SnailSploit/Claude-Red

Agent skills in the GitHub repository SnailSploit/Claude-Red, each with its code score out of 100.

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.

Repository score

51 / 100 D

Skills

79

Verified

0

Average skill score

51

GitHub stars

10,645

License

MIT

Open SnailSploit/Claude-Red on GitHub

79 skills in this repository

1. offensive-wpa-enterprise

   WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks wit…

   72B
2. offensive-container-escape

   Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker sock…

   68C
3. offensive-deauth-disassoc

   Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-fr…

   67C
4. offensive-toctou

   Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/…

   67C
5. offensive-krack-fragattacks

   KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanho…

   65C
6. offensive-mobile

   Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with…

   65C
7. offensive-bluetooth-ble

   Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM…

   64C
8. offensive-data-exfiltration

   Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-…

   64C
9. offensive-network-attacks

   Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, R…

   64C
10. offensive-reporting

    Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, sev…

    63C
11. offensive-wifi

    Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3…

    63C
12. offensive-active-directory

    Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProa…

    62C
13. offensive-business-logic

    Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulati…

    62C
14. offensive-iot

    IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals,…

    62C
15. offensive-wifi-recon

    Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSI…

    62C
16. offensive-wps

    WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reave…

    62C
17. offensive-wpa3-sae

    WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377,…

    61C
18. offensive-zigbee-thread-matter

    Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning a…

    61C
19. offensive-tls-attacks

    Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade atta…

    60C
20. offensive-cloud

    Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-…

    59C
21. offensive-deserialization

    Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream an…

    59C
22. offensive-crypto-attacks

    Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers wi…

    58C
23. offensive-linux-privesc

    Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse…

    58C
24. offensive-osint

    Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media p…

    58C
25. offensive-windows-privesc

    Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\SYSTEM: token…

    58C
26. offensive-anti-forensics

    Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider…

    57C
27. offensive-jwt

    JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), j…

    57C
28. offensive-lateral-movement

    Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay at…

    57C
29. offensive-wpa2-psk

    WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat h…

    57C
30. offensive-bluetooth-classic

    Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-tran…

    56C
31. offensive-lorawan-sub-ghz

    LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-styl…

    56C
32. offensive-phishing

    Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration,…

    56C
33. offensive-social-engineering

    Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, a…

    56C
34. offensive-sqli

    SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL,…

    56C
35. offensive-supply-chain

    Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across…

    56C
36. offensive-z-wave

    Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis…

    56C
37. offensive-evil-twin

    Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe respons…

    55C
38. offensive-advanced-redteam

    Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation,…

    54D
39. offensive-api-security

    Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken au…

    54D
40. offensive-k8s-attacks

    Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersona…

    54D
41. offensive-persistence

    Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tas…

    54D
42. offensive-shellcode

    Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loa…

    54D
43. offensive-api-abuse

    Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass thr…

    53D
44. offensive-cicd-secrets

    Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of v…

    52D
45. offensive-ssti

    Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprint…

    52D
46. offensive-c2-frameworks

    Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/…

    51D
47. offensive-dependency-confusion

    Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public an…

    51D
48. offensive-graphql

    Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and…

    51D
49. offensive-fuzzing

    Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutat…

    49D
50. offensive-basic-exploitation
    48D
51. offensive-cicd-pipeline

    Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GIT…

    47D
52. offensive-vuln-classes
    47D
53. offensive-crash-analysis
    46D
54. offensive-windows-mitigations
    46D
55. offensive-netexec

    Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of '…

    45D
56. offensive-windows-boundaries
    44D
57. offensive-mitigations
    43D
58. offensive-bug-identification
    41D
59. offensive-exploit-development
    40D
60. offensive-keylogger-arch
    40D
61. offensive-rce
    40D
62. offensive-xss
    40D
63. offensive-xxe
    40D
64. offensive-ai-security
    39F
65. offensive-fast-checking
    39F
66. offensive-osint-methodology
    39F
67. offensive-fuzzing-course
    38F
68. offensive-file-upload
    37F
69. offensive-idor
    37F
70. offensive-ssrf
    37F
71. offensive-oauth
    35F
72. offensive-open-redirect
    35F
73. offensive-exploit-dev-course
    34F
74. offensive-race-condition
    33F
75. offensive-parameter-pollution
    32F
76. offensive-request-smuggling
    32F
77. offensive-edr-evasion
    30F
78. offensive-waf-bypass
    29F
79. offensive-initial-access
    28F

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.