All authors
Claude Skills by NetVar1337
github.com/NetVar1337861 skills0 installs44 views
- Active Directory AttackUse when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominanceVotes: 0GitHub stars: 2
- Advanced RedteamUse when designing C2 infrastructure or OPSEC for a long-haul red-team op — redirectors, malleable profiles, tiered/segregated infra, living-off-the-land, data exfiltrationVotes: 0GitHub stars: 2
- Ai SecurityUse when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)Votes: 0GitHub stars: 2
- Cloud SecurityUse when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuseVotes: 0GitHub stars: 2
- Coding MasteryUse when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementationVotes: 0GitHub stars: 2
- Crypto AnalysisUse when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration reviewVotes: 0GitHub stars: 2
- Edr EvasionUse when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasionVotes: 0GitHub stars: 2
- Exploit DevelopmentUse when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-SandboxVotes: 0GitHub stars: 2
- Incident ResponseUse when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi responseVotes: 0GitHub stars: 2
- Initial AccessUse when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitationVotes: 0GitHub stars: 2
- Keylogger ArchUse when designing or analyzing keystroke/input capture — SetWindowsHookEx, raw input devices, ETW-based capture, kernel drivers, stealth techniques and their IOCsVotes: 0GitHub stars: 2
- Malware AnalysisUse when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)Votes: 0GitHub stars: 2
- Mobile PentestUse when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native REVotes: 0GitHub stars: 2
- Network AttackUse when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wirelessVotes: 0GitHub stars: 2
- Privesc LinuxUse when escalating privileges on a Linux host — SUID/SGID & GTFOBins, sudo LPE (CVE-2025-32462/32463), capabilities & LD_PRELOAD, kernel LPE (CVE-2024-1086, Dirty Pipe, GameOver(lay)), service misconfig (PwnKit, Looney Tunables), container/namespace escapeVotes: 0GitHub stars: 2
- Privesc WindowsUse when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvestingVotes: 0GitHub stars: 2
- Recon OsintUse when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)Votes: 0GitHub stars: 2
- Red Team OpsUse when running a full red-team engagement end-to-end — initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-landVotes: 0GitHub stars: 2
- Reverse EngineeringUse when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-daysVotes: 0GitHub stars: 2
- Shellcode DevUse when writing position-independent shellcode or a loader — PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcodeVotes: 0GitHub stars: 2
- Threat HuntingUse when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validationVotes: 0GitHub stars: 2
- Using Offensive ClaudeUse when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)Votes: 0GitHub stars: 2
- Vulnerability AnalysisUse when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risksVotes: 0GitHub stars: 2
- Web PentestUse when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet raceVotes: 0GitHub stars: 2
- Windows BoundariesUse when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonationVotes: 0GitHub stars: 2
- Windows MitigationsUse when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCIVotes: 0GitHub stars: 2
- Offset DumperGame/engine offset dumper patterns: pattern scan DB, PDB/schema dump, UE/Unity/Source pipelines, version pinning.Votes: 0GitHub stars: 2
- Omc ReferenceOMC agent catalog, available tools, team pipeline routing, commit protocol, and skills registry. Auto-loads when delegating to agents, using OMC tools, orchestrating teams, making commits, or invoking skills.Votes: 0GitHub stars: 2
- Operator ExecutionUse when the operator asks to execute, implement, investigate, automate, or fully handle a task. Convert the request into a tight execution contract, load the narrowest matching skill, act rather than narrate, and return verified results.Votes: 0GitHub stars: 2
- Ot IcsUse for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.Votes: 0GitHub stars: 2
- Patch Diff ExploitN-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。Votes: 0GitHub stars: 2
- Patch Diff Variant HuntingUse when mining historical CVEs, vendor patches, silent fixes, regressions, or incomplete mitigations for new vulnerability variants that still affect the latest stable release. Converts binary/source diffs into root-cause predicates, searches sibling implementations and exceptional paths, and applies a strict novelty gate so known bugs are not misreported as zero-days.Votes: 0GitHub stars: 2
- Pattern ScannerBinary/pattern scanning: IDA/runtime signatures, mask formats, PE section constraints, SIMD scanners.Votes: 0GitHub stars: 2
- Pcx ScriptingPCX (Perception.cx) scripting with Enma and AngelScript for game interaction, memory manipulation, rendering, GUI, and automation. Full API reference for Enma proc/render/input/GUI/net/unicorn/zydis/win/sound APIs. Invoke with /pcx-scripting or when the task involves Perception.cx scripting.Votes: 0GitHub stars: 2
- Pe ToolsPE/COFF engineering: parse, rebuild, TLS, exceptions, imports, manual map helpers, Authenticode notes.Votes: 0GitHub stars: 2
- Pentest Tools主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。Votes: 0GitHub stars: 2
- Src Hunter实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。Votes: 0GitHub stars: 2
- Perception ApiPerception.cx's Enma host API for script lifecycle, process memory, rendering, GUI, input, networking, sound, Windows automation, Unicorn, Zydis, CPU helpers, and MCP. Use when writing, reviewing, or debugging scripts that call APIs registered by Perception; not for Enma language syntax itself.Votes: 0GitHub stars: 2
- PlanUse for plan-mode only: write an actionable markdown plan under .hermes/plans/, no execution.Votes: 0GitHub stars: 2
- Plouton SmmUse when building or extending a Plouton-class SMM (ring -2) game or memory framework: EDK2 SMM module, XHCI SMI on USB, Windows physical memory walk, SPI firmware implant, or PiSmmCpuDxeSmm page-table patch.Votes: 0GitHub stars: 2
- Ponytail AuditUse for whole-repo over-engineering audit ('audit for over-engineering', /ponytail-audit). Report only.Votes: 0GitHub stars: 2
- Ponytail DebtUse to list ponytail: shortcut comments as a debt ledger (/ponytail-debt). Report only.Votes: 0GitHub stars: 2
- Ponytail GainUse to show ponytail impact scoreboard from benchmark medians (/ponytail-gain).Votes: 0GitHub stars: 2
- Ponytail HelpUse for ponytail commands quick-reference (/ponytail-help).Votes: 0GitHub stars: 2
- Ponytail ReviewUse for over-engineering code review focused on what to delete (/ponytail-review).Votes: 0GitHub stars: 2
- PonytailUse for laziest correct solution ('ponytail', 'yagni', 'do less'). Modes: lite/full/ultra; default off until enabled.Votes: 0GitHub stars: 2
- Prompt ForgeUse when writing, rewriting, or stress-testing prompts, work orders, or skill trigger text. Convert vague requests into a tight objective-target-constraints-proof prompt and keep only variants that change agent behavior.Votes: 0GitHub stars: 2
- Protocol ReverseUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.Votes: 0GitHub stars: 2
- Pwn Chain从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调'CTF 本地通 → 真实远程稳定打通'的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。Votes: 0GitHub stars: 2
- Pwndbg Dynamic AnalysisUse when debugging authorized Linux user/kernel/QEMU targets with Pwndbg on GDB/LLDB.Votes: 0GitHub stars: 2