wgpsec

C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改

Java 反序列化漏洞检测与利用。当目标是 Java 应用（Tomcat/Spring/WebLogic/JBoss/Jenkins）、发现 rO0AB/aced0005 开头的 Base64 数据、HTTP 请求中有 application/x-java-serialized-object Content-Type、或存在 T3/IIOP/RMI/JNDI 协议端口时使用。覆盖 ysoserial gadget chain、JNDI 注入、Fastjson/Jackson 反序列化、Shiro…

LDAP 注入检测与利用。当目标有 LDAP 认证入口（企业登录/SSO/统一认证）、发现 389/636/3268/3269 端口、URL 参数中出现 uid/cn/ou/dc 等 LDAP 属性名、或后端使用 LDAP 进行用户查询时使用。LDAP 注入与 SQL 注入思路类似但语法不同——通过注入 LDAP 搜索过滤器操作符来绕过认证或提取数据。在域环境和企业内网中常见，与 AD 域攻击配合可以获取域用户凭据。发现任何 LDAP 相关入口、Active Directory 集成认证、或 LDAP…

NoSQL 注入检测与利用。当目标使用 MongoDB/CouchDB 等 NoSQL 数据库、登录表单使用 JSON body 提交、或参数中出现 $gt/$ne/$regex 等操作符时使用。覆盖操作符注入认证绕过、$regex 盲注数据提取、$where JS 注入、CouchDB 攻击、WAF 绕过

PHP 安全特性绕过：disable_functions 和 open_basedir 限制突破。当已获取 webshell 但命令执行函数被禁用或文件操作被 open_basedir 限制时使用

PHP 类型杂耍（Type Juggling）和 Magic Hash 攻击方法论。当目标是 PHP 应用且存在密码比较、哈希校验、认证逻辑时使用。当看到 PHP `==` 松散比较、MD5/SHA1 哈希校验、strcmp 比较、JSON 输入处理、is_numeric 检查时必须使用。当错误登录泄露了输入的 MD5 哈希值时，这是 Magic Hash 的强信号，立即使用。CTF/渗透中 PHP 认证绕过最常见的漏洞类型之一。即使只是看到 PHP 5.x 或响应中包含哈希值，也应考虑使用此 skill

SQL注入检测、利用、绕过的完整方法论。当目标有表单提交、登录页面、搜索功能、数据查询接口时使用。包含POST参数完整性检查、EXTRACTVALUE截断陷阱、UNION/报错/盲注/sqlmap全流程

服务端模板注入(SSTI)的检测、引擎识别和利用。当目标是Flask/Jinja2/Django/Twig/Mako/Pug应用、存在用户输入回显、参数名含template/name/message/greeting时使用。Phase 0/1即覆盖快速检测和引擎识别，无须单独skill。如只需快速检测定位可直接使用Phase 0/1，无需阅读完整利用部分

Guide for using f8x, the red/blue team environment automation deployment tool. Use this skill whenever the user asks about installing security tools on a VPS, deploying pentest/red-team/blue-team environments, using f8x commands or flags, querying available…

AWS security hardening guide for red team infrastructure. Use this skill whenever the user is deploying to AWS, configuring IAM policies, setting up VPCs or security groups, asking about SSH access, encryption, key rotation, or any AWS security question. Also…

Strategies for minimizing cloud infrastructure costs in red team deployments. Use this skill whenever the user asks about pricing, budgets, cost estimates, instance sizing, spot instances, or resource cleanup. Also apply when the user is choosing instance…

Guide for deploying infrastructure across multiple cloud providers (AWS, Azure, GCP, Alibaba Cloud, Tencent Cloud, Huawei Cloud, Volcengine). Use this skill whenever the user mentions deploying to more than one cloud, comparing cloud providers, selecting…

Terraform IaC best practices for cloud infrastructure deployments. Use this skill whenever the user is writing Terraform code, creating templates, generating .tf files, asking about state management, modules, variables, security groups, or any…

Diagnose and fix Terraform deployment errors in RedC scenarios. Use this skill whenever the user encounters an error during deployment — whether it's a Terraform init failure, authentication error, resource creation failure, network timeout, state conflict,…

Create, maintain, and validate redc Terraform templates for multi-cloud deployment scenarios. Use this skill whenever someone wants to add a new cloud template (ECS, EC2, VM, etc.), create a userdata script, write a compose template, update an existing…

Look up official Terraform provider documentation before writing or debugging any Terraform resource, data source, or provider configuration. Use this skill whenever you encounter a Terraform error, need to write a new resource block, are unsure about…

Red team infrastructure multi-cloud automated deployment tool. Deploy, manage, and monitor cloud instances across Alibaba Cloud, AWS, Tencent Cloud, Volcengine, Huawei Cloud, and more via MCP. Credentials are read from environment variables — only configure…

Multi-cloud red team infrastructure automation. Deploy and manage cloud resources across AWS, Aliyun, Tencent Cloud with Terraform. Includes commands for init, deploy, manage, execute, and cleanup of infrastructure cases.

审计 AboutSecurity skills 中引用的渗透工具与 f8x 安装器、arsenal 投递物仓库、tchkiller --check 之间的同步状态。当新增或修改了 skill、往 f8x 加了新工具、或者想检查工具覆盖完整性时使用此 skill。涉及关键词：工具审计、f8x 覆盖、arsenal 同步、--check 检查、工具链维护。

Write and fix vulnerability knowledge base (vulndb) entries for the tchkiller penetration testing agent. Use this skill whenever the user wants to create, import, fix, or audit vulndb markdown entries. This includes: writing new vulnerability entries from…

Skill with references

SQL Injection attack and defense techniques