#exploit-development
25 resources
Results
- active-directory-attack
- Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position) - Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery - Coerc
- ai-agent-redteam
Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning.
- cicd-supply-chain
CI/CD Pipeline Poisoning & Supply-Chain Attacks
- crypto-analysis
- Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws) - Reviewing crypto implementations in source code or captured traffic - Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene) - Recov
- exploit-development
End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations.
- malware-analysis
- Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
- mobile-pentest
- Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance - Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks) - Bypass root/jailbreak or
- network-attack
- Internal network pentest from an unauthenticated wire position or initial foothold - Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6) - Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2
- privesc-linux
- Gained an initial unprivileged shell on a Linux host and need root or a higher-privileged account - Post-exploitation lateral/vertical movement on Linux servers, workstations, CI runners, or appliances - Container / Kubernetes pod foothol
- privesc-windows
- Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM - Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege - Standard-user → admin vi
- recon-osint
- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
- reverse-engineering
- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
- threat-hunting
- Hypothesis-driven hunting across endpoint, network, cloud, and identity telemetry - Writing & shipping detections (Sigma + correlation) as version-controlled code in CI - Mapping & measuring coverage against MITRE ATT&CK v18 (Detection St
- vulnerability-analysis
Every vulnerability you miss is one an attacker finds first.
- web-pentest
- Web application security assessment (black/grey/white box) - API security testing (REST, GraphQL, WebSocket) - Authentication & session management testing (JWT, OAuth/OIDC, SAML) - Business-logic and race-condition hunting - WAF/CSP bypas
- windows-boundaries
- Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line) - Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged ap
- windows-mitigations-bypass
Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI).
- coding-mastery
- Writing exploit code, PoCs, or security tools - Developing automation scripts for pentesting workflows - Implementing network protocols or custom C2 - Building security analysis tools - Cryptographic implementation or analysis - Performan
- engagement-memory
Engagement Memory (cross-engagement learning)
- threat-model-discipline
You cannot test what you have not modeled. A threat model names the assets, entry points, trust boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not accidental.
- edr-evasion
- Planning EDR bypass during red team engagements - Researching AV/EDR evasion techniques - Developing implants that must survive endpoint detection - Testing detection capabilities of security products
- engagement-flow
A pentest/red-team engagement is a phased pipeline with gates, not a pile of techniques run ad hoc.
- shellcode-dev
- Writing custom x86/x64 shellcode - Implementing position-independent code (PIC) - Building shellcode loaders for implant delivery - Evading AV/EDR static detection - Converting PE files to shellcode - Cross-platform shellcode development
- using-offensive-claude
<SUBAGENT-STOP> If you were dispatched as a subagent to execute a specific task, skip this skill.
- writing-offensive-skills
Conventions for authoring skills in this repo so the dispatcher can find them and operators can trust them.
