All authors
Claude Skills by NetVar1337
github.com/NetVar1337861 skills0 installs44 views
- ByovdBYOVD (Bring Your Own Vulnerable Driver) attack workflow: identify vulnerable signed drivers, map IOCTLs, arbitrary physical/virtual memory, MSR R/W, kernel code exec. Use for BYOVD, vulnerable .sys abuse, signed-driver primitives. Do NOT use for writing a new WDM/KMDF driver from scratch (kernel-dev) or generic exploit-dev without a driver primitive.Votes: 0GitHub stars: 2
- C ReviewUse when auditing C/C++ for memory corruption, integer overflow, races, and platform-specific vulns.Votes: 0GitHub stars: 2
- C2 Implant EngineeringUse when designing, implementing, reviewing, or debugging a custom C2 implant, beacon, or agent runtime: versioned task protocols, cancellable jobs, encrypted framing, transport failover, module ABIs, sleep/wake behavior, self-update, and operator-to-agent conformance tests.Votes: 0GitHub stars: 2
- C2 TradecraftC2 / command-and-control tradecraft for authorized red-team and adversary-simulation work: implant-beacon architectures, C2 protocol design, listener/redirector setup, OPSEC-aware egress, and evasion vs EDR/network detection. Use when the operator asks to stand up or extend C2 infrastructure, deploy or debug beacons/implants, design C2 channels (DNS/HTTPS/websocket/ICMP), or tune detection evasion for C2 traffic.Votes: 0GitHub stars: 2
- Call Stack SpoofingUsermode call-stack spoofing primitives: synthetic frames, gadget restore, JMP vs CALL semantics, ETW-friendly stacks.Votes: 0GitHub stars: 2
- Case ReviewReviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.Votes: 0GitHub stars: 2
- CavecrewUse when delegating to caveman subagents (investigator/builder/reviewer) to shrink tool-result context.Votes: 0GitHub stars: 2
- CavemanUltra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.Votes: 0GitHub stars: 2
- Cheat Longevity EngineeringEngineering cheats for longevity under AC: minimize ban surfaces, feature risk tiers, OPSEC build/deploy, silent flags, update cadence.Votes: 0GitHub stars: 2
- CheckUse for read-only SPEC.md vs code drift detection ('check drift', 'check invariants').Votes: 0GitHub stars: 2
- ClassesRecover C++ class hierarchies, vtables, and RTTI from a compiled binary via r2xsql's classes and class_methods tables. Use when asked about class/inheritance structure, vtable layout, virtual method tables, or 'what C++ classes does this binary define'.Votes: 0GitHub stars: 2
- Offensive Ai SecurityAI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, LLM-assisted attack automation, and AI system reconnaissance. Use when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors.Votes: 0GitHub stars: 2
- Offensive OauthOAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.Votes: 0GitHub stars: 2
- Offensive CloudUse when assessing AWS, Azure, or GCP security: identity enumeration, IAM privilege paths, cloud resource exposure, persistence review, lateral movement, serverless risks, and evidence-driven reporting.Votes: 0GitHub stars: 2
- Offensive Basic ExploitationWeek 5 exploit development curriculum. Foundational exploitation techniques: controlling EIP/RIP, ROP chain construction, ret2libc, shellcode injection, heap spraying, bypass techniques for ASLR/NX/stack canaries. Use when building initial PoCs or understanding classic exploitation primitives.Votes: 0GitHub stars: 2
- Offensive Crash AnalysisWeek 4 exploit development curriculum. Crash triage and analysis methodology: WinDbg/GDB analysis, ASAN/MSAN output interpretation, exploitability assessment, register/stack trace reading, root cause identification. Use when analyzing crash dumps, assessing exploitability, or understanding fuzzer-generated crashes.Votes: 0GitHub stars: 2
- Offensive Exploit Dev CourseFull exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers.Votes: 0GitHub stars: 2
- Offensive Exploit DevelopmentExploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.Votes: 0GitHub stars: 2
- Offensive MitigationsSecurity mitigation reference and bypass catalog: ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, seccomp. Covers both detection of enabled mitigations and known bypass techniques. Use when assessing target hardening or planning exploit mitigation bypasses.Votes: 0GitHub stars: 2
- Offensive Bug IdentificationSystematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.Votes: 0GitHub stars: 2
- Offensive Fuzzing CourseWeek 2 of the exploit development curriculum. Covers fuzzing methodology: target selection, corpus generation, coverage-guided fuzzing with AFL++/libFuzzer, structured fuzzing, and triage/deduplication. Use when setting up fuzz campaigns, selecting harness strategies, or triaging fuzzer output.Votes: 0GitHub stars: 2
- Offensive Vuln ClassesExploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit dev knowledge.Votes: 0GitHub stars: 2
- Offensive Advanced RedteamPractical advanced red team operations guide: OPSEC discipline, C2 infrastructure design, living-off-the-land techniques, lateral movement, persistence, data exfiltration, and evading modern defenses. Use for planning advanced red team engagements or understanding APT TTPs.Votes: 0GitHub stars: 2
- Offensive Edr EvasionEDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.Votes: 0GitHub stars: 2
- Offensive Initial AccessInitial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements.Votes: 0GitHub stars: 2
- Offensive Keylogger ArchLow-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis.Votes: 0GitHub stars: 2
- Offensive Windows BoundariesWindows security boundary taxonomy and attack surface enumeration: kernel/user boundary, sandbox boundaries (LPAC, AppContainer), COM/RPC boundaries, hypervisor boundary, trust level transitions. Use when planning privilege escalation paths, sandbox escapes, or understanding Windows security architecture.Votes: 0GitHub stars: 2
- Offensive Windows MitigationsDeep-dive on Windows exploit mitigations: ASLR, DEP/NX, CFG, CET/Shadow Stack, SEHOP, Heap Guard, ACG, Arbitrary Code Guard. Covers both the protection mechanism and known bypass techniques. Use when researching Windows exploit mitigations, planning bypass strategies, or understanding protection depth.Votes: 0GitHub stars: 2
- Offensive Osint MethodologyStructured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.Votes: 0GitHub stars: 2
- Offensive OsintComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tra...Votes: 0GitHub stars: 2
- Offensive Fast CheckingSpeed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping.Votes: 0GitHub stars: 2
- Offensive DeserializationInsecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits.Votes: 0GitHub stars: 2
- Offensive File UploadFile upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.Votes: 0GitHub stars: 2
- Offensive GraphqlGraphQL security testing checklist: introspection abuse, batching attacks, query depth/complexity DoS, field suggestion enumeration, IDOR via GraphQL, injection through arguments, authorization bypass. Use when assessing GraphQL endpoints in web app tests or bug bounty.Votes: 0GitHub stars: 2
- Offensive IdorIDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.Votes: 0GitHub stars: 2
- Offensive Open RedirectOpen redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.Votes: 0GitHub stars: 2
- Offensive Parameter PollutionHTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.Votes: 0GitHub stars: 2
- Offensive Race ConditionRace condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.Votes: 0GitHub stars: 2
- Offensive RceRemote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery.Votes: 0GitHub stars: 2
- Offensive Request SmugglingHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.Votes: 0GitHub stars: 2
- Offensive SsrfServer-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.Votes: 0GitHub stars: 2
- Offensive SstiServer-Side Template Injection testing checklist: template engine identification (Jinja2, Twig, Freemarker, Pebble, Velocity), polyglot detection payloads, engine-specific RCE payloads, blind SSTI, and filter bypass. Use when testing web apps for template injection vulnerabilities.Votes: 0GitHub stars: 2
- Offensive Waf BypassWAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.Votes: 0GitHub stars: 2
- Offensive XssCross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.Votes: 0GitHub stars: 2
- Offensive XxeXML External Entity injection testing checklist: classic XXE, blind XXE (out-of-band), XXE via file upload (SVG/docx), XXE in SOAP/REST, error-based XXE, XInclude attacks, and XXE filter bypass. Use for web app XXE testing and bug bounty.Votes: 0GitHub stars: 2
- Cloud K8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.Votes: 0GitHub stars: 2
- Code AuditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Votes: 0GitHub stars: 2
- CodeqlUse to run CodeQL scans (full or high-precision) and process SARIF findings.Votes: 0GitHub stars: 2
- Completion ReceiptUse when finishing a task, writing a status report, or handing work back. Emit a short receipt with paths, commands actually run, results, and any leftover blocker. Do not claim done from narrative.Votes: 0GitHub stars: 2
- Computer UseUse when the computer_use tool is available to drive the desktop without stealing focus.Votes: 0GitHub stars: 2