All authors
Claude Skills by ShulkwiSEC
github.com/ShulkwiSEC331 skills4 installs834 views
- Recon For SecEntry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.Votes: 0GitHub stars: 22
- RemediateGenerates specific, implementable fixes for every finding in findings.json. Produces code patches (unified diff), configuration changes, dependency updates, and IaC fixes — not generic advice but actual before/after code. Uses the reproduction command from each finding as the verification step: "run this after the fix — it should now fail." Stores remediation data in findings.json so the dashboard shows a Fix button and /gh-export includes the remediation in GitHub issues. Chains from /pent...Votes: 0GitHub stars: 22
- Remote Hunting WorkflowSet up 3 remote control modes for Claude Code CLI — local iTerm pair hacking, Discord bot for mobile control, and tmux multi-pane multi-target workflows. Includes dangerouslySkipPermissions security hardening. Based on Critical Thinking Bug Bounty Podcast Episode 166.Votes: 0GitHub stars: 22
- ReportGenerate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.Votes: 0GitHub stars: 22
- Request CvesGenerates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.Votes: 0GitHub stars: 22
- Reverse Shell TechniquesReverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY upgrades, file transfer methods, PowerShell shells, and Windows payload generation.Votes: 0GitHub stars: 22
- Reverse ShellReverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.Votes: 0GitHub stars: 22
- Rogue Access Point Evil TwinDeploy an Evil Twin (Rogue Access Point) to clone a legitimate Wi-Fi network's SSID and MAC address. By combining this with targeted deauthentication attacks, an attacker aggressively forces nearby victims to silently connect to the malicious AP, enabling pervasive Man-in-the-Middle (MitM), captive portal phishing, and credentials interception.Votes: 0GitHub stars: 22
- Rsa Attack TechniquesRSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.Votes: 0GitHub stars: 22
- Saml Sso Assertion AttacksSAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.Votes: 0GitHub stars: 22
- Sandbox Escape TechniquesSandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.Votes: 0GitHub stars: 22
- Self Hosted Runner PoisoningUse when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow ...Votes: 0GitHub stars: 22
- Semgrep Custom Rule WritingWrite custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.Votes: 0GitHub stars: 22
- Server Side Template InjectionIdentify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).Votes: 0GitHub stars: 22
- Session FixationDetect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze token randomness via Burp Sequencer. Test JSESSIONID, ASP.NET Forms Auth cookies. Tools: OWASP ZAP, Burp Suite Repeater/Sequencer, JHijack.Votes: 0GitHub stars: 22
- Session Search ToolBuild a custom session search tool that indexes and queries past Claude Code CLI chat logs to retrieve historical findings, techniques, and context. Based on Critical Thinking Bug Bounty Podcast Episode 166.Votes: 0GitHub stars: 22
- Shodan DorkingUtilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).Votes: 0GitHub stars: 22
- Smart Contract VulnerabilitiesSmart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.Votes: 0GitHub stars: 22
- Smtp Open Relay AbuseIdentify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.Votes: 0GitHub stars: 22
- Spring Boot Actuator AbuseIdentify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.Votes: 0GitHub stars: 22
- Sql InjectionSQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.Votes: 0GitHub stars: 22
- Sqli Manual And AutomatedDetect and exploit SQL injection vulnerabilities using both manual techniques and automated tools. Use this skill when testing web applications for database injection flaws including UNION-based, error-based, blind boolean, blind time-based, and out-of-band SQL injection. Covers WAF bypass, second-order SQLi, authentication bypass, and full database extraction with sqlmap.Votes: 0GitHub stars: 22
- Sqli Sql InjectionSQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.Votes: 0GitHub stars: 22
- Ssl Tls AuditTLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certific...Votes: 0GitHub stars: 22
- Ssrf Aws Metadata AbuseExploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS to access the highly sensitive Instance Metadata Service (IMDS). This allows an attacker to steal valid IAM roles and temporary security credentials, leading to catastrophic cloud account compromise.Votes: 0GitHub stars: 22
- Ssrf Nextjs Server ActionsIdentify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.Votes: 0GitHub stars: 22
- Ssrf Server Side Request ForgerySSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.Votes: 0GitHub stars: 22
- SsrfServer-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Bu...Votes: 0GitHub stars: 22
- Ssti Server Side Template InjectionSSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.Votes: 0GitHub stars: 22
- SstiServer-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions `{{7*7}}` returning `49`, or `${7*7}`, `<%= 7*7 %>`. Leads to full RCE via template sandbox escape, Python `__class__.__mro__` traversal, and Java reflection chains. Tools: tplmap, Burp Suite.Votes: 0GitHub stars: 22
- Stack Overflow And RopStack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.Votes: 0GitHub stars: 22
- Steganography TechniquesSteganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.Votes: 0GitHub stars: 22
- Subdomain TakeoverSubdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.Votes: 0GitHub stars: 22
- Symbolic Execution ToolsSymbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis with angr, Z3, or Unicorn Engine.Votes: 0GitHub stars: 22
- Symmetric Cipher AttacksSymmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reuse, or meet-in-the-middle attacks.Votes: 0GitHub stars: 22
- Sysmon Process Creation AnalysisAnalyze Sysmon Event ID 1 (Process Creation) logs to identify malicious executions, living-off-the-land binaries (LOLBins), command-line obfuscation, and suspicious parent-child process relationships.Votes: 0GitHub stars: 22
- Threat ModelingStructured threat modeling skill using the PASTA framework (Process for Attack Simulation and Threat Analysis) combined with Adam Shostack's 4-question framework. Use this skill whenever the user asks to do threat modeling, security analysis, map the attack surface, identify threats, or review an application for security risks — even if they don't mention PASTA or a specific framework by name. Core activities: Component Mapping (architecture + data flows), Critical Assessment (business impac...Votes: 0GitHub stars: 22
- Traffic Analysis PcapTraffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.Votes: 0GitHub stars: 22
- Tunneling And PivotingTunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTTP tunneling, ProxyChains, and multi-layer pivoting strategies.Votes: 0GitHub stars: 22
- Type JugglingPHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.Votes: 0GitHub stars: 22
- Unauthorized Access Common ServicesUnauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interfaces are exposed without authentication.Votes: 0GitHub stars: 22
- Upload Insecure FilesInsecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.Votes: 0GitHub stars: 22
- Vlan Hopping And Trunkingexploit misconfigured network switches to jump from a low-privilege VLAN (e.g., Guest Network) into a restricted VLAN (e.g., Corporate or Management Network). Use this skill during internal network penetration tests when physical access is achieved or when assessing network segmentation and zero-trust architectures. Covers Switch Spoofing (DTP) and Double Tagging (802.1Q).Votes: 0GitHub stars: 22
- Vlan Hopping AttacksExecute VLAN Hopping attacks to bypass Layer 2 network segmentation constraints. Exploit misconfigured switch ports utilizing Switch Spoofing natively via Dynamic Trunking Protocol (DTP) and specifically Double Tagging (802.1Q) inherently to unconditionally access isolated networks natively.Votes: 0GitHub stars: 22
- Vm And Bytecode ReverseCustom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, dispatcher loops, or maze-style challenges.Votes: 0GitHub stars: 22
- Volatility Memory ForensicsAnalyze full RAM captures (memory dumps) to extract forensic artifacts, detect stealthy malware, recover injected shellcode, and identify rootkits that bypass traditional disk-based antivirus scanning. Use this skill during Incident Response and advanced threat hunting engagements to identify what was actively running on a compromised system at a specific point in time.Votes: 0GitHub stars: 22
- Web Application Recon And EnumerationPerform comprehensive web application reconnaissance and enumeration including subdomain discovery, directory bruteforcing, technology fingerprinting, port scanning, and content discovery. Use this skill as the first step in any bug bounty or web penetration test to map the target's attack surface before exploitation. Covers passive and active recon, JavaScript analysis, and API endpoint enumeration.Votes: 0GitHub stars: 22
- Web Cache DeceptionWeb cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.Votes: 0GitHub stars: 22
- Web Cache Poisoning DeceptionIdentify and exploit Web Cache Poisoning vulnerabilities by manipulating unkeyed inputs (HTTP headers, hostnames) to force a caching server (CDN or reverse proxy) to save a malicious response and serve it to all subsequent users requesting the same legitimate URL.Votes: 0GitHub stars: 22
- Web Cache PoisoningComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22