Enterprise Vpn Attack (Grade B)Security-tested testing-security skill for Claude AI. Grade B. External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo A

What's inside?

The bundle contains 82 auto‑loaded skills covering the external attack surface: Web application hunting (13 skills such as XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open‑redirect), Authentication & identity (7 skills including auth‑bypass, session, OAuth, SAML, MFA‑bypass, ATO), API & infrastructure (15 skills like GraphQL, gRPC, WebSocket, API‑misconfig, host‑header, RCE), Advanced & concurrency (6 skills such as race‑condition, HTTP smuggling, deserialization, cache‑poison), Framework‑specific (4 skills for Next.js, Node.js, Laravel, Spring Boot), Enterprise identity & cloud (3 skills for M365/Entra, Okta, cloud‑IAM), Infrastructure & appliance (4 skills for VMware vCenter, enterprise VPN, SharePoint, ASP.NET/NTLM), Red‑team tradecraft (4 skills), Recon & OSINT (4 skills), Workflow, reporting & specialized (11 skills). It also ships 15 slash commands (/hunt, /recon, /report, …) and a deterministic engagement engine that maps a target’s attack surface and routes each finding to the appropriate skill.

Asked by Youssef El-Sayed · Nov 10, 2025

What is this?

claude-bughunter is a drop-in skill bundle for the Claude Code skills system. Install once and Claude Code stops being a chatbot and starts behaving like a senior bug‑hunting researcher or red‑team operator: it knows the techniques, the chain templates, the VRT mappings, the platform CVE chains, and the hygiene — and it stays in scope. Four layers stack: Think — bb‑methodology + redteam‑mindset: the 5‑phase non‑linear workflow, critical‑thinking framework, and red‑team operator discipline. Hunt webapps — 48 hunt‑skills curated from 681 disclosed HackerOne reports: per‑class detection patterns, payloads, bypass tables, and chain templates. Hit the perimeter — enterprise platform chains (M365/Entra, Okta, vCenter, SSL‑VPN appliances, SharePoint, cloud IAM): current 2024‑2026 CVE chains + post‑credential escalation. Ship it — triage‑validation + reporting + evidence‑hygiene: the 7‑Question Gate, VRT‑aware severity, OOS rebuttals, PII redaction, and red‑team deliverables. All triggered automatically by topic — describe what you’re testing in plain English and the relevant skill loads. No invocation by name.

Asked by Ivana Novak · Sep 24, 2025

How does it work?

The bundle follows a six‑phase, non‑linear workflow: recon → map & rank → hunt → validate → report, with scope enforced in code and a 7‑Question Gate before any finding is submitted. There are two ways to drive it: describe what you’re testing in plain English and the relevant skill loads are automatically applied, or use the /hunt scaffold and the cbh CLI, which provides an engagement‑folder structure, state management, and orchestration. Documentation includes a usage guide, a worked example, a 6‑phase architecture diagram, and a skill‑to‑phase mapping.

Asked by Yuki Mori · Jul 26, 2025