All authors
Claude Skills by harezadmm
github.com/harezadmm182 skills0 installs5 views
- Kerberos AttacksKerberos protocol attack techniques and exploitationVotes: 0GitHub stars: 2
- Kernel ExploitationLinux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.Votes: 0GitHub stars: 2
- Kubernetes PentestingKubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.Votes: 0GitHub stars: 2
- Lattice Crypto AttacksCSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.Votes: 0GitHub stars: 2
- Linux Lateral MovementLinux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.Votes: 0GitHub stars: 2
- Linux PostexploitLinux post-exploitation — credential harvesting, privilege escalation, persistence, lateral movement, evasion, exfiltration, and network attacks with multi-exec fallback (bash/sh/python3/perl/busybox) and stealth modes (base64/memfd/shm)Votes: 0GitHub stars: 2
- Linux Privesc Gtfobins MasterLinux privilege escalation via misconfigured sudo/suid/capabilities on legitimate binaries. Use when an unprivileged shell exists and enumerating for a root path. Covers context discovery, binary selection by permission context, and the escalation decision tree.Votes: 0GitHub stars: 2
- Linux Privilege EscalationLinux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.Votes: 0GitHub stars: 2
- Linux Security BypassLinux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.Votes: 0GitHub stars: 2
- Llm Prompt InjectionLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.Votes: 0GitHub stars: 2
- Llm SecurityOWASP LLM Top 10 security testing - prompt injection, system prompt leakage, excessive agency, sensitive data disclosureVotes: 0GitHub stars: 2
- Macos PostexploitmacOS post-exploitation — 46 programs across recon, credential harvesting, privilege escalation, persistence, evasion, monitoring, lateral movement, and exfiltrationVotes: 0GitHub stars: 2
- Macos Process InjectionmacOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.Votes: 0GitHub stars: 2
- Macos Security BypassmacOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.Votes: 0GitHub stars: 2
- Malware Development WorkflowMalware development for authorised red-team and detection-engineering work. Use when building a custom implant, loader, or payload for an engagement, or when producing samples for defensive testing. Covers the development pipeline, capability selection, and the legal and operational constraints.Votes: 0GitHub stars: 2
- Memory Forensics VolatilityMemory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.Votes: 0GitHub stars: 2
- Mobile Ssl Pinning BypassMobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI hash pinning on Android and iOS, including React Native, Flutter, and Xamarin frameworks.Votes: 0GitHub stars: 2
- Network Protocol AttacksNetwork protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.Votes: 0GitHub stars: 2
- Nosql InjectionNoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.Votes: 0GitHub stars: 2
- Ntlm Relay CoercionNTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.Votes: 0GitHub stars: 2
- Nuclei Custom Template AuthoringWriting and running nuclei templates for scalable vulnerability detection. Use when you need to check a class of vulnerability across many targets, convert a manual finding into a repeatable check, or triage a large surface. Covers template anatomy, protocol types, matchers, and safe execution.Votes: 0GitHub stars: 2
- Nuclei Template Library OperationsOperating the full nuclei-templates library as an assessment instrument. Use when you need to select the right templates for a target, gate noisy checks behind fingerprinting, schedule scans without disrupting production, or triage thousands of hits into findings. Covers the 13,717-template census, profile-driven selection, flow-based multi-step chains, OAST, and hit triage.Votes: 0GitHub stars: 2
- Oauth Oidc MisconfigurationOAuth 2.0 and OIDC misconfiguration playbook. Use when reviewing redirect_uri validation, state and nonce handling, PKCE enforcement, token audience, account binding, and server-side fetch references in authorization flows.Votes: 0GitHub stars: 2
- Open RedirectOpen redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.Votes: 0GitHub stars: 2
- Osint Target ProfilingOSINT and social engineering reconnaissance. Use during the SCOUT phase when you need to map an organisation, its people, its infrastructure and its trust relationships before touching it. Covers identity harvesting, infrastructure attribution, and the pivot from person to system.Votes: 0GitHub stars: 2
- Path Traversal LfiPath traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.Votes: 0GitHub stars: 2
- Prototype Pollution AdvancedAdvanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.Votes: 0GitHub stars: 2
- Prototype PollutionPrototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.Votes: 0GitHub stars: 2
- PrototypeBuild a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.Votes: 0GitHub stars: 2
- Race ConditionRace condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.Votes: 0GitHub stars: 2
- Recon And MethodologyReconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.Votes: 0GitHub stars: 2
- Recon For SecEntry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.Votes: 0GitHub stars: 2
- Recon MethodologyReconnaissance methodology — passive and active discovery, asset inventory, and attack-surface mappingVotes: 0GitHub stars: 2
- Request SmugglingHTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.Votes: 0GitHub stars: 2
- Reverse Shell TechniquesReverse shell and outbound callback techniques. Use when establishing a shell from a compromised host, choosing a payload for a constrained environment, stabilising a TTY, or working through egress filtering and detection. Covers language payloads, egress bypass, TTY upgrade, and OPSEC.Votes: 0GitHub stars: 2
- Rsa Attack TechniquesRSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.Votes: 0GitHub stars: 2
- Saml Sso Assertion AttacksSAML SSO assertion attack playbook. Use when an enterprise login uses SAMLRequest/SAMLResponse, an ACS endpoint, and an external IdP. Covers decoding, signature-coverage analysis, XML Signature Wrapping, unsigned assertions, algorithm confusion, comment/namespace bypasses, audience and recipient gaps, InResponseTo and freshness replay, IdP-initiated vs SP-initiated flows, account linking via unverified email, NameID format confusion, XXE, and issuer confusion.Votes: 0GitHub stars: 2
- Sandbox Escape TechniquesSandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.Votes: 0GitHub stars: 2
- Security Reporting And DocumentationProducing the penetration test deliverable: audience-modelled findings, argued severity, evidence discipline, kill-chain narratives, testable remediation, and the verification and retest cycle. Use when writing, reviewing, or retesting any security report whose value depends on verified, actionable claims.Votes: 0GitHub stars: 2
- Setup Ts Deep ModulesWire dependency-cruiser into a TypeScript repo so each package is a deep module — implementation hidden in subfolders, reachable only through its entry-point files. User-invoked.Votes: 0GitHub stars: 2
- Smart Contract VulnerabilitiesSmart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.Votes: 0GitHub stars: 2
- Sqli Sql InjectionSQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.Votes: 0GitHub stars: 2
- Ssrf Server Side Request ForgerySSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.Votes: 0GitHub stars: 2
- Ssti Server Side Template InjectionSSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.Votes: 0GitHub stars: 2
- Stack Overflow And RopStack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.Votes: 0GitHub stars: 2
- Steganography TechniquesSteganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.Votes: 0GitHub stars: 2
- Stripe 3ds PaymentsEMV 3-D Secure 2.x and Stripe PaymentIntent authentication testing. Use when a payment flow returns next_action, requires_action, or an ACS redirect and you need to map the challenge state machine, test SCA/PSD2 exemptions, and report frictionless vs challenge outcomes with evidence.Votes: 0GitHub stars: 2
- Subdomain TakeoverSubdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.Votes: 0GitHub stars: 2
- Symbolic Execution ToolsSymbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis with angr, Z3, or Unicorn Engine.Votes: 0GitHub stars: 2
- Symmetric Cipher AttacksSymmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reuse, or meet-in-the-middle attacks.Votes: 0GitHub stars: 2