Menu
Skills in this repository
SkillsMP has collected 908 skills from abelrguezr/hacktricks-skills. Open a skill to review its source and details.
abelrguezr/hacktricks-skillsShowing 40 of 908 collected skills.
Active Directory password spraying and brute force methodology for authorized security assessments. Use this skill when conducting penetration tests, red team operations, or security audits on Active Directory environments where you have explicit written…
Guide for NTLM authentication coercion attacks in Active Directory environments. Use this skill whenever the user needs to force Windows systems to authenticate to an attacker-controlled host, capture NTLM hashes, or perform relay attacks. Trigger on mentions…
Windows Print Spooler security hardening and PrintNightmare vulnerability remediation. Use this skill whenever the user mentions Print Spooler security, PrintNightmare, CVE-2021-1675, CVE-2021-34527, CVE-2021-34481, CVE-2022-21999, SpoolFool, Windows printer…
Active Directory privileged group enumeration and exploitation. Use this skill whenever the user mentions Active Directory groups, privilege escalation, AD security assessment, domain enumeration, or needs to identify and exploit privileged group memberships.…
How to abuse RDP sessions for lateral movement and pivoting in authorized penetration testing. Use this skill whenever the user mentions RDP sessions, remote desktop pivoting, session injection, RDPInception, or needs to test RDP security in an Active…
Execute Resource-based Constrained Delegation (RBCD) attacks in Active Directory environments. Use this skill whenever the user needs to exploit write permissions on computer accounts to gain privileged access, perform S4U attacks, enumerate RBCD…
Extract SCCM OSD policy secrets by relaying Management Point NTLM authentication to the site database. Use this skill whenever the user mentions SCCM, Configuration Manager, OSD secrets, policy extraction, NTLM relay to MSSQL, or wants to extract Network…
How to work with Active Directory security descriptors (SDDL) for penetration testing and security assessments. Use this skill whenever the user mentions security descriptors, SDDL, ACL manipulation, WMI access, WinRM access, hash dumping, DAMP, or any…
Active Directory SID History Injection attack methodology. Use this skill whenever the user mentions SID history, domain trust attacks, cross-domain privilege escalation, Golden/Diamond tickets with SIDs, or wants to escalate from child to parent domain in…
Forge and abuse Kerberos Silver Tickets in Active Directory environments. Use this skill whenever the user mentions silver tickets, TGS forgery, service ticket attacks, Kerberos abuse, SPN exploitation, or needs to impersonate users to specific AD services.…
Active Directory Skeleton Key attack methodology for authentication bypass and persistence. Use this skill whenever the user mentions skeleton key attacks, AD authentication bypass, LSASS manipulation, Mimikatz misc::skeleton, master password injection, or…
How to perform TimeRoasting attacks against Active Directory to recover computer account passwords via MS-SNTP MAC collection and offline cracking. Use this skill whenever the user mentions Active Directory attacks, computer account password recovery,…
Active Directory security assessment skill for detecting and exploiting unconstrained delegation vulnerabilities. Use this skill whenever the user mentions Active Directory, Kerberos delegation, TGT dumping, LSASS memory, unconstrained delegation, or wants to…
How to enumerate and assess Windows security controls including AppLocker, credentials storage (SAM, LSASS, LSA), Microsoft Defender, EFS, gMSA, LAPS, PowerShell modes, SSPI, and UAC. Use this skill whenever the user mentions Windows security assessment,…
Windows security controls reference for AppLocker, credentials storage (SAM, LSASS, LSA, NTDS.dit), Defender, EFS, gMSA, LAPS, PowerShell constrained language mode, execution policy, SSPI, and UAC. Use this skill whenever the user needs to check, enumerate,…
Windows UAC bypass and privilege escalation techniques. Use this skill whenever the user needs to bypass User Account Control on Windows, check UAC status, understand UAC policies, or escalate from medium to high integrity. Trigger on mentions of UAC,…
Use this skill for Windows AV/EDR defense research, detection engineering, and authorized security assessments. Trigger when users need to understand AV/EDR bypass techniques for building detections, analyzing malware behavior, conducting authorized…
Windows Command Line reference for penetration testing and security assessment. Use this skill whenever the user needs Windows CMD commands for reconnaissance, enumeration, privilege escalation, persistence, or post-exploitation activities. Trigger on…
Windows PowerShell commands and techniques for penetration testing, reconnaissance, and post-exploitation. Use this skill whenever the user needs to perform Windows system enumeration, execute remote payloads, bypass AMSI/Defender, enumerate users/groups,…
Active Directory enumeration using PowerView/SharpView. Use this skill whenever the user mentions Active Directory enumeration, AD reconnaissance, PowerView, SharpView, domain security assessment, AD pentesting, finding misconfigurations in AD, Kerberoast,…
Systematic Windows local privilege escalation enumeration and exploitation. Use this skill whenever you need to escalate privileges on a Windows system, perform post-exploitation enumeration, assess Windows security posture, or look for privilege escalation…
Cobalt Strike red team operations guide. Use this skill whenever the user mentions Cobalt Strike, C2 infrastructure, beacon operations, post-exploitation, lateral movement, Windows/Linux penetration testing, or adversary emulation. This covers listeners,…
How to perform lateral movement between Windows hosts using AtExec and SchtasksExec techniques. Use this skill whenever the user mentions lateral movement, remote command execution, Windows domain pivoting, moving between hosts, executing commands on remote…
Use DCOM objects for Windows lateral movement in authorized security assessments. Use this skill whenever you need to move laterally between Windows systems, execute commands remotely via DCOM, or enumerate DCOM applications. Trigger this skill for any…
Guide for understanding Windows lateral movement techniques in authorized security assessments. Use this skill when the user asks about lateral movement, PsExec, SmbExec, WmiExec, WinRM, DCOM, RDP, or any Windows remote execution methods during penetration…
Execute commands on remote Windows hosts via Service Control Manager (SCM) using PsExec, SMBExec, or manual service creation. Use this skill whenever you need to run commands on a remote Windows machine where you have local admin credentials, especially for…
Execute commands on remote Windows systems via RDP. Use this skill whenever you need to run commands on a remote Windows machine through Remote Desktop Protocol, including authorized security testing, system administration, or troubleshooting remote Windows…
Analyze and understand SCMExec lateral movement techniques for security assessments. Use this skill when investigating Windows lateral movement, reviewing Service Control Manager abuse, analyzing SharpMove or similar tools, or when you need to understand how…
How to assess, test, and harden Windows Remote Management (WinRM) configurations. Use this skill whenever the user mentions WinRM, Windows remote management, lateral movement via WinRM, needs to audit/harden WinRM settings on Windows systems, or is working on…
Windows Management Instrumentation (WMI) techniques for authorized security testing and lateral movement assessment. Use this skill whenever you need to enumerate Windows systems, query WMI namespaces/classes, execute remote commands via WMI, or assess…
How to set up and use the Mythic C2 framework for authorized red teaming and security testing. Use this skill whenever the user needs to install Mythic, configure agents (Apollo, Poseidon, etc.), set up C2 profiles, or execute common red team operations like…
Guide for understanding NTLM authentication, configuring NTLM security settings, and hardening Windows environments against NTLM-based attacks. Use this skill whenever the user asks about NTLM authentication, LM/NTLMv1/NTLMv2 protocols, Pass-the-Hash attacks,…
Techniques for capturing NetNTLMv2 hashes through Windows authentication coercion. Use this skill whenever the user needs to steal NTLM credentials, capture NetNTLMv2 hashes, perform SMB authentication attacks, exploit writable shares for credential theft, or…
Windows Notepad Markdown protocol handler abuse research and defense. Use this skill whenever the user mentions Windows Notepad, Markdown rendering vulnerabilities, ShellExecuteExW, protocol handler abuse, CVE-2026-20841, or needs to create PoC payloads,…
Analyze and understand Mimikatz credential theft techniques for authorized security assessments, penetration testing, and defensive security research. Use this skill when you need to understand Windows credential extraction methods, Kerberos ticket attacks,…
Check and analyze Windows credential protection mechanisms including WDigest, LSA PPL/PP, Credential Guard, RDP RestrictedAdmin, cached credentials, and Protected Users group. Use this skill whenever the user needs to assess Windows security posture, audit…
Analyze Windows credential security, understand attack vectors for authorized penetration testing, and recommend defensive hardening measures. Use this skill whenever the user asks about Windows credential theft techniques, LSASS security, SAM/NTDS.dit…
This skill cannot be created.
Analyze and document Windows local privilege escalation chains in enterprise software (endpoint agents, auto-updaters, driver utilities). Use this skill whenever investigating IPC vulnerabilities, auto-updater hijacking, TOCTOU race conditions, or…
Use this skill whenever analyzing Windows access tokens, investigating privilege escalation paths, enumerating user tokens, or working with Windows security tokens. Trigger this skill for any Windows security assessment involving token analysis, user…