Skip to content

Commit a14d10d

Browse files
SnailSploitSnailSploit
authored
Merge pull request #13 from SnailSploit/claude/improve-skills-depth-variety-pfs200
Add 20 new skills across 10 categories + deeply rewrite 4 thin skills
2 parents aeb41ec + 48c3ac2 commit a14d10d

28 files changed

Lines changed: 13786 additions & 791 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,38 @@ All notable changes to `claude-red` are documented here. The library follows a p
88

99
- Phase 1 — Internal AD/Windows split (16 skills)
1010
- Phase 2 — Cloud Identity / Hybrid (10 skills)
11-
- Phase 3 — Wireless split (12 skills) — **mandatory for v0.3.0**
1211
- Phase 4 — IoT split (10 skills)
1312
- Phase 5 — Web Basics (8 skills)
1413
- Phase 6 — Web Advanced (10 skills)
1514

15+
## [0.3.0] — 2025-08
16+
17+
### Added — 10 New Categories (20 skills)
18+
19+
- **container/** — `offensive-container-escape` (Docker/containerd/Podman breakout, runc CVEs, cgroup escape), `offensive-k8s-attacks` (RBAC abuse, etcd, kubelet API, pod escape, CRD exploitation)
20+
- **cicd/** — `offensive-cicd-pipeline` (GitHub Actions injection, Jenkins RCE, GitLab CI, Azure DevOps), `offensive-cicd-secrets` (env var extraction, vault misconfigs, OIDC federation, runner tokens)
21+
- **api/** — `offensive-api-security` (OWASP API Top 10, REST/gRPC/WebSocket), `offensive-api-abuse` (business logic, batching, JWT manipulation, webhook hijacking)
22+
- **crypto/** — `offensive-crypto-attacks` (padding oracle, ECB, hash extension, RSA, PRNG), `offensive-tls-attacks` (POODLE/DROWN/Heartbleed, pinning bypass, HSTS bypass, 0-RTT)
23+
- **privesc/** — `offensive-linux-privesc` (SUID, capabilities, sudo, cron, kernel exploits), `offensive-windows-privesc` (Potato family, service misconfigs, DLL hijacking, UAC bypass)
24+
- **post-exploitation/** — `offensive-lateral-movement` (PTH/PTT, NTLM relay, tunneling), `offensive-persistence` (registry, scheduled tasks, Golden/Silver tickets, PAM), `offensive-data-exfiltration` (DNS/HTTPS/ICMP tunneling, cloud dead drops, steganography)
25+
- **forensics/** — `offensive-anti-forensics` (log clearing, timestomping, ADS, anti-VM), `offensive-c2-frameworks` (Cobalt Strike, Sliver, Mythic, Havoc, redirectors)
26+
- **supply-chain/** — `offensive-supply-chain` (dependency confusion, typosquatting, build attacks), `offensive-dependency-confusion` (npm/PyPI/NuGet/Maven namespace attacks)
27+
- **social-engineering/** — `offensive-phishing` (GoPhish, EvilGinx2, MFA phishing), `offensive-social-engineering` (pretexting, vishing, smishing, physical SE, USB drops)
28+
- **network/** — `offensive-network-attacks` (ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, IPv6 attacks, MITM)
29+
30+
### Changed — Deep Rewrites (4 skills)
31+
32+
- `offensive-deserialization` — 183 to 600+ lines; added Java/PHP/.NET/Python/Node/Ruby exploitation depth, modern vectors (K8s, message queues, serverless), WAF bypass, tool commands
33+
- `offensive-graphql` — 207 to 567 lines; added introspection bypass, batching attacks, subscription abuse, file upload, DoS patterns, CrackQL/BatchQL tooling
34+
- `offensive-advanced-redteam` — 146 to 640 lines; added engagement planning, infrastructure setup, C2 tradecraft, OPSEC discipline, evasion techniques, reporting, engagement scenarios
35+
- `offensive-ssti` — 347 to 758 lines; added 10+ engine-specific exploits (Jinja2/Twig/Freemarker/Velocity/Pebble/Smarty/Mako/ERB/Thymeleaf), filter bypass, blind exploitation, chaining
36+
37+
### Changed — Documentation
38+
39+
- README updated with 10 new category sections, badge counts (58 to 78 skills, 13 to 23 categories), expanded roadmap
40+
- CHANGELOG updated with v0.3.0 section
41+
- `claude-skills.json` manifest regenerated
42+
1643
## [0.2.0] — 2025-05
1744

1845
### Added

‎README.md‎

Lines changed: 118 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
**Offensive security skills for Claude — drop-in `SKILL.md` files that turn Claude into a context-aware red team operator.**
88

99
[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
10-
[![Skills](https://img.shields.io/badge/skills-58-red.svg)](#skill-index)
11-
[![Categories](https://img.shields.io/badge/categories-13-orange.svg)](#categories)
10+
[![Skills](https://img.shields.io/badge/skills-78-red.svg)](#skill-index)
11+
[![Categories](https://img.shields.io/badge/categories-23-orange.svg)](#categories)
1212
[![Stars](https://img.shields.io/github/stars/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red)
1313
[![Forks](https://img.shields.io/github/forks/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red/network/members)
1414

@@ -35,6 +35,16 @@ Built by **[SnailSploit](https://snailsploit.com)** — GenAI Security Research.
3535
- [Exploit Development](#exploit-development)
3636
- [Fuzzing & Vulnerability Research](#fuzzing--vulnerability-research)
3737
- [Reconnaissance](#reconnaissance)
38+
- [API Security](#api-security)
39+
- [Container & Kubernetes](#container--kubernetes)
40+
- [CI/CD & Pipeline](#cicd--pipeline)
41+
- [Cryptography](#cryptography)
42+
- [Privilege Escalation](#privilege-escalation)
43+
- [Post-Exploitation](#post-exploitation)
44+
- [Forensics & C2](#forensics--c2)
45+
- [Supply Chain](#supply-chain)
46+
- [Social Engineering](#social-engineering)
47+
- [Network Attacks](#network-attacks)
3848
- [AI Security](#ai-security)
3949
- [Utility](#utility)
4050
- [Roadmap](#roadmap)
@@ -104,10 +114,20 @@ Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to
104114
| [Cloud](#cloud) | 1 | AWS / Azure / GCP attack paths *(expanding)* |
105115
| [Mobile](#mobile) | 1 | Android + iOS pentest *(expanding)* |
106116
| [IoT & Embedded](#iot--embedded) | 1 | Hardware, firmware, RTOS, ICS *(expanding)* |
107-
| [Infrastructure & Red Team](#infrastructure--red-team) | 7 | Initial access, EDR evasion, Windows ops |
117+
| [Infrastructure & Red Team](#infrastructure--red-team) | 7 | Initial access, EDR evasion, advanced red team ops, Windows internals |
108118
| [Exploit Development](#exploit-development) | 6 | Stack/heap, mitigations, crash analysis, TOCTOU |
109119
| [Fuzzing & VR](#fuzzing--vulnerability-research) | 4 | libFuzzer, AFL++, bug ID, vuln classes |
110120
| [Reconnaissance](#reconnaissance) | 2 | OSINT tooling and methodology |
121+
| [API Security](#api-security) | 2 | REST/gRPC/WebSocket testing, business logic abuse |
122+
| [Container & Kubernetes](#container--kubernetes) | 2 | Container escape, K8s cluster attacks |
123+
| [CI/CD & Pipeline](#cicd--pipeline) | 2 | Pipeline exploitation, secrets extraction |
124+
| [Cryptography](#cryptography) | 2 | Crypto implementation attacks, TLS/SSL |
125+
| [Privilege Escalation](#privilege-escalation) | 2 | Linux and Windows privesc |
126+
| [Post-Exploitation](#post-exploitation) | 3 | Lateral movement, persistence, data exfiltration |
127+
| [Forensics & C2](#forensics--c2) | 2 | Anti-forensics, C2 framework tradecraft |
128+
| [Supply Chain](#supply-chain) | 2 | Supply chain attacks, dependency confusion |
129+
| [Social Engineering](#social-engineering) | 2 | Phishing campaigns, physical/vishing/smishing |
130+
| [Network Attacks](#network-attacks) | 1 | Layer 2/3 attacks, MITM, poisoning |
111131
| [AI Security](#ai-security) | 1 | Prompt injection, jailbreaks, RAG poisoning |
112132
| [Utility](#utility) | 2 | Fast-checking, professional reporting |
113133

@@ -253,6 +273,96 @@ Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to
253273
| [`offensive-osint`](Skills/recon/offensive-osint/SKILL.md) | OSINT tools — recon-ng, theHarvester, Maltego pipelines |
254274
| [`offensive-osint-methodology`](Skills/recon/offensive-osint-methodology/SKILL.md) | OSINT methodology — structured intelligence collection |
255275

276+
### API Security
277+
278+
`Skills/api/`
279+
280+
| Skill | Description |
281+
|---|---|
282+
| [`offensive-api-security`](Skills/api/offensive-api-security/SKILL.md) | API testing — OWASP API Top 10, REST/gRPC/WebSocket, BOLA, BFLA, mass assignment |
283+
| [`offensive-api-abuse`](Skills/api/offensive-api-abuse/SKILL.md) | API business logic — chaining, batching, JWT manipulation, webhook hijacking |
284+
285+
### Container & Kubernetes
286+
287+
`Skills/container/`
288+
289+
| Skill | Description |
290+
|---|---|
291+
| [`offensive-container-escape`](Skills/container/offensive-container-escape/SKILL.md) | Container breakout — privileged escape, Docker socket, capabilities, cgroup, runc CVEs |
292+
| [`offensive-k8s-attacks`](Skills/container/offensive-k8s-attacks/SKILL.md) | Kubernetes — RBAC abuse, etcd access, kubelet API, pod escape, secrets, CRD exploitation |
293+
294+
### CI/CD & Pipeline
295+
296+
`Skills/cicd/`
297+
298+
| Skill | Description |
299+
|---|---|
300+
| [`offensive-cicd-pipeline`](Skills/cicd/offensive-cicd-pipeline/SKILL.md) | CI/CD exploitation — GitHub Actions injection, Jenkins RCE, GitLab CI, Azure DevOps |
301+
| [`offensive-cicd-secrets`](Skills/cicd/offensive-cicd-secrets/SKILL.md) | CI/CD secrets — env var extraction, vault misconfigs, OIDC federation, runner token abuse |
302+
303+
### Cryptography
304+
305+
`Skills/crypto/`
306+
307+
| Skill | Description |
308+
|---|---|
309+
| [`offensive-crypto-attacks`](Skills/crypto/offensive-crypto-attacks/SKILL.md) | Crypto attacks — padding oracle, ECB manipulation, hash extension, RSA, weak PRNG |
310+
| [`offensive-tls-attacks`](Skills/crypto/offensive-tls-attacks/SKILL.md) | TLS/SSL — POODLE, DROWN, Heartbleed, pinning bypass, HSTS bypass, 0-RTT replay |
311+
312+
### Privilege Escalation
313+
314+
`Skills/privesc/`
315+
316+
| Skill | Description |
317+
|---|---|
318+
| [`offensive-linux-privesc`](Skills/privesc/offensive-linux-privesc/SKILL.md) | Linux privesc — SUID, capabilities, sudo, cron, kernel exploits, Docker group |
319+
| [`offensive-windows-privesc`](Skills/privesc/offensive-windows-privesc/SKILL.md) | Windows privesc — Potato family, service misconfigs, DLL hijacking, UAC bypass, PrintNightmare |
320+
321+
### Post-Exploitation
322+
323+
`Skills/post-exploitation/`
324+
325+
| Skill | Description |
326+
|---|---|
327+
| [`offensive-lateral-movement`](Skills/post-exploitation/offensive-lateral-movement/SKILL.md) | Lateral movement — PTH, PTT, NTLM relay, WMI/WinRM/DCOM, tunneling (chisel, ligolo-ng) |
328+
| [`offensive-persistence`](Skills/post-exploitation/offensive-persistence/SKILL.md) | Persistence — registry, scheduled tasks, WMI subs, Golden/Silver tickets, PAM backdoors |
329+
| [`offensive-data-exfiltration`](Skills/post-exploitation/offensive-data-exfiltration/SKILL.md) | Data exfiltration — DNS/HTTPS/ICMP tunneling, cloud dead drops, steganography |
330+
331+
### Forensics & C2
332+
333+
`Skills/forensics/`
334+
335+
| Skill | Description |
336+
|---|---|
337+
| [`offensive-anti-forensics`](Skills/forensics/offensive-anti-forensics/SKILL.md) | Anti-forensics — log clearing, timestomping, ADS hiding, memory cleanup, anti-VM |
338+
| [`offensive-c2-frameworks`](Skills/forensics/offensive-c2-frameworks/SKILL.md) | C2 tradecraft — Cobalt Strike, Sliver, Mythic, Havoc, Metasploit, redirectors, domain fronting |
339+
340+
### Supply Chain
341+
342+
`Skills/supply-chain/`
343+
344+
| Skill | Description |
345+
|---|---|
346+
| [`offensive-supply-chain`](Skills/supply-chain/offensive-supply-chain/SKILL.md) | Supply chain — dependency confusion, typosquatting, build system attacks, image trojaning |
347+
| [`offensive-dependency-confusion`](Skills/supply-chain/offensive-dependency-confusion/SKILL.md) | Dependency confusion — npm/PyPI/NuGet/Maven/Go namespace attacks, safe PoC methodology |
348+
349+
### Social Engineering
350+
351+
`Skills/social-engineering/`
352+
353+
| Skill | Description |
354+
|---|---|
355+
| [`offensive-phishing`](Skills/social-engineering/offensive-phishing/SKILL.md) | Phishing — GoPhish, EvilGinx2, payload delivery, email auth bypass, MFA phishing |
356+
| [`offensive-social-engineering`](Skills/social-engineering/offensive-social-engineering/SKILL.md) | Social engineering — pretexting, vishing, smishing, physical SE, USB drops, watering holes |
357+
358+
### Network Attacks
359+
360+
`Skills/network/`
361+
362+
| Skill | Description |
363+
|---|---|
364+
| [`offensive-network-attacks`](Skills/network/offensive-network-attacks/SKILL.md) | Network L2/L3 — ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, IPv6 attacks, MITM |
365+
256366
### AI Security
257367

258368
`Skills/ai/`
@@ -280,13 +390,15 @@ The library is being expanded in seven phases. Track progress in [CHANGELOG.md](
280390
|---|---|---:|---|
281391
| 1 | Internal AD/Windows (rename `active-directory/` → `internal/`) | +16 | Planned |
282392
| 2 | Cloud Identity (Entra/AAD, ADFS, Okta, M365) | +10 | Planned |
283-
| 3 | Wireless split (WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz) | +12 | **Mandatory** |
393+
| 3 | Wireless split (WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz) | +12 | **Done** |
284394
| 4 | IoT split (UART/JTAG, flash, fault injection, RTOS, ICS) | +10 | Planned |
285395
| 5 | Web Basics (recon, auth bypass, access control, CSRF, headers, CORS, cache, clickjack) | +8 | Planned |
286396
| 6 | Web Advanced (proto pollution, SAML, OIDC, WebSocket, gRPC, postMessage, SSI/ESI, CSTI) | +10 | Planned |
287-
| 7 | Polish (README, LICENSE, manifest, install) | — | **In progress** |
397+
| 7 | Polish (README, LICENSE, manifest, install) | — | **Done** |
398+
| 8 | New categories (API, container, CI/CD, crypto, privesc, post-exploitation, forensics/C2, supply chain, social engineering, network) | +20 | **Done** |
399+
| 9 | Deep rewrites (deserialization, GraphQL, advanced red team, SSTI) | — | **Done** |
288400

289-
End state: ~107 skills across the same 13+ categories.
401+
End state: ~130 skills across 23+ categories.
290402

291403
---
292404

0 commit comments

Comments
 (0)