Claude Skills by pashki975

Methodology for TryHackMe packet-capture / traffic-analysis rooms. Use when the room hands you a .pcap/.pcapng (or a Wireshark/tshark task), when the goal is to reconstruct what happened on the wire, or when asked "what next" on a capture. Guides the load → overview → follow-the-story → extract flow, distinct from the box-owning recon→foothold→privesc arc. The /pcap command supplies the tshark mechanics; this skill supplies how to think about a capture.

Standard operating procedure for solving a TryHackMe box. Use when starting a new room, when the user asks "what next", or when stuck and needing a methodical next step. Guides the recon → enum → foothold → privesc → loot flow and enforces scope discipline.

The core decision loop for driving any TryHackMe room. Use at the START of every room, whenever the user asks "what next", and whenever progress stalls. Teaches classify -> observe -> hypothesize -> test -> decide, so the approach is chosen from what the room is actually teaching rather than defaulting to port-scan-then-privesc. This is the thinking layer above the methodology and command skills.

Standard operating procedure for solving Windows and Active Directory TryHackMe boxes. Use when the target is Windows/domain-joined (SMB/LDAP/Kerberos/WinRM ports open, or the room mentions AD/domain), when asked "what next" on a Windows room, or when a Linux-oriented approach isn't fitting. Guides the recon → AD enum → foothold → Kerberos → privesc → domain flow.