القائمة
جمع SkillsMP عدد ١٦ من skills من dariushoule/roorecon. افتح أي skill لمراجعة مصدره وتفاصيله.
عرض ١٦ من أصل ١٦ skills مجمعة.
Network, service, and web enumeration for authorized pentesting and CTF. Use when starting an engagement or CTF box and you need to map attack surface — discover open ports, fingerprint services, enumerate web apps, and triage what to attack first. Triggers…
لغة النص الأصلي: الإنجليزية
Offline password-hash cracking with hashcat on the host GPU, for authorized pentesting and CTF. Use to identify an unknown hash's type, pick the right hashcat mode, fetch a wordlist, and run a sensible wordlist→rules→mask attack ladder. Triggers on "help me…
لغة النص الأصلي: الإنجليزية
Linux local privilege escalation methodology for authorized pentesting and CTF — turn a foothold shell (often a low-priv/service account like www-data) into root. Use after landing any non-root shell on a Linux host and you need to escalate: enumerate the…
لغة النص الأصلي: الإنجليزية
Drive a real web browser as a companion to the operator during authorized pentesting/CTF — a host Chrome routed through the VPN that both the human and the agent can control over CDP (Playwright MCP). Use to explore a web app interactively, reproduce/poke at…
لغة النص الأصلي: الإنجليزية
Post-engagement retrospective that turns one run's operator↔agent interactions into durable improvements to this repo's skills, runbooks, and tooling. Use at the end of an engagement (after the work, ideally before teardown wipes scratch) to refine skills,…
لغة النص الأصلي: الإنجليزية
Pick and fetch the right SecLists wordlist on demand for content discovery, fuzzing, subdomain/vhost enum, parameter mining, default-cred spraying, and payload injection (LFI/SSRF/SQLi/XSS), for authorized pentesting and CTF. Use when a fuzz/brute job needs a…
لغة النص الأصلي: الإنجليزية
Cloud-emulator and AWS-compatible-API attack methodology for authorized pentesting and CTF. Use when a target exposes an AWS-shaped API (LocalStack, moto, or a custom/look-alike mock), an instance metadata service (IMDS / 169.254.169.254) reachable via SSRF,…
لغة النص الأصلي: الإنجليزية
CVE and public-exploit (PoC) research for authorized pentesting and CTF. Use after recon fingerprints a service/version to find known vulnerabilities and working exploits — GitHub PoCs, Exploit-DB, Metasploit modules — ranked by exploitability. Also sharpens…
لغة النص الأصلي: الإنجليزية
Persistent, shared reverse-shell catcher for authorized pentesting and CTF — both the operator and the agent can drop in and out of the same caught shell, with built-in upload/download. Use after finding an RCE/command-injection to receive a reverse shell…
لغة النص الأصلي: الإنجليزية
Cleanly shut down a RooRecon engagement — close the browser, drop the SOCKS proxy and VPN tunnel, tidy runtime scratch out of the working tree, and confirm nothing is left running. Use when the operator says to clean up, shut down, tear down, wrap up, or stop…
لغة النص الأصلي: الإنجليزية
Active Directory enumeration and attack-path runbook for authorized pentesting and CTF. Use after recon spots a Domain Controller (Kerberos+LDAP+SMB) or when you hold domain credentials and need to map users, groups, shares, ACLs, delegation, AD CS, and…
لغة النص الأصلي: الإنجليزية
Stand up BloodHound Community Edition locally and load AD collection data so the operator can see the attack graph. Use to ingest an existing SharpHound/rusthound/nxc collection zip (or collect one given domain creds) and open BloodHound in the browser to…
لغة النص الأصلي: الإنجليزية
Recursive web directory and file brute-forcing (content discovery) for authorized pentesting and CTF. Use after finding an http/https service to discover hidden paths, admin panels, backups, and API routes. Triggers on "dirbust", "directory brute", "content…
لغة النص الأصلي: الإنجليزية
Automated SQL injection detection and exploitation with sqlmap, for authorized pentesting and CTF. Use after recon/dirbust finds a parameter or endpoint that looks injectable (or a known SQLi CVE) to confirm the injection, enumerate the database, and dump…
لغة النص الأصلي: الإنجليزية
Fetch prebuilt Windows offensive tooling (GhostPack/Rubeus, SharpHound, Certify, Seatbelt, Inveigh, the *Potato suite, …) from the Forge registry into a shared, off-host /tools volume, for authorized pentesting and CTF. Use when you need a Windows .NET tool…
لغة النص الأصلي: الإنجليزية
Offline memory-image forensics for authorized pentesting and CTF — extract credentials and artifacts from RAM dumps, VM memory snapshots, and lsass minidumps with volatility3. Use when loot includes a memory image (.vmem/.vmsn/.dmp/.raw/hiberfil.sys) or an…
لغة النص الأصلي: الإنجليزية