infrastructure

Oryginalny dokument Skill

Treść z repozytorium z zachowaniem nagłówków, przykładów, kodu, tabel, linków i obrazów.

Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.

Techniques

Type	Key Vectors
Port Scanning	SYN scan, UDP scan, service detection, OS fingerprinting
DNS	Zone transfers, cache poisoning, subdomain takeover, DNS rebinding
MITM	ARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning
VLAN Hopping	Switch spoofing, double tagging
IPv6	RA flooding, neighbor spoofing, tunneling attacks
SMB/NetBIOS	Null sessions, relay attacks, enumeration
Sniffing	Packet capture, credential harvesting, protocol analysis
DoS	Resource exhaustion, amplification, application-layer
ICS/SCADA	Modbus TCP, PLC exploitation, coil/register manipulation, session hijacking
Space / CCSDS	Satellite telecommand framing (Space Packet + TC Transfer Frame), APID/SCID/VCID routing, VCFC sequencing, CRC-16/CCITT, ASCII `0x%02x:` command counters
UPnP / IoT / CPE	rootDesc/SCPD enumeration, vendor SOAP info disclosure (`GetPassword`), command injection via vendor actions, cross-action auth-key reuse
Hardware / Embedded	Logic captures (Saleae `.sal`), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker

Workflow

Network discovery and topology mapping
Port scanning and service enumeration
Protocol-specific vulnerability testing
Network attack execution (authorized scope only)
Evidence capture with packet captures and logs

Reference

Quickstart guides (per attack type):

reference/port-scanning-quickstart.md - Port scanning and service discovery
reference/dns-quickstart.md - DNS attacks and enumeration
reference/mitm-quickstart.md - Man-in-the-middle attacks
reference/vlan-hopping-quickstart.md - VLAN hopping techniques
reference/ipv6-quickstart.md - IPv6 attack vectors
reference/smb-netbios-quickstart.md - SMB/NetBIOS exploitation
reference/sniffing-quickstart.md - Network sniffing and capture
reference/dos-quickstart.md - DoS assessment
reference/ics-modbus-quickstart.md - ICS/SCADA Modbus PLC exploitation
reference/ccsds-space-telecommand-quickstart.md - Satellite CCSDS telecommand frame crafting (Space Packet + TC Transfer Frame)
reference/upnp-iot-quickstart.md - UPnP / IoT / CPE firmware web UI enumeration and exploitation
reference/hardware-embedded-quickstart.md - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS

Scan techniques: reference/syn-scan.md, reference/udp-scan.md, reference/icmp-scan.md, reference/os-fingerprint.md Other: reference/firewall-detection.md, reference/service-enum.md, reference/ip-reputation.md, reference/overview.md

authenticated-session-acquisition

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

instalacje

GitHub Stars

534

Aktualizacja

29 lip

MIT2 Pliki

Zobacz szczegóły →

blockchain-security

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.