Best penetration testing skills, page 2

Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k).

ADScanPro/Claude-AD

Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws

NeoTheCapt/RedteamAgent

Detects price oracle manipulation and flash loan attack vectors in DeFi smart contracts.

quillai-network/quillshield_skills

Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools

CommonHuman-Lab/nyxstrike

Changing or adding a project setting / default value in RedAmon.

samugit83/redamon

Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB.

ADScanPro/Claude-AD

CORS misconfiguration testing for data theft and access control bypass

NeoTheCapt/RedteamAgent

Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs.

AgentSecOps/SecOpsAgentKit

Build a high-fidelity network and service inventory using Nmap, Masscan, packet capture, DNS, and protocol-specific follow-up.

cyberful/cyberful

Wiring an LLM into a recon tool's decisions ("let AI pick {feature} for {tool}"): the never-raise contract, the per-target cache, the full+partial coverage, and the two UI toggles bound to one field.

samugit83/redamon

Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, constrained/S4U, RBCD).

ADScanPro/Claude-AD

Check reburp's Montoya API coverage and detect when a Burp/Montoya upgrade added or changed APIs.

forefy/reburp

Cross-site request forgery testing for state-changing operations

NeoTheCapt/RedteamAgent

Chief Security Officer mode. An agent skill from no-session/pstack.

no-session/pstack

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing.

davila7/claude-code-templates

Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.

Encod3d-Sec/TORCH

Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator.

transilienceai/communitytools

Adding a new tool to the recon pipeline: the enrichment-module contract and its isolated wrapper (the actual fan-out and test call path), graph completeness, and the preset catalog that silently…

samugit83/redamon

Insecure deserialization detection and gadget chain exploitation

NeoTheCapt/RedteamAgent

SQL injection detection→exploitation→proof for web apps and APIs.

s0ld13rr/pentestcode

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

davila7/claude-code-templates

Subdomain and DNS enumeration workflow using subfinder, amass, dnsenum, fierce, theharvester, gau, and waybackurls

CommonHuman-Lab/nyxstrike

Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

Encod3d-Sec/TORCH

How RedAmon tests actually run and how to author them: the per-file Docker gate, the unit/integration/live tiers, and the failure modes that make a green run a lie.

samugit83/redamon

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…

samugit83/redamon

Working on the HTTP capture proxy and its replay/fuzz path: the egress guard that stops the proxy becoming an SSRF pivot, why it checks the resolved IP, and keeping capture off the scan's critical…

samugit83/redamon

Discover hidden directories, files, and endpoints on a web server

NeoTheCapt/RedteamAgent

A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch.

ADScanPro/Claude-AD

Multi-tenant authz, pre-auth disclosure hardening, and Kali disposition.

bbartling/open-fdd

Squad de 15 agentes de seguranca ofensiva e defensiva (Georgia Weidman, Peter Kim, Jim Manico, Chris Sanders, Omar Santos, Marcus Carey) cobrindo pentest, red team, blue team, AppSec, recon e…

ohmyjahh/xquads-squads

Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology

RightNow-AI/openfang

Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f

CommonHuman-Lab/nyxstrike

Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection.

AgentSecOps/SecOpsAgentKit

Automated SQL injection detection and exploitation tool for web application security testing.

AgentSecOps/SecOpsAgentKit

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities.

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus.

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry…

mukul975/Anthropic-Cybersecurity-Skills

Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences…

mukul975/Anthropic-Cybersecurity-Skills

Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable, gather…

mukul975/Anthropic-Cybersecurity-Skills

Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, SIEM, and…

mukul975/Anthropic-Cybersecurity-Skills

Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent…

mukul975/Anthropic-Cybersecurity-Skills

Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape…

mukul975/Anthropic-Cybersecurity-Skills

Invoke for 等保2.0 full-lifecycle assessment on corporate networks on Kali Linux: classification, gap analysis, baseline audit, vuln scanning, penetration testing, and compliance reporting per GB/T…

openocta/openocta_skills

Web vulnerability scanning workflow covering SQLi, XSS, template injection, and generic CVE detection using nuclei, sqlmap, dalfox, nikto, and jaeles

CommonHuman-Lab/nyxstrike

Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.

Encod3d-Sec/TORCH

Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement…

mukul975/Anthropic-Cybersecurity-Skills

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception.

mukul975/Anthropic-Cybersecurity-Skills