Claude Skills by SnailSploit

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trus...

- **Skill Name**: ai-security - **Folder**: offensive-ai-security - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ai.md

JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.

- **Skill Name**: oauth-attacks - **Folder**: offensive-oauth - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/oauth.md

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, Event...

- **Skill Name**: basic-exploitation - **Folder**: offensive-basic-exploitation - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/5-basic-exploitation.md

- **Skill Name**: crash-analysis - **Folder**: offensive-crash-analysis - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/4-crash-analysis.md

- **Skill Name**: exploit-dev-curriculum - **Folder**: offensive-exploit-dev-course - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/course.md

- **Skill Name**: exploit-development - **Folder**: offensive-exploit-development - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/development.md

- **Skill Name**: security-mitigations - **Folder**: offensive-mitigations - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/mitigations.md

Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-...

- **Skill Name**: bug-identification - **Folder**: offensive-bug-identification - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/bug-identification.md

- **Skill Name**: fuzzing-course - **Folder**: offensive-fuzzing-course - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/2-fuzzing.md

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.

- **Skill Name**: vulnerability-classes - **Folder**: offensive-vuln-classes - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/1-vulnerability-classes.md

- **Skill Name**: advanced-redteam-ops - **Folder**: offensive-advanced-redteam - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/Advanced%20red-team%20operations%20for%20dummies.md

- **Skill Name**: edr-evasion - **Folder**: offensive-edr-evasion - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.md

- **Skill Name**: initial-access - **Folder**: offensive-initial-access - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/initial-access.md

- **Skill Name**: keylogger-architecture - **Folder**: offensive-keylogger-arch - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/Low-level%20Keylogger%20architecture_.md

Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques.

- **Skill Name**: windows-boundaries - **Folder**: offensive-windows-boundaries - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/7-windows-boundaries.md

- **Skill Name**: windows-mitigations - **Folder**: offensive-windows-mitigations - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/6-windows-mitigations.md

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protoc...

Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL b...

- **Skill Name**: osint-methodology - **Folder**: offensive-osint-methodology - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.md

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tra...

- **Skill Name**: fast-checking - **Folder**: offensive-fast-checking - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/fast-checking.md

Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, sc...

Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surfa...

- **Skill Name**: insecure-deserialization - **Folder**: offensive-deserialization - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/insecure-deserialization.md

- **Skill Name**: file-upload - **Folder**: offensive-file-upload - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/file-upload.md

- **Skill Name**: graphql-security - **Folder**: offensive-graphql - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/graphql.md

- **Skill Name**: idor - **Folder**: offensive-idor - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/idor.md

- **Skill Name**: open-redirect - **Folder**: offensive-open-redirect - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/open-redirect.md

- **Skill Name**: parameter-pollution - **Folder**: offensive-parameter-pollution - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.md

- **Skill Name**: race-condition - **Folder**: offensive-race-condition - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/race-condition.md

- **Skill Name**: rce - **Folder**: offensive-rce - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/rce.md

- **Skill Name**: request-smuggling - **Folder**: offensive-request-smuggling - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/req-smuggle.md

SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via ...

- **Skill Name**: ssrf - **Folder**: offensive-ssrf - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ssrf.md

- **Skill Name**: ssti - **Folder**: offensive-ssti - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ssti.md

- **Skill Name**: waf-bypass - **Folder**: offensive-waf-bypass - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/waf-bypass.md

- **Skill Name**: xss - **Folder**: offensive-xss - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/xss.md

- **Skill Name**: xxe - **Folder**: offensive-xxe - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/xxe.md

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, ...

Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio ac...

Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.

Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept th...

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tr...