Menü
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | cloud |
| description | Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting. |
| Skill | Use for |
|---|---|
/skills/standard/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc |
/skills/standard/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover |
/skills/standard/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath |
/skills/standard/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation |
/skills/standard/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |
bash("aws sts get-caller-identity")bash("aws iam list-attached-user-policies --user-name <me>")iam_policy_auditbash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_auditbash("kubectl get pods -A -o json") → k8s_auditmetadata_endpoints("aws") for the target cloudcredential node + leaks edge from the SSRF vulnplan_attack_chains(promote=True) to see the full path