Claude Skills by nuroctane

Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands,

Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM

Detect process injection techniques (T1055) - including DLL injection, process

Detect abuse of elevation control mechanisms (T1548), including Windows UAC

'Detects typosquatting attacks in npm and PyPI package registries by

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated ("slopsquatting") dependency list, or when auditing a lockfile diff for a swapped package.

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon

Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped

Run CloudFox's read-only Describe/List/Get enumeration (all-checks,

Systematically map and remove malware, backdoors, and attacker persistence

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for def...

'Evaluates and selects Threat Intelligence Platform (TIP) products based

'Executes authorized attack simulations against Active Directory environments

Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting ...

'Executes authorized phishing simulation campaigns to assess an organization''s

Build the foundational red team engagement plan - scope definition, Rules

'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s

Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1

BloodHound is a graph-based Active Directory reconnaissance tool that

Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.

Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, or assessing API input validation.

Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence/backdooring modules like iam__backdoor_users_keys. Use for authorized AWS penetration tests or red-team engagements, assessing blast radius from a compromised IAM credential, or generating attacker telemetry for purple-team detection testing.

'Analyzes and simulates BGP hijacking scenarios in authorized lab environments

Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering. Use when testing whether low-privilege users can invoke admin API functions or otherwise escalate privileges via function-level access control gaps.

Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, and checking DNS/CNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.

Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.

'Tests and exploits deep link (URL scheme and App Link) vulnerabilities

Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.

Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.

Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.

'Identifies and exploits insecure local data storage vulnerabilities

Identifying and exploiting insecure deserialization vulnerabilities in

'Identifies and exploits IPv6-specific vulnerabilities including SLAAC

Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.

Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.

Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding.

Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.

Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278

Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB,

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations

Detects and exploits JavaScript prototype pollution vulnerabilities

Detects and exploits race condition (TOCTOU) vulnerabilities in web

Identifying and exploiting SSRF vulnerabilities to access internal services,

'Identifies and exploits SMB protocol vulnerabilities using Metasploit

'Identifies and exploits SQL injection vulnerabilities in web applications

Detecting and exploiting SQL injection vulnerabilities using sqlmap to

Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities

Exploits PHP type juggling vulnerabilities caused by loose (==) comparison

Uses the Metasploit Framework (msfconsole and its exploit, auxiliary,

Testing WebSocket implementations for authentication bypass, cross-site