network-appliance-offensive

name

network-appliance-offensive

description

Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC, safe firmware/patch-level inference for FortiGate/PAN-OS/Cisco ASA/Citrix feeding CVE applicability, NTLM Type-2 target-info decode, handshake-completion TLS-version probing, and an RST-TTL forgery discriminator. The active/offensive counterpart to the static firewall-review skill. Use when a perimeter firewall/VPN/appliance is in scope and you must test it (not just audit a config), without reinventing raw-socket protocol tooling each engagement.

Network-Appliance Offensive

firewall-review audits a config statically; infrastructure covers generic ports/DNS/SMB. Neither tests a live perimeter appliance or its VPN crypto — so IKE builders, SIC/OPSEC fingerprinting, and TTL discriminators were reinvented from raw sockets each engagement, often shallowly, and CVE applicability was left UNDETERMINED across whole estates. This skill provides the deterministic, tested tools and the precondition-gated methodology. Non-destructive only — every tool observes/decodes/infers; none fires an exploit, and CVE applicability is a precondition check, never a blind "vulnerable."

Tools

Tool	Does	Anti-footgun
tools/ike_enum.py	IKEv1 aggressive-mode detection, IKEv1/IKEv2 transform + DH-group enum, NOTIFY / NAT-T decode (wraps ike-scan, raw ISAKMP SA_INIT builder fallback)	Aggressive-mode support (PSK-hash leak) is the finding; enumerate, don't crack in-band
tools/checkpoint_sic_opsec.py