All authors
Claude Skills by noahfranklin
github.com/noahfranklin21 skills0 installs43 views
- Active Directory PentestUse when testing an on-prem Active Directory environment — enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting, delegation abuse), credential access (NTLM/hashes, LSASS, DCSync), ACL/permission abuse, GPO abuse, trust attacks, and domain-privilege-escalation attack paths. Maps to MITRE ATT&CK, with detection signals and remediation. Assumed-breach, authorized engagements only.Votes: 0GitHub stars: 2
- Api Secure DesignUse when designing, reviewing, or hardening an API for security — choosing authentication/authorization, adding rate limiting and quotas, validating input/schemas, managing secrets and TLS, configuring CORS, setting security headers, and logging. Provides a secure-by-design checklist and remediation guidance mapped to OWASP API Top 10 and OWASP ASVS. Defensive/blue-team companion to api-security-audit.Votes: 0GitHub stars: 2
- Api Security AuditUse when testing or auditing an API for security vulnerabilities — REST, GraphQL, gRPC, or WebSocket — including authentication/authorization, BOLA/IDOR, mass assignment, SSRF, rate limiting, and security misconfiguration. Maps findings to the OWASP API Security Top 10 (2023) and produces test steps, detection signals, and remediation for each. For authorized engagements only.Votes: 0GitHub stars: 2
- Cloud PentestUse when testing cloud environments (AWS, Azure, GCP) for security weaknesses — IAM misconfiguration and privilege escalation, exposed storage/secrets, public/misconfigured services, SSRF-to-metadata credential theft, serverless and container-service risks, logging gaps, and lateral movement across accounts/subscriptions/projects. Maps to MITRE ATT&CK Cloud and provider benchmarks. Authorized engagements only.Votes: 0GitHub stars: 2
- Container K8s PentestUse when testing container and Kubernetes security — image and registry weaknesses, insecure container configuration (privileged, host mounts, capabilities), container escape, Kubernetes RBAC and API-server exposure, secrets handling, network policy gaps, and pod-to-cluster privilege escalation. Maps to MITRE ATT&CK Containers and CIS benchmarks. Authorized engagements only.Votes: 0GitHub stars: 2
- Entra Cloud PentestUse when testing Microsoft Entra ID (Azure AD) and Microsoft 365 identity security — tenant/user enumeration, authentication attacks (password spray, MFA gaps, legacy auth), conditional-access bypass, OAuth/app-consent abuse, privileged-role and Graph API abuse, and hybrid AD-to-cloud (and cloud-to-AD) attack paths. Maps to MITRE ATT&CK, with detection and remediation. Authorized engagements only.Votes: 0GitHub stars: 2
- Llm App DefenseUse when designing or hardening an AI/LLM application against attacks — defending against prompt injection, insecure output handling, excessive agency/tool abuse, sensitive-data disclosure, and RAG poisoning. Provides defense-in-depth controls, least-privilege tool design, human-in-the-loop patterns, monitoring, and red-team CI, mapped to OWASP LLM Top 10 (2025), NIST AI RMF, and MITRE ATLAS. Defensive companion to llm-redteam.Votes: 0GitHub stars: 2
- Llm RedteamUse when red-teaming or security-testing an AI/LLM application — testing for prompt injection (direct and indirect), jailbreaks, system-prompt leakage, sensitive-data disclosure, insecure output handling, excessive agency/tool abuse, and RAG/vector weaknesses. Maps to the OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS, and defines a repeatable eval-harness approach. For authorized testing of systems you own or are cleared to assess.Votes: 0GitHub stars: 2
- Mobile PentestUse when testing an Android or iOS mobile application for security issues — insecure data storage, weak crypto, insecure communication, authentication, platform misuse, reverse engineering / tampering resistance, and hardcoded secrets. Follows OWASP MASTG/MASVS and covers static, dynamic, and network testing. Authorized engagements only.Votes: 0GitHub stars: 2
- Network Device PentestUse when testing network devices and appliances — routers, switches, firewalls, VPN concentrators, load balancers, wireless controllers, and management planes (Cisco, Juniper, Fortinet, Palo Alto, MikroTik, etc.). Covers management-interface exposure, default/weak credentials, insecure protocols, firmware/CVE exposure, SNMP, and configuration review. Authorized engagements only.Votes: 0GitHub stars: 2
- Network PentestUse when testing network infrastructure — external or internal — for security weaknesses: host/service discovery, vulnerability identification, common service misconfigurations (SMB, RDP, SSH, SNMP, LDAP, databases), network-level attacks (relay, poisoning), and pivoting. Follows PTES and NIST SP 800-115, mapped to MITRE ATT&CK, with detection and remediation. Authorized engagements only.Votes: 0GitHub stars: 2
- Post ExploitationUse after gaining access during an authorized engagement to demonstrate impact — situational awareness, credential access, lateral movement, and reaching objectives — while documenting the path. Covers methodology mapped to MITRE ATT&CK (Discovery, Credential Access, Lateral Movement, Collection, Exfiltration, Impact) with detection signals for the blue team. Authorized engagements only; prove and document rather than cause harm.Votes: 0GitHub stars: 2
- Privilege EscalationUse after gaining an initial foothold to escalate privileges on a Linux or Windows host — enumerating misconfigurations, weak permissions, sudo/SUID issues, service and scheduled-task abuse, credential harvesting, kernel/software vulns, and token/capability abuse. Maps to MITRE ATT&CK Privilege Escalation, with detection and remediation. Authorized engagements only.Votes: 0GitHub stars: 2
- Recon OsintUse at the start of any authorized red-team or pentest engagement to map the target's attack surface — passive OSINT (domains, subdomains, certs, DNS, ASN/IP ranges, leaked credentials, employees, tech stack) and active recon (port/service discovery, web asset enumeration). Produces a scoped attack-surface inventory feeding the domain-specific pentest skills. Authorized engagements only.Votes: 0GitHub stars: 2
- Red Team OpsUse to plan and run a full authorized red-team engagement end to end — scoping and rules of engagement, threat-actor emulation, the attack lifecycle (recon → initial access → execution → escalation → lateral movement → objectives), C2 concepts, deconfliction and safety, evidence handling, and executive + technical reporting. Maps the engagement to MITRE ATT&CK and orchestrates the other Gideon skills. Authorized engagements only.Votes: 0GitHub stars: 2
- Report WritingUse when writing up security findings and assessment reports — structuring each finding (title, description, impact, affected assets, severity/CVSS), building clear proof-of-concept sections with formatted HTTP request/response and highlighted payloads, step-by-step reproduction, and remediation/solution, then assembling the full executive + technical report. Works for black-box and gray-box engagements across web, API, mobile, cloud, network, AD/identity, and AI/LLM. The deliverable that mak...Votes: 0GitHub stars: 2
- Social EngineeringUse when planning or running an AUTHORIZED social-engineering assessment — phishing/spear-phishing simulations, vishing, pretext design, and security-awareness measurement — as part of a sanctioned engagement. Covers scoping, campaign design, safe execution, metrics, and awareness remediation. Strictly for authorized, consented programs; never for deceiving people outside an approved engagement.Votes: 0GitHub stars: 2
- Threat ModelUse when threat modeling a system — a web app, API, or AI/LLM application — to identify assets, trust boundaries, and threats before or during development. Guides STRIDE and PASTA analysis, attack trees, and data-flow diagrams, and produces a prioritized, ready-to-fill threat model with mitigations. Pairs with api-secure-design and llm-app-defense for remediation.Votes: 0GitHub stars: 2
- Vuln ChainingUse to move beyond isolated findings — combine low-severity primitives into high-impact exploit chains, reason about attack paths across domains (web+api+cloud+identity+network), correlate related weaknesses, and hunt for novel/logic vulnerabilities that scanners miss. Provides a primitive taxonomy, chaining and correlation methodology, and attack-path graphing to prioritize the fixes that break the most paths. Authorized engagements only.Votes: 0GitHub stars: 2
- Web App PentestUse when testing a web application for security vulnerabilities — authentication/session, access control (IDOR/privilege escalation), injection (SQLi, XSS, SSTI, command), SSRF, file upload, business logic, CSRF, and misconfiguration. Follows the OWASP Web Security Testing Guide (WSTG) and maps to the OWASP Top 10 (2021), with test steps, detection, and remediation. Authorized engagements only.Votes: 0GitHub stars: 2
- Wireless PentestUse when assessing Wi-Fi and wireless network security — WPA2/WPA3 personal and enterprise (802.1X/EAP), rogue/evil-twin access points, PMKID/handshake weaknesses, guest/segmentation issues, and management-network exposure over wireless. Covers authorized wireless assessment methodology, detection, and remediation. Authorized, on-site/scoped engagements only.Votes: 0GitHub stars: 2