Menú
Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | cloud |
| description | Cloud exploitation lane — AWS IAM privesc, S3 takeover, k8s RBAC abuse, Terraform state leaks, cloud metadata pivoting. |
| Skill | Use for |
|---|---|
/skills/standard/cloud/aws-iam-enum/SKILL.md | IAM enumeration + privesc |
/skills/standard/cloud/s3-takeover/SKILL.md | Dangling bucket / subdomain takeover |
/skills/standard/cloud/k8s-pivot/SKILL.md | Pod escape, RBAC abuse, hostPath |
/skills/standard/cloud/terraform-state-leak/SKILL.md | Exposed state file exploitation |
/skills/standard/cloud/imds-pivot/SKILL.md | SSRF → metadata → IAM role |
bash("aws sts get-caller-identity")bash("aws iam list-attached-user-policies --user-name <me>")iam_policy_auditbash("aws s3 cp s3://bucket/terraform.tfstate -") → tfstate_auditbash("kubectl get pods -A -o json") → k8s_auditmetadata_endpoints("aws") for the target cloudcredential node + leaks edge from the SSRF vulnplan_attack_chains(promote=True) to see the full path