All authors
Claude Skills by SnailSploit
github.com/SnailSploit79 skills1 installs305 views
- Offensive Active DirectoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trus...Votes: 0GitHub stars: 6,704
- Offensive Ai Security- **Skill Name**: ai-security - **Folder**: offensive-ai-security - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ai.mdVotes: 0GitHub stars: 6,704
- Offensive JwtJWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.Votes: 0GitHub stars: 6,704
- Offensive Oauth- **Skill Name**: oauth-attacks - **Folder**: offensive-oauth - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/oauth.mdVotes: 0GitHub stars: 6,704
- Offensive CloudCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, Event...Votes: 0GitHub stars: 6,704
- Offensive Basic Exploitation- **Skill Name**: basic-exploitation - **Folder**: offensive-basic-exploitation - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/5-basic-exploitation.mdVotes: 0GitHub stars: 6,704
- Offensive Crash Analysis- **Skill Name**: crash-analysis - **Folder**: offensive-crash-analysis - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/4-crash-analysis.mdVotes: 0GitHub stars: 6,704
- Offensive Exploit Dev Course- **Skill Name**: exploit-dev-curriculum - **Folder**: offensive-exploit-dev-course - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/course.mdVotes: 0GitHub stars: 6,704
- Offensive Exploit Development- **Skill Name**: exploit-development - **Folder**: offensive-exploit-development - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/development.mdVotes: 0GitHub stars: 6,704
- Offensive Mitigations- **Skill Name**: security-mitigations - **Folder**: offensive-mitigations - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/mitigations.mdVotes: 0GitHub stars: 6,704
- Offensive ToctouTime-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-...Votes: 0GitHub stars: 6,704
- Offensive Bug Identification- **Skill Name**: bug-identification - **Folder**: offensive-bug-identification - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/bug-identification.mdVotes: 0GitHub stars: 6,704
- Offensive Fuzzing Course- **Skill Name**: fuzzing-course - **Folder**: offensive-fuzzing-course - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/2-fuzzing.mdVotes: 0GitHub stars: 6,704
- Offensive FuzzingPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.Votes: 0GitHub stars: 6,704
- Offensive Vuln Classes- **Skill Name**: vulnerability-classes - **Folder**: offensive-vuln-classes - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/1-vulnerability-classes.mdVotes: 0GitHub stars: 6,704
- Offensive Advanced Redteam- **Skill Name**: advanced-redteam-ops - **Folder**: offensive-advanced-redteam - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/Advanced%20red-team%20operations%20for%20dummies.mdVotes: 0GitHub stars: 6,704
- Offensive Edr Evasion- **Skill Name**: edr-evasion - **Folder**: offensive-edr-evasion - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.mdVotes: 0GitHub stars: 6,704
- Offensive Initial Access- **Skill Name**: initial-access - **Folder**: offensive-initial-access - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/initial-access.mdVotes: 0GitHub stars: 6,704
- Offensive Keylogger Arch- **Skill Name**: keylogger-architecture - **Folder**: offensive-keylogger-arch - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/Low-level%20Keylogger%20architecture_.mdVotes: 0GitHub stars: 6,704
- Offensive ShellcodeShellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques.Votes: 0GitHub stars: 6,704
- Offensive Windows Boundaries- **Skill Name**: windows-boundaries - **Folder**: offensive-windows-boundaries - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/7-windows-boundaries.mdVotes: 0GitHub stars: 6,704
- Offensive Windows Mitigations- **Skill Name**: windows-mitigations - **Folder**: offensive-windows-mitigations - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/6-windows-mitigations.mdVotes: 0GitHub stars: 6,704
- Offensive IotIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protoc...Votes: 0GitHub stars: 6,704
- Offensive MobileMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL b...Votes: 0GitHub stars: 6,704
- Offensive Osint Methodology- **Skill Name**: osint-methodology - **Folder**: offensive-osint-methodology - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.mdVotes: 0GitHub stars: 6,704
- Offensive OsintComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tra...Votes: 0GitHub stars: 6,704
- Offensive Fast Checking- **Skill Name**: fast-checking - **Folder**: offensive-fast-checking - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/fast-checking.mdVotes: 0GitHub stars: 6,704
- Offensive ReportingPenetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, sc...Votes: 0GitHub stars: 6,704
- Offensive Business LogicBusiness logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surfa...Votes: 0GitHub stars: 6,704
- Offensive Deserialization- **Skill Name**: insecure-deserialization - **Folder**: offensive-deserialization - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/insecure-deserialization.mdVotes: 0GitHub stars: 6,704
- Offensive File Upload- **Skill Name**: file-upload - **Folder**: offensive-file-upload - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/file-upload.mdVotes: 0GitHub stars: 6,704
- Offensive Graphql- **Skill Name**: graphql-security - **Folder**: offensive-graphql - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/graphql.mdVotes: 0GitHub stars: 6,704
- Offensive Idor- **Skill Name**: idor - **Folder**: offensive-idor - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/idor.mdVotes: 0GitHub stars: 6,704
- Offensive Open Redirect- **Skill Name**: open-redirect - **Folder**: offensive-open-redirect - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/open-redirect.mdVotes: 0GitHub stars: 6,704
- Offensive Parameter Pollution- **Skill Name**: parameter-pollution - **Folder**: offensive-parameter-pollution - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.mdVotes: 0GitHub stars: 6,704
- Offensive Race Condition- **Skill Name**: race-condition - **Folder**: offensive-race-condition - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/race-condition.mdVotes: 0GitHub stars: 6,704
- Offensive Rce- **Skill Name**: rce - **Folder**: offensive-rce - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/rce.mdVotes: 0GitHub stars: 6,704
- Offensive Request Smuggling- **Skill Name**: request-smuggling - **Folder**: offensive-request-smuggling - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/req-smuggle.mdVotes: 0GitHub stars: 6,704
- Offensive SqliSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via ...Votes: 0GitHub stars: 6,704
- Offensive Ssrf- **Skill Name**: ssrf - **Folder**: offensive-ssrf - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ssrf.mdVotes: 0GitHub stars: 6,704
- Offensive Ssti- **Skill Name**: ssti - **Folder**: offensive-ssti - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/ssti.mdVotes: 0GitHub stars: 6,704
- Offensive Waf Bypass- **Skill Name**: waf-bypass - **Folder**: offensive-waf-bypass - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/waf-bypass.mdVotes: 0GitHub stars: 6,704
- Offensive Xss- **Skill Name**: xss - **Folder**: offensive-xss - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/xss.mdVotes: 0GitHub stars: 6,704
- Offensive Xxe- **Skill Name**: xxe - **Folder**: offensive-xxe - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/xxe.mdVotes: 0GitHub stars: 6,704
- Offensive Bluetooth BleBluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, ...Votes: 0GitHub stars: 6,704
- Offensive Bluetooth ClassicBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio ac...Votes: 0GitHub stars: 6,704
- Offensive Deauth DisassocDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.Votes: 0GitHub stars: 6,704
- Offensive Evil TwinEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept th...Votes: 0GitHub stars: 6,704
- Offensive Krack FragattacksKRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.Votes: 0GitHub stars: 6,704
- Offensive Lorawan Sub GhzLoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tr...Votes: 0GitHub stars: 6,704