blackbox-claude-plugin

This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.

This skill covers Cacti network monitoring tool exploitation including authenticated RCE via graph templates (CVE-2025-24367), unauthenticated command injection (CVE-2022-46169), and authentication bypass techniques.

This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.

This skill covers container escape techniques for Docker, LXC/LXD, and Kubernetes environments. Includes Docker socket escape, Docker Desktop API escape (192.168.65.7:2375), privileged container breakout, and capability-based escapes.

This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.

This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".

This skill should be used when the user asks about "dump database", "extract credentials", "sqlite", "mysql credentials", "database passwords", or needs to extract user data from common database systems.

This skill should be used when Erlang/OTP services are detected: - Port 4369 (EPMD - Erlang Port Mapper Daemon) - Erlang SSH (usually port 2222) - RabbitMQ, CouchDB, or other Erlang-based services Covers CVE-2025-32433 pre-auth RCE and other Erlang attack vectors.

This skill should be used when FTP services are detected including: - CrushFTP (CVE-2025-31161 auth bypass) - vsftpd (backdoor) - ProFTPD (mod_copy) - Pure-FTPd, FileZilla Server Covers authentication bypass, file access, and privilege escalation.

This skill should be used when the user asks about "crack hash", "identify hash", "hashcat", "john", "found hash", or needs to crack password hashes. Provides complete workflow from hash identification to cracking.

This skill should be used when the user asks about "Linux privilege escalation", "linpeas", "SUID", "sudo abuse", "GTFOBins", "kernel exploits", "cron jobs", "capabilities", or needs guidance on escalating privileges on Linux systems.

This skill should be used when you have shell access and need to find credentials for lateral movement or privilege escalation. Covers: - Grepping for passwords in config files - Common credential locations - Database extraction - History files and environment variables

This skill covers PHP type juggling vulnerabilities including magic hashes, loose comparison bypass, and authentication circumvention. Use when encountering PHP applications with password reset, token validation, or strcmp-based auth.

This skill should be used when the user asks about "nmap", "port scanning", "network reconnaissance", "service discovery", "masscan", "host discovery", "banner grabbing", or needs guidance on network enumeration techniques.

This skill should be used when analyzing discovered source code for security issues. Helps identify dangerous functions, hardcoded secrets, and vulnerable packages.

This skill should be used when the user asks about "gobuster", "directory fuzzing", "web enumeration", "nikto", "web vulnerabilities", "feroxbuster", "ffuf", "subdomain enumeration", or needs guidance on web application testing.

This skill should be used when the user asks about "Windows privilege escalation", "winpeas", "token impersonation", "potato attacks", "service exploitation", "unquoted service path", "AlwaysInstallElevated", or needs guidance on escalating privileges on Windows systems.