All authors
Claude Skills by ShulkwiSEC
github.com/ShulkwiSEC331 skills4 installs834 views
- Web ExploitDeep web exploitation beyond initial scanning. Covers SQLi (blind, OOB, second-order), NoSQL injection (MongoDB, operator bypass), GraphQL injection (introspection, batching, mutation abuse), XSS (reflected/stored/DOM with full source-sink analysis), SSTI (Jinja2/Twig/Freemarker/ERB engine identification and RCE), SSRF chains, file upload bypass (polyglot creation), XXE (blind, DOCX/SVG injection, Content-Type switching), deserialization (Java/PHP/Python/.NET), command injection, path travers...Votes: 0GitHub stars: 22
- Web FingerprintingIdentify web server type/version, framework, and application entry points via banner grabbing, HTTP header analysis (Server, X-Powered-By, X-Generator), cookie names (CAKEPHP, laravel_session, wp-settings), HTML meta generators, robots.txt, source map files (.map), JS hardcoded secrets, and Google dorking (site:, inurl:, filetype:, intitle:) with tools Nikto, WhatWeb, Wappalyzer, Nmap, Shodan, Burp Suite, OWASP ZAP, Waybackurls.Votes: 0GitHub stars: 22
- Websocket Hijacking TestingIdentify and exploit vulnerabilities within WebSocket communications, including Cross-Site WebSocket Hijacking (CSWSH), unauthenticated message spoofing, and data manipulation. Use this skill when auditing real-time applications such as trading platforms, live chat applications, or collaborative dashboards.Votes: 0GitHub stars: 22
- Websocket SecurityWebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.Votes: 0GitHub stars: 22
- WebsocketsComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Wifi Penetration TestingConduct comprehensive penetration testing against Wireless Networks (802.11). Use this skill when assessing the physical/wireless perimeter of an organization. Covers monitor mode, packet injection, WPA/WPA2 PSK cracking via 4-way handshakes and PMKID, WPA Enterprise (802.1x) evil twin attacks, WPS PIN bruteforcing, and rogue access point deployment.Votes: 0GitHub stars: 22
- Windows Av EvasionAV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.Votes: 0GitHub stars: 22
- Windows Event Logs AnalysisConduct comprehensive forensic analysis of Windows Event Logs (.evtx) to trace attacker activity including lateral movement, privilege escalation, credential dumping, persistence mechanisms, and remote code execution. Use this skill during incident response, threat hunting, or post-breach forensic investigations on Windows systems and Active Directory environments.Votes: 0GitHub stars: 22
- Windows Lateral MovementWindows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.Votes: 0GitHub stars: 22
- Windows Prefetch AnalysisAnalyze Windows prefetch files (.pf) to determine evidence of program execution. This skill details how to extract execution times, run counts, and the paths of files accessed by a program, which is critical for incident response and malware timeline reconstruction.Votes: 0GitHub stars: 22
- Windows Privilege EscalationWindows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.Votes: 0GitHub stars: 22
- Windows Registry Autorun ForensicsAnalyze the Windows Registry to uncover malicious persistence mechanisms. This skill details how to investigate Run keys, Services, Scheduled Tasks registry keys, and Image File Execution Options (IFEO) to locate hidden backdoors.Votes: 0GitHub stars: 22
- Windows Registry ForensicsConduct expert-level incident response analysis of the Windows Registry structure (SAM, SYSTEM, SOFTWARE, NTUSER.DAT). Extract pivotal artifacts detailing threat actor execution (ShimCache, Amcache, UserAssist), persistence mechanisms (RunKeys), and lateral movement activities (RDP connections, mapped drives).Votes: 0GitHub stars: 22
- Windows Token ImpersonationExecute advanced Privilege Escalation on Windows operating systems utilizing Access Token Impersonation. Use this skill (often via Potato exploits or Metasploit/Incognito) when compromising services running as Local Service or Network Service to escalate to the highest privilege level: NT AUTHORITY\SYSTEM.Votes: 0GitHub stars: 22
- Wmi Event Subscription Persistence[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.Votes: 0GitHub stars: 22
- Wmi Event Subscription[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.Votes: 0GitHub stars: 22
- Wmi Event SubscriptionsEstablish highly stealthy, fileless persistence on compromised Windows systems using WMI (Windows Management Instrumentation) Event Subscriptions. Create malicious Event Filters, Event Consumers, and FilterToConsumer Bindings to execute payloads (reverse shells, beacons, keyloggers) triggered by system events — startup, user logon, process creation, or time intervals. This persistence survives reboots and evades Autoruns, file-based AV, and standard EDR sweeps.Votes: 0GitHub stars: 22
- Wmi ExecutionUtilize Windows Management Instrumentation (WMI) to execute malicious payloads, establish lateral movement, and execute commands stealthily across an Active Directory environment without dropping binaries to disk or relying on traditional Service Creation (PsExec) mechanics.Votes: 0GitHub stars: 22
- Xslt InjectionXSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.Votes: 0GitHub stars: 22
- Xss Cross Site ScriptingXSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.Votes: 0GitHub stars: 22
- Xss Reflected Stored DomDetect and exploit Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based variants. Use this skill when testing web applications for JavaScript injection, HTML injection, input sanitization bypass, or Content Security Policy evasion. Covers WAF bypass payloads, mutation XSS, blind XSS with out-of-band callbacks, and exploitation chains for session hijacking and account takeover.Votes: 0GitHub stars: 22
- Xss ReflectedReflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting `<script>alert(1)</script>`, event handlers like `onfocus`, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE), Hackvertor, XSS-Proxy, ratproxy.Votes: 0GitHub stars: 22
- Xss StoredStored XSS (persistent XSS) occurs when attacker-supplied input is saved server-side and later rendered unencoded to other users. Common injection points include profile fields, comments, forum posts, file upload filenames, and application logs. Detect via PHP `$_GET/$_POST/$_REQUEST/$_FILES`, ASP `Request.Form`, JSP `request.getParameter`, and BeEF hook injection. Tools: Burp Suite, OWASP ZAP, BeEF, PHP Charset Encoder, Hackvertor.Votes: 0GitHub stars: 22
- XssComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Xxe Xml External Entity InjectionExploit XML External Entity (XXE) vulnerabilities in web applications to read arbitrary files, perform SSRF, or execute denial of service attacks. Use this skill when the server parses XML input from the user (such as SAML, SOAP, DOCX, or direct XML payloads).Votes: 0GitHub stars: 22
- Xxe Xml External EntityXXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.Votes: 0GitHub stars: 22
- XxeXML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (`file:///etc/passwd`), SSRF via `http://` entities, and DoS via Billion Laughs. Vulnerable Java APIs include `DocumentBuilder`, `SAXParser`, `dom4j`, `TransformerFactory`, `SAXReader`, `XMLInputFactory`, Xerces. Detect by injecting `<!DOCTYPE>` DTD with `SYSTEM` entity references. Tools: Burp Suite, wfuzz XML fuzz strings.Votes: 0GitHub stars: 22
- Yara Rule DevelopmentDevelop and deploy advanced YARA rules, the industry standard "pattern-matching swiss army knife" for malware researchers. Use this skill to identify, classify, and hunt for specific malicious binaries (APT implants, ransomware) across enterprise networks, memory dumps, and VirusTotal based on hexadecimal signatures, API imports, and behavioral strings.Votes: 0GitHub stars: 22
- Yara Rule Writing MalwareWrite custom YARA rules to identify and classify malware based on textual and binary patterns. This skill focuses on creating robust signatures using strings, regular expressions, and hexadecimal opcodes extracted during malware analysis for enterprise threat hunting.Votes: 0GitHub stars: 22
- Zeek Conn Log AnalysisAnalyze Zeek (formerly Bro) `conn.log` files to hunt for malicious network behaviors, including C2 beaconing, long-lived anomalous connections, and data exfiltration patterns.Votes: 0GitHub stars: 22
- Zero Logon ExploitationExploit the critical ZeroLogon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol (MS-NRPC) to instantly obtain Domain Administrator privileges on a Windows Active Directory domain by resetting the machine account password of the Primary Domain Controller (PDC) to an empty string.Votes: 0GitHub stars: 22