Skills for Real Engineers. Straight from my .agents directory.
39 skills
enterprise-vpn-attack
Agent skill from
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
How to install enterprise-vpn-attack
install enterprise-vpn-attack
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/enterprise-vpn-attack/
# into
~/.claude/skills/enterprise-vpn-attack/ (all projects)
.claude/skills/enterprise-vpn-attack/ (one project)
1## When to use this skill23Trigger when recon surfaces:4- `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect5- `intranet.*` / `vpn.*` / `connect.*` / `webvpn.*` / `wc.*` / `remote.*` subdomains6- Port 443 returning login pages with `Server: Apache` or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"7- TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)8- HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5)910DO NOT use for:11- Internal lateral-movement post-foothold (out of scope per user's boundary)12- VPN client-side bugs (different attack class)13- IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)1415---1617## Vendor identification (fingerprinting)1819### Cisco ASA / AnyConnect20```bash21curl -skI 'https://target/+CSCOE+/logon.html' | head -1022# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content23# Login page contains: "AnyConnect", "CSCOE", "logon.html"24```25ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.2627```bash28# Path-based version hints (older builds leaked builds in URLs)29curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'30curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled31…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills