메뉴
Root pointer for the binary reversing lane. Covers triage, string extraction, packer unpacking, symbol risk, ROP, Ghidra deep analysis, and firmware extraction.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | reverser |
| description | Root pointer for the binary reversing lane. Covers triage, string extraction, packer unpacking, symbol risk, ROP, Ghidra deep analysis, and firmware extraction. |
| Skill | Use for |
|---|---|
/skills/standard/reverser/triage/SKILL.md | First-pass ELF/PE/Mach-O triage |
/skills/standard/reverser/firmware/SKILL.md | Router / IoT firmware extraction |
/skills/standard/reverser/packer-unpacking/SKILL.md | UPX / ASPack / Themida / VMProtect |
/skills/standard/reverser/rop-chain/SKILL.md | Gadget hunting for exploit dev |
/skills/standard/reverser/anti-debug-bypass/SKILL.md | IsDebuggerPresent, ptrace, NtGlobalFlag |
/skills/standard/reverser/ghidra/SKILL.md | Deep Ghidra analysis — decompile, xrefs, imports, P-code |
ghidra_status — check Ghidra MCP bridge and headless availabilitybin_identify — format, arch, NX/PIEbin_packer — entropy + signaturebin_strings — category=url/ip/crypto/secret/version to seed the graphbin_symbols_report — risk bucket classificationcve_lookup + cve_by_packageghidra_analyze for full analysis, or bin_ghidra_script / bin_r2_script as fallbackghidra_decompile on interesting functions, ghidra_xrefs on dangerous imports