القائمة
جمع SkillsMP عدد ٨٠ من skills من blacklanternsecurity/red-run. افتح أي skill لمراجعة مصدره وتفاصيله.
عرض ٤٠ من أصل ٨٠ skills مجمعة.
Multi-phase penetration test orchestrator. Handles recon, assessment surface mapping, vulnerability chaining, and routes to technique skills for execution. Invoke via /red-run-ctf slash command only.
لغة النص الأصلي: الإنجليزية
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials (msDS-KeyCredentialLink → PKINIT), and…
لغة النص الأصلي: الإنجليزية
Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden Certificate (forge with stolen…
لغة النص الأصلي: الإنجليزية
Forces remote systems to authenticate back to attacker-controlled listeners and relays captured authentication to escalate privileges or move laterally. Covers authentication coercion (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, CheeseOunce), NTLM relay…
لغة النص الأصلي: الإنجليزية
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
لغة النص الأصلي: الإنجليزية
Enumerates and exploits Microsoft SCCM/MECM (System Center Configuration Manager / Microsoft Endpoint Configuration Manager) infrastructure for credential harvesting, lateral movement, and domain escalation. Covers SCCM enumeration (sccmhunter, SharpSCCM),…
لغة النص الأصلي: الإنجليزية
Legacy subagent-based orchestrator. Superseded by /red-run-ctf (agent teams). Use /red-run-legacy to invoke manually. Does not auto-trigger.
لغة النص الأصلي: الإنجليزية
Offline credential and file recovery with hashcat and john. Use when any skill captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files (ZIP, Office, PDF, KeePass, SSH key, 7z, RAR). Trigger phrases: "recover this hash", "offline…
لغة النص الأصلي: الإنجليزية
Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for Linux privilege escalation. Use when a user belongs to a privileged group or has write access to…
لغة النص الأصلي: الإنجليزية
Harvest stored credentials from a Windows system for privilege escalation or lateral movement.
لغة النص الأصلي: الإنجليزية
Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.
لغة النص الأصلي: الإنجليزية
SMB share enumeration, access testing, password policy extraction, and content searching. Enumerates shares via null session, guest, and authenticated access. Covers share listing, per-share access testing, MANSPIDER content search, and SMB vulnerability…
لغة النص الأصلي: الإنجليزية
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the orchestrator passes target services…
لغة النص الأصلي: الإنجليزية
Network reconnaissance, host discovery, port scanning, and OS fingerprinting. Produces a port/service map that the orchestrator uses to route to service-specific enumeration skills.
لغة النص الأصلي: الإنجليزية
XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269 (server-to-server) are found open. Covers authentication testing, user enumeration, MUC room discovery, and…
لغة النص الأصلي: الإنجليزية
Exploit Windows token privileges for local privilege escalation to SYSTEM.
لغة النص الأصلي: الإنجليزية
Security-focused source code review. Identifies hardcoded credentials, injection sinks, authentication weaknesses, and framework-specific vulnerabilities. Use when application source code is available for review.
لغة النص الأصلي: الإنجليزية
Extracts credentials from Active Directory: DCSync replication, NTDS.dit database extraction, SAM hive dump, Azure AD Connect (ADSync) credential extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS root key + GoldenGMSA), dMSA exploitation…
لغة النص الأصلي: الإنجليزية
Deploy webshells to IIS, Apache, or Tomcat web roots via SMB share write access. Use when a domain user has write access to a file share that maps to a web server's document root — write a webshell via smbclient/net use, then trigger it via HTTP for RCE.…
لغة النص الأصلي: الإنجليزية
Discover web application injection points and route to the correct exploitation skill during authorized penetration testing.
لغة النص الأصلي: الإنجليزية
Guide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.
لغة النص الأصلي: الإنجليزية
Guide server-side request forgery (SSRF) exploitation during authorized penetration testing.
لغة النص الأصلي: الإنجليزية
Enumerates Active Directory domains and maps attack surface for penetration testing.
لغة النص الأصلي: الإنجليزية
Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key (LSASS master password), custom SSP injection (credential logging via mimilib/memssp), security descriptor…
لغة النص الأصلي: الإنجليزية
Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL → modify to ESC1), ESC5 (PKI object ACLs), ESC7 (ManageCA/ManageCertificates abuse), ESC8 (NTLM relay to HTTP enrollment), ESC11 (NTLM…
لغة النص الأصلي: الإنجليزية
Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee supplies subject), ESC2 (any-purpose/no EKU), ESC3 (enrollment agent), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2…
لغة النص الأصلي: الإنجليزية
Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and registry modifications…
لغة النص الأصلي: الإنجليزية
Exploits Kerberos delegation misconfigurations for privilege escalation and lateral movement in Active Directory. Covers Unconstrained Delegation (TGT harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with SPN swapping), and…
لغة النص الأصلي: الإنجليزية
Forges Kerberos tickets for domain persistence and privilege escalation. Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash → forged TGS), Diamond Ticket (decrypt/modify/re-encrypt legitimate TGT for stealth), Sapphire Ticket (U2U…
لغة النص الأصلي: الإنجليزية
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.
لغة النص الأصلي: الإنجليزية
Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest root via golden/diamond ticket…
لغة النص الأصلي: الإنجليزية
Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was quarantined, blocked, or…
لغة النص الأصلي: الإنجليزية
Container escape, Docker breakout, and Kubernetes exploitation.
لغة النص الأصلي: الإنجليزية
Database service enumeration and quick-win access checks for MSSQL, MySQL, PostgreSQL, Oracle, MongoDB, and Redis. Checks default/empty passwords, unauthenticated access, and command execution capabilities. Use after network-recon identifies database ports.
لغة النص الأصلي: الإنجليزية
Enumeration of infrastructure services: DNS, SMTP, SNMP, IPMI, NFS, TFTP, RPC/MSRPC, and HTTP/HTTPS surface detection. Checks zone transfers, open relays, default community strings, cipher zero, NFS exports, and web technology fingerprinting. Use after…
لغة النص الأصلي: الإنجليزية
Network pivoting, port forwarding, and tunneling through compromised hosts to reach internal networks.
لغة النص الأصلي: الإنجليزية
Enumeration of remote access services: FTP, SSH, RDP, VNC, and WinRM. Checks anonymous access, default credentials, version vulnerabilities, and authentication methods. Use after network-recon identifies remote access ports.
لغة النص الأصلي: الإنجليزية
Exploit remote SMB vulnerabilities for unauthenticated code execution on Windows hosts.
لغة النص الأصلي: الإنجليزية
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
لغة النص الأصلي: الإنجليزية
Linux local privilege escalation enumeration and attack surface mapping.
لغة النص الأصلي: الإنجليزية