MINDMAP.md

claude-red — Library Mindmap

A visual map of every skill in the library, by category. Use it to navigate, to discover skills you didn't know existed, and to spot coverage gaps before an engagement.

References for completeness checking: MITRE ATT&CK, HackTricks, OWASP WSTG, PayloadsAllTheThings.

---

Library Map

mindmap
  root((claude-red))
    Web
      sqli
      xss
      ssrf
      ssti
      xxe
      idor
      file-upload
      rce
      deserialization
      race-condition
      request-smuggling
      open-redirect
      parameter-pollution
      graphql
      waf-bypass
      business-logic
    Auth
      jwt
      oauth
    Active-Directory
      active-directory
    Wireless
      wifi
      wifi-recon
      wpa2-psk
      wpa3-sae
      wpa-enterprise
      wps
      evil-twin
      krack-fragattacks
      deauth-disassoc
      bluetooth-ble
      bluetooth-classic
      zigbee-thread-matter
      z-wave
      lorawan-sub-ghz
    Cloud
      cloud
    Mobile
      mobile
    IoT
      iot
    Infrastructure
      initial-access
      advanced-redteam
      edr-evasion
      shellcode
      keylogger-arch
      windows-mitigations
      windows-boundaries
    Exploit-Dev
      exploit-development
      exploit-dev-course
      basic-exploitation
      crash-analysis
      mitigations
      toctou
    Fuzzing
      fuzzing
      fuzzing-course
      bug-identification
      vuln-classes
    Recon
      osint
      osint-methodology
    AI
      ai-security
    Utility
      fast-checking
      reporting

Loading

---

Coverage Cross-Reference

Use this table to confirm coverage of common offensive surfaces. If a row has no skill, it's a gap.

Web Application (OWASP WSTG)

Surface	Skill
Information gathering	recon/offensive-osint, recon/offensive-osint-methodology
Configuration / deployment	web/offensive-waf-bypass
Identity management	auth/offensive-jwt, auth/offensive-oauth
Authentication	(planned: web/auth-bypass)
Authorization	web/offensive-idor
Session management	auth/offensive-jwt, auth/offensive-oauth
Input validation	web/offensive-sqli, web/offensive-xss, web/offensive-xxe, web/offensive-ssti, web/offensive-ssrf
Error handling	(implicit across web skills)
Cryptography	(planned)
Business logic	web/offensive-business-logic
Client-side	web/offensive-xss, web/offensive-open-redirect
API testing	web/offensive-graphql

Internal Network / Active Directory (MITRE ATT&CK Enterprise)

Tactic	Skill
Reconnaissance	recon/offensive-osint, active-directory/offensive-active-directory
Initial Access	infrastructure/offensive-initial-access
Execution	infrastructure/offensive-advanced-redteam
Persistence	active-directory/offensive-active-directory
Privilege Escalation	active-directory/offensive-active-directory
Defense Evasion	infrastructure/offensive-edr-evasion, infrastructure/offensive-windows-mitigations, infrastructure/offensive-windows-boundaries
Credential Access	active-directory/offensive-active-directory
Discovery	recon/offensive-osint, active-directory/offensive-active-directory
Lateral Movement	active-directory/offensive-active-directory, infrastructure/offensive-advanced-redteam
Collection	infrastructure/offensive-advanced-redteam
Command and Control	infrastructure/offensive-advanced-redteam
Exfiltration	infrastructure/offensive-advanced-redteam
Impact	infrastructure/offensive-advanced-redteam

Wireless

Surface	Skill
Recon / war-driving	wireless/offensive-wifi-recon
WPA2-PSK	wireless/offensive-wifi
WPA3-SAE	wireless/offensive-wifi
WPA-Enterprise	wireless/offensive-wifi
WPS	wireless/offensive-wifi
Evil twin / KARMA / Mana	wireless/offensive-wifi
KRACK / FragAttacks	wireless/offensive-wifi
Bluetooth (BLE + Classic)	wireless/offensive-wifi
Zigbee / Thread / Matter	wireless/offensive-wifi
Z-Wave	wireless/offensive-wifi
LoRa / sub-GHz	wireless/offensive-wifi

Cloud

Provider / Surface	Skill
AWS — privesc, IMDS, persistence	cloud/offensive-cloud
Azure — privesc, IMDS, persistence	cloud/offensive-cloud
GCP — privesc, IMDS, persistence	cloud/offensive-cloud
Cross-cloud / OIDC trust	cloud/offensive-cloud
Hybrid identity (AAD Connect, ADFS)	(planned: cloud-identity/)

Mobile

Platform / Surface	Skill
Android static + dynamic	mobile/offensive-mobile
iOS static + dynamic	mobile/offensive-mobile
Firebase / cloud misconfig	mobile/offensive-mobile
Mobile API testing	mobile/offensive-mobile
Biometric / pinning bypass	mobile/offensive-mobile

IoT / Embedded

Layer	Skill
Hardware recon	iot/offensive-iot
UART / JTAG / SWD	iot/offensive-iot
Flash extraction	iot/offensive-iot
Firmware analysis	iot/offensive-iot
Bootloader / secure boot	iot/offensive-iot
RTOS exploitation	iot/offensive-iot
ICS / OT protocols	iot/offensive-iot
MQTT / CoAP	iot/offensive-iot

Exploit Development

Topic	Skill
Beginner / mitigations off	exploit-dev/offensive-basic-exploitation
Course curriculum	exploit-dev/offensive-exploit-dev-course
Stack / heap / ROP	exploit-dev/offensive-exploit-development
Modern mitigations	exploit-dev/offensive-mitigations
Crash triage	exploit-dev/offensive-crash-analysis
TOCTOU / race	exploit-dev/offensive-toctou, web/offensive-race-condition

Fuzzing & Vulnerability Research

Topic	Skill
Coverage-guided fuzzing	fuzzing/offensive-fuzzing
Fuzzing curriculum	fuzzing/offensive-fuzzing-course
Static review patterns	fuzzing/offensive-bug-identification
Vuln class taxonomy	fuzzing/offensive-vuln-classes

AI Security

Topic	Skill
Prompt injection / jailbreak / RAG	ai/offensive-ai-security

Utility

Topic	Skill
Fast triage checklist	utility/offensive-fast-checking
Pro pentest reporting	utility/offensive-reporting

---

How to Use the Mindmap

• Pre-engagement: Walk the relevant category branch and confirm a skill exists per surface in scope. Gaps you spot here are gaps in the engagement plan.
• During engagement: Click into the category for the surface you're testing; load only those skills into Claude.
• Post-engagement: Cross-check findings against the relevant Mindmap branches to ensure no surface was skipped.