying phishing- resistant MFA with Okta FastPass, managing lifecycle automation for user provisioning and deprovisioning, and enforcing adaptive…Votes: 0GitHub stars: 2
- Red Managing Third Party Vendor RiskBuild and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely.Votes: 0GitHub stars: 2
- Red Mapping Attack Paths With Bloodhound CeCollect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher.Votes: 0GitHub stars: 2
- Red Mapping Mitre Attack TechniquesMaps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.Votes: 0GitHub stars: 2
- Red Migrating To Post Quantum CryptographyBuild a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38.Votes: 0GitHub stars: 2
- Red Modeling Threats With OpenctiDeploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets).Votes: 0GitHub stars: 2
- Red Moving Laterally With NetexecUse NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules.Votes: 0GitHub stars: 2
- Red Network Offensive Network AttacksDense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040.Votes: 0GitHub stars: 2
- Red Operating Havoc C2Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations.Votes: 0GitHub stars: 2
- Red Operating Sliver C2Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation.Votes: 0GitHub stars: 2
- Red Operationalizing Misp Threat FeedsStand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules.Votes: 0GitHub stars: 2
- Red Orchestrating Llm Attacks With PyritBuild automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory.Votes: 0GitHub stars: 2
- Red Ot IcsOperational technology and ICS/SCADA security assessment across industrial protocols.Votes: 0GitHub stars: 2
- Red Parsing Artifacts With Eric Zimmerman ToolsParse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis.Votes: 0GitHub stars: 2
- Red Pentesting AjpTesting Apache JServ Protocol (AJP13) connectors (default 8009/TCP) for the Ghostcat LFI/RCE vulnerability (CVE-2020-1938), trusted-request-attribute abuse, AJP secret brute forcing, and reaching the Tomcat Manager via an nginx/Apache AJP proxy during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting CouchdbTesting Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution…Votes: 0GitHub stars: 2
- Red Pentesting DnsTesting DNS services (default 53/TCP+UDP, 5353/UDP mDNS) for zone transfers (AXFR), version/banner disclosure, subdomain and reverse-lookup enumeration, open recursion/amplification, DNSSEC and CAA misconfiguration, and Active Directory SRV record discovery during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting Docker RegistryTesting Docker Registry / Distribution services (default 5000/TCP, HTTP or HTTPS) for unauthenticated catalog access, image and blob/manifest extraction, weak basic-auth, and supply-chain image backdooring (push poisoned WordPress/SSH images) during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting DockerTesting the Docker Engine remote API (default 2375/TCP plaintext, 2376/TCP TLS) for unauthenticated access leading to instant host takeover by mounting the host filesystem into a privileged container, plus secret/credential extraction and container-escape pivoting during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting ElasticsearchTesting Elasticsearch search/analytics clusters (default HTTP port 9200, transport 9300) for disabled authentication and full index dumping, default/weak credentials, write access to indices, and the historical Groovy/MVEL dynamic-scripting remote-code-execution CVEs (CVE-2015-1427, CVE-2014-3120)…Votes: 0GitHub stars: 2
- Red Pentesting FreeipaAttacking FreeIPA, the open-source Active-Directory alternative for Unix environments, during authorized red-team operations - covering anonymous and authenticated LDAP/ipa enumeration, Kerberos CCACHE/keytab credential theft and reuse, HBAC and sudo rule abuse, hash extraction and cracking…Votes: 0GitHub stars: 2
- Red Pentesting FtpTesting FTP services (default port 21, plus FileZilla admin 14147) for anonymous access, default/weak credentials, FTP bounce port scanning and protocol relay, writable webroot uploads, and dangerous vsFTPd/ProFTPD configuration during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting ImapTesting IMAP services (default ports 143 cleartext, 993 IMAPS) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox access/data extraction via raw IMAP commands and curl during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting IpmiTesting IPMI / BMC out-of-band management interfaces (default 623/UDP, sometimes TCP) for the cipher-zero authentication bypass, RAKP password-hash retrieval, anonymous/default BMC credentials, cleartext password storage, and host takeover via KVM/SOL during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting KerberosTesting the Kerberos authentication service (88/tcp and 88/udp) in Active Directory during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting LdapTesting LDAP / LDAPS directory services (389, 636, and Global Catalog 3268/3269) including Active Directory during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting MemcachedTesting Memcached distributed memory caching servers (default port 11211 TCP/UDP) for unauthenticated stats/version access, slab-based key dumping and cached-data exfiltration, cache poisoning, and the UDP reflection/amplification DDoS primitive during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting MongodbTesting MongoDB document databases (default ports 27017 and 27018) for no-auth/unauthenticated access, weak credentials, database and collection dumping, predictable ObjectID enumeration, config-based auth bypass, and the MongoBleed unauthenticated memory-disclosure CVE during authorized…Votes: 0GitHub stars: 2
- Red Pentesting MsrpcTesting the Microsoft RPC (MSRPC / DCE-RPC) endpoint mapper and exposed RPC interfaces during authorized engagements. The endpoint mapper listens on TCP/UDP 135 (also reachable over SMB named pipes on 139/445 and HTTP on 593).Votes: 0GitHub stars: 2
- Red Pentesting MssqlTesting Microsoft SQL Server (default port 1433, UDP 1434 browser) for default/weak SA credentials, Windows-auth and NTLM relay/coercion, xp_cmdshell OS command execution, linked-server lateral movement, and OLE/BULK file read-write primitives during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting MysqlTesting MySQL / MariaDB database services (default port 3306) for empty/default root credentials, authentication-bypass and version CVEs, FILE-privilege data theft, and the INTO OUTFILE webshell / lib_mysqludf_sys UDF remote-code-execution primitives during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting NetbiosTesting NetBIOS over TCP/IP services during authorized engagements. Covers the NetBIOS Name Service (137/udp, 137/tcp), Datagram Service (138/udp), and Session Service (139/tcp).Votes: 0GitHub stars: 2
- Red Pentesting NfsTesting NFS services (default port 2049, with rpcbind/mountd on 111 and dynamic ports) for exported share enumeration, missing authentication, UID/GID impersonation, no_root_squash/no_all_squash misconfiguration, subtree_check export escape, and group-based file access (e.g., /etc/shadow) during…Votes: 0GitHub stars: 2
- Red Pentesting NtpTesting NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting OracleTesting Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during…Votes: 0GitHub stars: 2
- Red Pentesting Pop3Testing POP3 services (default ports 110 cleartext, 995 POP3S) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox retrieval/data extraction via raw POP3 commands during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting PostgresqlTesting PostgreSQL database services (default port 5432, fallback 5433) for trust-auth and default/weak credentials, role/privilege enumeration, the COPY ...Votes: 0GitHub stars: 2
- Red Pentesting RabbitmqTesting RabbitMQ / AMQP message brokers (default 5672/TCP plaintext, 5671/TCP TLS; management 15672) for default guest credentials, anonymous/SASL login, message sniffing via topic/stream/event-exchange binds, queue-deletion DoS (CVE-2024-51988), Authorization-header log leakage, and…Votes: 0GitHub stars: 2
- Red Pentesting RdpTesting the Remote Desktop Protocol (RDP, 3389/tcp ms-wbt-server) during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting RedisTesting Redis in-memory data stores (default port 6379) for unauthenticated access, weak AUTH credentials, keyspace dumping, and the high-impact RCE primitives - module load (system.exec), webshell/cron write via CONFIG SET dir + dbfilename + SAVE, SSH authorized_keys write, Lua sandbox escape…Votes: 0GitHub stars: 2
- Red Pentesting RsyncTesting rsync daemon services (default port 873) for unauthenticated module listing and access, weak/default credentials and brute force, arbitrary file read/download and write/upload (including authorized_keys planting), and rsyncd.conf/secrets misconfiguration during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting SmbTesting SMB/CIFS file-sharing services (TCP 445, and 139 over NetBIOS) on Windows and Samba hosts during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting SmtpTesting SMTP services (default ports 25, 465/SSL, 587/submission) for open relays, user enumeration (VRFY/EXPN/RCPT), NTLM info disclosure, weak/no authentication, SPF/DKIM/DMARC spoofing gaps, Secure Email Gateway bypass, and SMTP smuggling during authorized engagements.Votes: 0GitHub stars: 2
- Red Pentesting SnmpTesting SNMP services (default 161/UDP for agents, 162/UDP for traps, 10161/10162 over TLS/DTLS) for default/guessable community strings, sensitive MIB/OID data harvesting, writable rwcommunity strings, and SNMP-to-RCE via NET-SNMP-EXTEND-MIB during authorized engagements.Votes: 0GitHub stars: 2