Claude Skills by ShulkwiSEC

Deep web exploitation beyond initial scanning. Covers SQLi (blind, OOB, second-order), NoSQL injection (MongoDB, operator bypass), GraphQL injection (introspection, batching, mutation abuse), XSS (reflected/stored/DOM with full source-sink analysis), SSTI (Jinja2/Twig/Freemarker/ERB engine identification and RCE), SSRF chains, file upload bypass (polyglot creation), XXE (blind, DOCX/SVG injection, Content-Type switching), deserialization (Java/PHP/Python/.NET), command injection, path travers...

Identify web server type/version, framework, and application entry points via banner grabbing, HTTP header analysis (Server, X-Powered-By, X-Generator), cookie names (CAKEPHP, laravel_session, wp-settings), HTML meta generators, robots.txt, source map files (.map), JS hardcoded secrets, and Google dorking (site:, inurl:, filetype:, intitle:) with tools Nikto, WhatWeb, Wappalyzer, Nmap, Shodan, Burp Suite, OWASP ZAP, Waybackurls.

Identify and exploit vulnerabilities within WebSocket communications, including Cross-Site WebSocket Hijacking (CSWSH), unauthenticated message spoofing, and data manipulation. Use this skill when auditing real-time applications such as trading platforms, live chat applications, or collaborative dashboards.

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Conduct comprehensive penetration testing against Wireless Networks (802.11). Use this skill when assessing the physical/wireless perimeter of an organization. Covers monitor mode, packet injection, WPA/WPA2 PSK cracking via 4-way handshakes and PMKID, WPA Enterprise (802.1x) evil twin attacks, WPS PIN bruteforcing, and rogue access point deployment.

AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.

Conduct comprehensive forensic analysis of Windows Event Logs (.evtx) to trace attacker activity including lateral movement, privilege escalation, credential dumping, persistence mechanisms, and remote code execution. Use this skill during incident response, threat hunting, or post-breach forensic investigations on Windows systems and Active Directory environments.

Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

Analyze Windows prefetch files (.pf) to determine evidence of program execution. This skill details how to extract execution times, run counts, and the paths of files accessed by a program, which is critical for incident response and malware timeline reconstruction.

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

Analyze the Windows Registry to uncover malicious persistence mechanisms. This skill details how to investigate Run keys, Services, Scheduled Tasks registry keys, and Image File Execution Options (IFEO) to locate hidden backdoors.

Conduct expert-level incident response analysis of the Windows Registry structure (SAM, SYSTEM, SOFTWARE, NTUSER.DAT). Extract pivotal artifacts detailing threat actor execution (ShimCache, Amcache, UserAssist), persistence mechanisms (RunKeys), and lateral movement activities (RDP connections, mapped drives).

Execute advanced Privilege Escalation on Windows operating systems utilizing Access Token Impersonation. Use this skill (often via Potato exploits or Metasploit/Incognito) when compromising services running as Local Service or Network Service to escalate to the highest privilege level: NT AUTHORITY\SYSTEM.

[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.

[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.

Establish highly stealthy, fileless persistence on compromised Windows systems using WMI (Windows Management Instrumentation) Event Subscriptions. Create malicious Event Filters, Event Consumers, and FilterToConsumer Bindings to execute payloads (reverse shells, beacons, keyloggers) triggered by system events — startup, user logon, process creation, or time intervals. This persistence survives reboots and evades Autoruns, file-based AV, and standard EDR sweeps.

Utilize Windows Management Instrumentation (WMI) to execute malicious payloads, establish lateral movement, and execute commands stealthily across an Active Directory environment without dropping binaries to disk or relying on traditional Service Creation (PsExec) mechanics.

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.

XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.

Detect and exploit Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based variants. Use this skill when testing web applications for JavaScript injection, HTML injection, input sanitization bypass, or Content Security Policy evasion. Covers WAF bypass payloads, mutation XSS, blind XSS with out-of-band callbacks, and exploitation chains for session hijacking and account takeover.

Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting `<script>alert(1)</script>`, event handlers like `onfocus`, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE), Hackvertor, XSS-Proxy, ratproxy.

Stored XSS (persistent XSS) occurs when attacker-supplied input is saved server-side and later rendered unencoded to other users. Common injection points include profile fields, comments, forum posts, file upload filenames, and application logs. Detect via PHP `$_GET/$_POST/$_REQUEST/$_FILES`, ASP `Request.Form`, JSP `request.getParameter`, and BeEF hook injection. Tools: Burp Suite, OWASP ZAP, BeEF, PHP Charset Encoder, Hackvertor.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Exploit XML External Entity (XXE) vulnerabilities in web applications to read arbitrary files, perform SSRF, or execute denial of service attacks. Use this skill when the server parses XML input from the user (such as SAML, SOAP, DOCX, or direct XML payloads).

XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.

XML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (`file:///etc/passwd`), SSRF via `http://` entities, and DoS via Billion Laughs. Vulnerable Java APIs include `DocumentBuilder`, `SAXParser`, `dom4j`, `TransformerFactory`, `SAXReader`, `XMLInputFactory`, Xerces. Detect by injecting `<!DOCTYPE>` DTD with `SYSTEM` entity references. Tools: Burp Suite, wfuzz XML fuzz strings.

Develop and deploy advanced YARA rules, the industry standard "pattern-matching swiss army knife" for malware researchers. Use this skill to identify, classify, and hunt for specific malicious binaries (APT implants, ransomware) across enterprise networks, memory dumps, and VirusTotal based on hexadecimal signatures, API imports, and behavioral strings.

Write custom YARA rules to identify and classify malware based on textual and binary patterns. This skill focuses on creating robust signatures using strings, regular expressions, and hexadecimal opcodes extracted during malware analysis for enterprise threat hunting.

Analyze Zeek (formerly Bro) `conn.log` files to hunt for malicious network behaviors, including C2 beaconing, long-lived anomalous connections, and data exfiltration patterns.

Systematic zero-day vulnerability research in source code and compiled binaries. Find bugs that scanners and AI training data have never seen. Based on Critical Thinking Bug Bounty Podcast Episode 166 and Eugene's methodology.

Exploit the critical ZeroLogon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol (MS-NRPC) to instantly obtain Domain Administrator privileges on a Windows Active Directory domain by resetting the machine account password of the Primary Domain Controller (PDC) to an empty string.