القائمة
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | cloud |
| description | Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting. |
| Skill | Use for |
|---|---|
/skills/standard/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc |
/skills/standard/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover |
/skills/standard/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath |
/skills/standard/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation |
/skills/standard/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |
bash("aws sts get-caller-identity")bash("aws iam list-attached-user-policies --user-name <me>")iam_policy_auditbash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_auditbash("kubectl get pods -A -o json") → k8s_auditmetadata_endpoints("aws") for the target cloudcredential node + leaks edge from the SSRF vulnplan_attack_chains(promote=True) to see the full path