EntroVyx/hermes-agent-offsec

hermes-agent

Project self-knowledge for Hermes Agent Offsec. Use when the user asks about this fork, its CLI, configuration, update flow, providers, skills, modes, troubleshooting, or how it differs from the original Hermes Agent.

لغة النص الأصلي: الإنجليزية

xmlrpc-exploitation

WordPress XML-RPC triage: method enum, multicall abuse, pingback SSRF, and upload-chain validation.

لغة النص الأصلي: الإنجليزية

bb-local-toolkit

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning, vuln hunting (30+ classes), A-to-B chaining, AI/LLM testing, bypass tables, language-specific grep,…

لغة النص الأصلي: الإنجليزية

bug-bounty

Master bug bounty orchestrator — full pipeline: recon, pre-hunt learning, vulnerability hunting (30+ classes), A-to-B chaining, AI/LLM testing (ASI01-ASI10), language-specific grep, bypass tables, and reporting (7-question gate, CVSS 3.1, human-tone…

لغة النص الأصلي: الإنجليزية

google-meet

Join a Google Meet call, transcribe live captions, optionally speak in realtime, and do the followup work afterwards. Use when the user asks the agent to sit in on a meeting, take notes, summarize, respond in-call, or action items from it.

لغة النص الأصلي: الإنجليزية

saml-sso-attack

Attack SAML SSO via XSW, signature strip, metadata extract.

لغة النص الأصلي: الإنجليزية

cross-attack-chains

Chain multiple vulns into critical impact attack paths.

لغة النص الأصلي: الإنجليزية

wordpress-full-compromise

Execute optimal kill chains for WordPress full compromise.

لغة النص الأصلي: الإنجليزية

flask-werkzeug-attack

Exploit Flask/Werkzeug debugger exposure — traceback disclosure, SECRET extraction, console RCE (if enabled), server path disclosure, and Python stack trace information gathering

لغة النص الأصلي: الإنجليزية

docker-privesc

Escape Docker containers to host root via 5 techniques.

لغة النص الأصلي: الإنجليزية

artifact-pivot-intelligence

Public-artifact-first methodology for turning exposed client assets, archived content, public API material, support content, and metadata into high-signal attack-surface maps. Use when starting recon, when a target looks thin from the homepage, or when you…

لغة النص الأصلي: الإنجليزية

attack-chain

Visible exploit-chain builder. Use when a primitive appears and the operator needs to convert it into a reportable high-impact chain.

لغة النص الأصلي: الإنجليزية

attack-patterns-reference

Catalog: 25 attacks, 18 WP, 8 CORS to match findings.

لغة النص الأصلي: الإنجليزية

client-runtime-intelligence

Client-runtime and bundle analysis methodology for converting front-end assets into route maps, auth assumptions, object graphs, and manual test queues. Use when JavaScript, source maps, or mobile-facing assets are available.

لغة النص الأصلي: الإنجليزية

cloud-exposure-triage

Methodology for turning exposed cloud, identity, storage, and backend-service clues into a structured capability assessment and manual validation plan. Use when recon reveals hosted data services, identity platforms, storage endpoints, or public backend…

لغة النص الأصلي: الإنجليزية

continuous-surface-monitoring

Continuous recon and campaign-memory methodology for tracking deltas in attack surface, deduplicating noisy signals, and turning change events into prioritized manual testing queues. Use during long hunts or repeated target coverage.

لغة النص الأصلي: الإنجليزية

cross-wave-delta-analysis

Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

لغة النص الأصلي: الإنجليزية

crown-jewel

Attack-mode entry point for crown-jewel hunting. Use at the beginning of an authorized bug bounty or pentest session to choose the highest-impact objective before recon or exploitation.

لغة النص الأصلي: الإنجليزية

deep-hunt

Manual workflow attack mode for authorized bug bounty and pentest work. Use as /deep-hunt <workflow> to attack one business workflow deeply instead of scanning endpoints shallowly.

لغة النص الأصلي: الإنجليزية

exploit-chaining-engine

Offensive chain builder. Use when you have one or more weak findings and want to score, prioritize, and compose them into a critical or high-impact exploit path.

لغة النص الأصلي: الإنجليزية

google-dorks-catalog

High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

لغة النص الأصلي: الإنجليزية

manual-decision-trees

Manual testing trees for difficult bug bounty and pentest work. Use after mapping a workflow and before freeform poking so the agent systematically explores actor, state, transport, and secondary-object branches.

لغة النص الأصلي: الإنجليزية

offsec-campaign-orchestrator

Master workflow for offensive campaigns. Use when starting a target, scoping a hunt, or deciding how to split work across reconnaissance, manual testing, chain building, and reporting.

لغة النص الأصلي: الإنجليزية

pentest-playbook

7-phase pentest pipeline from passive recon to exploitation.

لغة النص الأصلي: الإنجليزية

protocol-surface-triage

Service-first infrastructure triage methodology for turning discovered ports and banners into attack-surface meaning, weak-boundary hypotheses, and follow-up validation plans. Use when network services, certificates, reverse DNS, or exposed management…

لغة النص الأصلي: الإنجليزية

recon-playbook

4-phase pipeline for max findings per minute across batches.

لغة النص الأصلي: الإنجليزية

request-import

Import HAR exports or raw Burp/Caido HTTP requests into an offensive request map. Use as /request-import <path> to extract endpoints, methods, parameters, cookies, auth hints, and deep-hunt candidates.

لغة النص الأصلي: الإنجليزية

sector-recon-methodology

Pick sectors, compile targets, batch recon for campaigns.

لغة النص الأصلي: الإنجليزية

subagent-hunt-orchestration

How to split offensive campaigns across specialist subagents without duplicating work. Use when a target is large enough that one linear agent loop wastes time.

لغة النص الأصلي: الإنجليزية

target-dossier

Create and maintain a persistent target dossier for authorized offsec campaigns. Use as /target-dossier <target> to initialize or update .offsec/campaigns/<target>/TARGET.md.

لغة النص الأصلي: الإنجليزية

target-dossier-system

Persistent target-memory workflow for offsec campaigns. Use when you need structured memory for actors, objects, state transitions, secrets, hypotheses, and chain candidates on a real target.

لغة النص الأصلي: الإنجليزية

api-noauth-hunt

Exploit no-auth APIs for data theft and CRUD via probes.

لغة النص الأصلي: الإنجليزية

cache-attack

Poison CDN cache or deceive when X-Cache header is detected.

لغة النص الأصلي: الإنجليزية

recon-carpet-cleaning

Sector-specific recon for carpet cleaning company websites — steam cleaning, stain removal, upholstery cleaning, flood restoration. Typically WordPress on shared hosting with service booking forms, emergency water damage response, and seasonal special offers.…

لغة النص الأصلي: الإنجليزية

cors-credential-wordpress

Exploit WP CORS credential reflection for data theft.

لغة النص الأصلي: الإنجليزية

deep-invade

Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

لغة النص الأصلي: الإنجليزية

email-security

DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

لغة النص الأصلي: الإنجليزية

error-log-mining

Mine error_log for creds, paths, SQL when leak hunt finds.

لغة النص الأصلي: الإنجليزية

exchange-owa-attack

Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

لغة النص الأصلي: الإنجليزية

firebase-supabase-attack

Exploit Firebase/Supabase for data via JS config leak probe.

لغة النص الأصلي: الإنجليزية