| name | hunt-vpn |
| description | Enterprise SSL VPN attack - vendor fingerprinting, CVE matrix (Cisco, Fortinet, Citrix, Palo Alto, Pulse/Ivanti), default credentials, pre-auth exploit commands. Wiki-first, FIND schema output. |
Hunt: Enterprise VPN Appliances
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "SSL VPN Fortinet Citrix Cisco Palo Alto Pulse Ivanti CVE default credentials pre-auth exploit" via wiki-search MCP
Hub: [[network-moc]] (live index). Primary page: [[network-service-attacks]] (VPN-protocol section: IKE aggressive-mode PSK capture, PPTP handshake capture). CVE arsenal: wiki/cheatsheets/cve-arsenal.md (Perimeter / VPN / edge - Fortinet/Citrix/Ivanti/PAN-OS/Cisco pre-auth CVEs with PoC). Default creds: wiki/cheatsheets/default-credentials.md.
Anchors: [[network-discovery]] (locating and banner-fingerprinting the exposed appliance).
When to Use
Recon surfaces: +CSCOE+ paths (Cisco ASA), Set-Cookie: SVPNCOOKIE= (Fortinet), NSC_AAA= (Citrix), DSAuthSession= (Pulse), BIGipServer* (F5), ports 443/8443/10443 with VPN login pages.
Attack surface (ranked)
Work top-down; exploit the first rung that lands, do not jump to CVEs before fingerprinting.
- Vendor fingerprint (cookie / header / login-page path) - which appliance, then which page below.
- Version fingerprint (JS file paths, meta tags, build strings) - narrows the CVE matrix to what actually applies to this build.
- Default credentials (short known-list, non-disruptive) - cheapest full-admin win, try before CVEs.
- for the fingerprinted vendor + version - file read, session-token leak, or RCE.
