enterprise-vpn-attack

Featured

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.

AI & Automation 4,666 stars 702 forks Updated today MIT

Install

View on GitHub

Quality Score: 96/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

## When to use this skill Trigger when recon surfaces: - `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect - `intranet.*` / `vpn.*` / `connect.*` / `webvpn.*` / `wc.*` / `remote.*` subdomains - Port 443 returning login pages with `Server: Apache` or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti" - TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports) - HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5) DO NOT use for: - Internal lateral-movement post-foothold (out of scope per user's boundary) - VPN client-side bugs (different attack class) - IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack) --- ## Vendor identification (fingerprinting) ### Cisco ASA / AnyConnect ```bash curl -skI 'https://target/+CSCOE+/logon.html' | head -10 # Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content # Login page contains: "AnyConnect", "CSCOE", "logon.html" ``` ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths. ```bash # Path-based version hints (older builds leaked builds in URLs) curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test' curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled curl -sk 'https://target/CSCOSSLC/config-auth' # An...

Details

Author
elementalsouls
Repository
elementalsouls/Claude-BugHunter
Created
4 months ago
Last Updated
today
Language
Python
License
MIT

Integrates with

Anthropic · AI

Bundled in these plugins

Claude-BugHunter

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

network-attack

Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless

382 Updated 5 days ago
hypnguyen1209
AI & Automation Featured

offensive-tls-attacks

Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication attac

6,950 Updated 6 days ago
SnailSploit
Code & Development Featured

crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

382 Updated 5 days ago
hypnguyen1209