enterprise-vpn-attack
SolidExternal SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
Install
Quality Score: 86/100
Skill Content
Details
- Author
- elementalsouls
- Repository
- elementalsouls/Claude-BugHunter
- Created
- 2 months ago
- Last Updated
- today
- Language
- Python
- License
- NOASSERTION
Integrates with
Bundled in these plugins
Similar Skills
Semantically similar based on skill content — not just same category
vuln-scan
Use this skill when the user runs /ievo:vuln-scan, asks to scan for vulnerabilities, or says "security scan my code" — not for auditing a third-party skill/plugin before installation (use /ievo:security-check for that). CWE-aware deep source code vulnerability scan for a single module or file set, inspired by Project Glasswing. Uses AI reasoning (not regex) to trace data flows, detect vulnerabilities, and validate findings via complete exploit chains. Every finding requires an attack narrative (entry point, data flow, impact); no chain means no finding. Applied per-module by the vuln-scanner agent, orchestrated by the /ievo:vuln-scan command. Covers OWASP top 10, CWE-anchored threat taxonomy (injection, auth bypass, crypto misuse, data exposure, race conditions, deserialization, path traversal, SSRF, business logic, supply chain).
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.
owasp-security
OWASP vulnerability detection + remediation for security code review, PLUS the Forge plugin's own security guards (why a "SECURITY BLOCK" / exit-2 fired and the correct fix). Use when reviewing or hardening authentication, authorization, input validation, cryptography, API endpoints, session management, deserialization, SSRF, or file uploads; when auditing a Claude Code plugin / MCP server / agent for excessive agency, prompt injection, or supply-chain risk; or when a Bash/Write/Edit was blocked by a Forge guard (rm -rf, chmod 777, curl|sh, force-push, eval(), os.system, shell=True, string-concat SQL, reading .env/*.pem/*.key). Covers OWASP Top 10:2025, API Security Top 10, Agentic AI (ASI01–ASI10), CWE Top 25, ASVS 5.0.