diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..c7c6690 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,49 @@ +# Changelog + +All notable changes to `claude-red` are documented here. The library follows a phased roadmap (see [README.md](README.md#roadmap)). Versions follow [Semantic Versioning](https://semver.org/) where breaking changes mean skill renames, removals, or category restructures. + +## [Unreleased] + +### Planned + +- Phase 1 — Internal AD/Windows split (16 skills) +- Phase 2 — Cloud Identity / Hybrid (10 skills) +- Phase 3 — Wireless split (12 skills) — **mandatory for v0.3.0** +- Phase 4 — IoT split (10 skills) +- Phase 5 — Web Basics (8 skills) +- Phase 6 — Web Advanced (10 skills) + +## [0.2.0] — 2025-05 + +### Added + +- 7 new offensive skills: + - `offensive-active-directory` — AD attack methodology (Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD) + - `offensive-wifi` — 802.11 attacks (WPA2/WPA3, EAP, KARMA/Mana, KRACK, WPS, BLE, Zigbee, Z-Wave, LoRa, sub-GHz) + - `offensive-business-logic` — workflow bypass, price/coupon/refund abuse, race conditions, anti-fraud defeat, chain construction + - `offensive-toctou` — time-of-check/use across binary, kernel, web, container layers with window-widening primitives + - `offensive-iot` — hardware recon, firmware extraction, RTOS, ICS/OT, wireless protocols, MQTT/CoAP + - `offensive-mobile` — Android+iOS pentest (Frida, pinning bypass, storage, biometric, deep links, Firebase) [category-sized] + - `offensive-cloud` — AWS+Azure+GCP attack paths (privesc, IMDS, cross-account, persistence, CSPM evasion) [category-sized] +- `offensive-reporting` — pro pentest report writing methodology (CVSS scoring, evidence hygiene, executive summaries, finding templates, attack chain narratives, deliverable formats, retest discipline) + +### Changed + +- **Reorganized skills into 13 category subdirectories.** Top-level `Skills/` now contains category folders (`web/`, `auth/`, `active-directory/`, `wireless/`, `cloud/`, `mobile/`, `iot/`, `infrastructure/`, `exploit-dev/`, `fuzzing/`, `recon/`, `ai/`, `utility/`). Skill folder names unchanged. +- README rewritten with category-based navigation, badges, install snippets, and roadmap. +- SECURITY.md rewritten with intended-use scope and disclosure policy. + +### Added (Documentation & Packaging) + +- `LICENSE` — MIT (was claimed in README, file now present) +- `CONTRIBUTING.md` — skill format, frontmatter standard, review process +- `CHANGELOG.md` — this file +- `claude-skills.json` — machine-readable manifest of all skills +- `install.sh` — installer that copies skills into the Claude skills path + +## [0.1.0] — 2024 + +### Added + +- Initial library of 37 offensive security skills, derived from the SnailSploit / Sahar Shlichov offensive checklist collection +- Categories covered: web app, auth, infrastructure & binary, recon, fuzzing, AI security, utility diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..c9a599e --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,140 @@ +# Contributing to claude-red + +Thanks for contributing. This guide explains the skill format, the review process, and the conventions to keep the library coherent as it grows. + +## Quick Rules + +1. **One skill, one surface.** Prefer focused skills (`offensive-kerberoasting`) over monolithic overviews (`offensive-active-directory`). +2. **YAML frontmatter is required.** Skills without it won't load via the Claude Skills system. +3. **Cite sources.** Every technique should be attributable. Link CVEs, advisories, original research. +4. **No unauthorized targeting.** Don't include hardcoded victim domains, real customer data, or credentials. +5. **Use code blocks with language tags.** It's how Claude (and humans) parse them best. + +--- + +## Skill Format + +A skill lives at: + +``` +Skills///SKILL.md +``` + +The folder name **must** match the `name:` field in the frontmatter. + +### Frontmatter (required) + +```yaml +--- +name: offensive- +description: "One paragraph (50–500 words). State the surface, the techniques covered, and when to use this skill. Claude uses this for trigger matching — be specific about scenarios, tools, and sub-topics." +--- +``` + +The `description` is what Claude matches against. Make it dense with relevant terms an operator would mention. Avoid marketing language. + +### Body Structure (recommended) + +```markdown +# + + + +## Quick Workflow + +1. + +--- + +##
+ + + +--- + +## Detection / Defender View + + + +--- + +## Engagement Cheatsheet + + + +--- + +## Key References + +- MITRE ATT&CK / CWE / OWASP IDs +- Canonical research papers, conference talks +- Tool docs, advisory URLs +- Source: link to upstream checklist if applicable +``` + +### Style Guide + +- **Voice:** technical, second-person ("you"), present tense +- **Length:** 200–800 lines is typical; aim for depth in one surface, not breadth across many +- **Code blocks:** always specify the language (`bash`, `python`, `c`, `powershell`, `sql`, `yaml`, `http`) +- **Tables:** use for compact reference (CVE → exploitation, capability → escape, etc.) +- **No emoji** unless used as visual markers in tables (✓ ✗ ⚠) and only sparingly + +--- + +## Adding a New Skill + +1. Pick the right category folder. If none fits, propose a new one in your PR description. +2. Create `Skills///SKILL.md`. +3. Write the frontmatter and body following the structure above. +4. Update [`README.md`](README.md) — add the skill to the relevant category table. +5. Update [`CHANGELOG.md`](CHANGELOG.md) under the next version. +6. Update [`claude-skills.json`](claude-skills.json) if it exists (run `python tools/build_manifest.py` if available). +7. Run any local lint: + ```bash + ./tools/check-skill.sh Skills///SKILL.md + ``` + +## Modifying an Existing Skill + +- Preserve the `name:` field (it's a public identifier; renames are breaking changes) +- Note the edit briefly in CHANGELOG.md +- For substantive rewrites, link the prior version's SHA so reviewers can diff + +## Splitting a Monolithic Skill + +When a skill grows beyond one surface (e.g. `offensive-wifi` covering WPA2, WPA3, BLE, Zigbee), split it: + +1. Keep the original as a brief overview that points to the new focused skills +2. Move detailed content into new per-surface skills +3. Update README, CHANGELOG, and the manifest + +The roadmap in README tracks current splits. + +## Review Process + +Pull requests are reviewed for: + +- Technical accuracy (does this work? is it current?) +- Clarity (would a competent operator understand and execute?) +- Scope (one surface, not three) +- Attribution (sources cited?) +- Safety (no real targets, no live secrets, no malicious helpers) + +Expect one round of review. Maintainers may request edits before merging. + +--- + +## What We Won't Accept + +- Skills that hardcode real victim infrastructure +- Tooling that has destructive defaults without warnings +- Bypasses for vendor-mandated security telemetry without legitimate red team context +- Content under non-MIT-compatible licenses +- AI-generated skills without operator review (use Claude to draft, then verify and edit) + +--- + +## Questions + +Open a GitHub Discussion before a large PR so the maintainers can confirm the direction. For sensitive findings (a leaked credential in an example, etc.), see [SECURITY.md](SECURITY.md). diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..53e4674 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024-2025 SnailSploit / Kai Aizen + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 7a17d74..cb88c8f 100644 --- a/README.md +++ b/README.md @@ -1,34 +1,115 @@ ![claude-red banner](/assets/banner.png) +
+ # claude-red -> 38 offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator. +**Offensive security skills for Claude — drop-in `SKILL.md` files that turn Claude into a context-aware red team operator.** + +[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) +[![Skills](https://img.shields.io/badge/skills-45-red.svg)](#skill-index) +[![Categories](https://img.shields.io/badge/categories-13-orange.svg)](#categories) +[![Stars](https://img.shields.io/github/stars/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red) +[![Forks](https://img.shields.io/github/forks/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red/network/members) Built by **[SnailSploit](https://snailsploit.com)** — GenAI Security Research. ---- - -## What is this? - -`claude-red` is a curated library of offensive security skills designed for the [Claude skills system](https://docs.claude.com). Each skill is a structured `SKILL.md` file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development. - -Drop any skill into your Claude environment and it behaves like a specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. +
--- -## Structure +## Table of Contents -``` -claude-red/ -└── skills-output/ - ├── offensive-sqli/ - │ └── SKILL.md - ├── offensive-xss/ - │ └── SKILL.md - └── ... (38 total) +- [What is this](#what-is-this) +- [Quickstart](#quickstart) +- [Categories](#categories) +- [Skill Index](#skill-index) + - [Web Application](#web-application) + - [Auth & Identity](#auth--identity) + - [Active Directory](#active-directory) + - [Wireless](#wireless) + - [Cloud](#cloud) + - [Mobile](#mobile) + - [IoT & Embedded](#iot--embedded) + - [Infrastructure & Red Team](#infrastructure--red-team) + - [Exploit Development](#exploit-development) + - [Fuzzing & Vulnerability Research](#fuzzing--vulnerability-research) + - [Reconnaissance](#reconnaissance) + - [AI Security](#ai-security) + - [Utility](#utility) +- [Roadmap](#roadmap) +- [Contributing](#contributing) +- [License](#license) +- [Acknowledgements](#acknowledgements) + +--- + +## What is this + +`claude-red` is a curated library of offensive security skills for the [Claude Skills system](https://docs.claude.com). Each skill is a structured `SKILL.md` file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to ADCS abuse. + +Drop a skill into your Claude environment and it behaves like a specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using. + +**Use it for:** authorized red team engagements, bug bounty triage, security research, CTF preparation, training operators, and exploring attack surfaces methodically. + +--- + +## Quickstart + +### Claude Skills System (recommended) + +```bash +# Clone into a directory Claude will scan +git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red + +# Or install only one category +git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red +cd claude-red && git sparse-checkout set Skills/web Skills/active-directory ``` -Each directory is a self-contained skill. Point Claude at the relevant `SKILL.md` before your engagement begins. +Claude will auto-load matching skills based on conversational triggers (e.g. mentioning SQLi loads `offensive-sqli`). + +### Claude Code + +```bash +# Point Claude at a single skill before a session +cat Skills/web/offensive-sqli/SKILL.md | claude --system-file - + +# Or load a whole category +cat Skills/active-directory/**/SKILL.md | claude --system-file - +``` + +### Claude.ai (Manual) + +Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to your conversation. + +### Install Script + +```bash +./install.sh # interactive +./install.sh --target ~/.claude/skills # explicit target +./install.sh --category web # one category +``` + +--- + +## Categories + +| Category | Skills | Focus | +|---|---:|---| +| [Web Application](#web-application) | 16 | OWASP Top 10 + business logic + advanced web bug classes | +| [Auth & Identity](#auth--identity) | 2 | JWT, OAuth | +| [Active Directory](#active-directory) | 1 | On-prem AD attack methodology *(expanding)* | +| [Wireless](#wireless) | 1 | 802.11, WPA2/3, EAP, BLE, Zigbee, sub-GHz *(expanding)* | +| [Cloud](#cloud) | 1 | AWS / Azure / GCP attack paths *(expanding)* | +| [Mobile](#mobile) | 1 | Android + iOS pentest *(expanding)* | +| [IoT & Embedded](#iot--embedded) | 1 | Hardware, firmware, RTOS, ICS *(expanding)* | +| [Infrastructure & Red Team](#infrastructure--red-team) | 7 | Initial access, EDR evasion, Windows ops | +| [Exploit Development](#exploit-development) | 6 | Stack/heap, mitigations, crash analysis, TOCTOU | +| [Fuzzing & VR](#fuzzing--vulnerability-research) | 4 | libFuzzer, AFL++, bug ID, vuln classes | +| [Reconnaissance](#reconnaissance) | 2 | OSINT tooling and methodology | +| [AI Security](#ai-security) | 1 | Prompt injection, jailbreaks, RAG poisoning | +| [Utility](#utility) | 2 | Fast-checking, professional reporting | --- @@ -36,103 +117,186 @@ Each directory is a self-contained skill. Point Claude at the relevant `SKILL.md ### Web Application +`Skills/web/` + | Skill | Description | |---|---| -| `offensive-sqli` | SQL Injection — union-based, blind, OOB, bypass chains | -| `offensive-xss` | Cross-Site Scripting — stored, reflected, DOM, mutation | -| `offensive-ssrf` | Server-Side Request Forgery — cloud metadata, filter bypass | -| `offensive-ssti` | Server-Side Template Injection — engine identification, RCE paths | -| `offensive-xxe` | XML External Entity Injection — OOB exfil, blind exploitation | -| `offensive-idor` | Insecure Direct Object References — enumeration, business logic | -| `offensive-file-upload` | File Upload Vulnerabilities — extension bypass, polyglots, webshells | -| `offensive-rce` | Remote Code Execution — chaining, command injection, deserialization | -| `offensive-deserialization` | Insecure Deserialization — Java, PHP, .NET gadget chains | -| `offensive-race-condition` | Race Conditions — TOCTOU, limit bypass, concurrent request attacks | -| `offensive-request-smuggling` | HTTP Request Smuggling — CL.TE, TE.CL, pipeline desync | -| `offensive-open-redirect` | Open Redirect — OAuth abuse, phishing chains, SSRF pivots | -| `offensive-parameter-pollution` | HTTP Parameter Pollution — WAF bypass, logic confusion | -| `offensive-graphql` | GraphQL Vulnerabilities — introspection, batching, IDOR via aliases | -| `offensive-waf-bypass` | WAF Bypass Techniques — encoding, chunking, case mutation | +| [`offensive-sqli`](Skills/web/offensive-sqli/SKILL.md) | SQL injection — error/blind/OOB, DB-specific, ORM CVEs, cloud paths | +| [`offensive-xss`](Skills/web/offensive-xss/SKILL.md) | Cross-site scripting — stored, reflected, DOM, mutation | +| [`offensive-ssrf`](Skills/web/offensive-ssrf/SKILL.md) | Server-side request forgery — cloud metadata, filter bypass | +| [`offensive-ssti`](Skills/web/offensive-ssti/SKILL.md) | Server-side template injection — engine ID, RCE paths | +| [`offensive-xxe`](Skills/web/offensive-xxe/SKILL.md) | XML external entity — OOB exfil, blind exploitation | +| [`offensive-idor`](Skills/web/offensive-idor/SKILL.md) | Insecure direct object references — enumeration, business logic | +| [`offensive-file-upload`](Skills/web/offensive-file-upload/SKILL.md) | File upload — extension bypass, polyglots, webshells | +| [`offensive-rce`](Skills/web/offensive-rce/SKILL.md) | Remote code execution — chaining, command injection | +| [`offensive-deserialization`](Skills/web/offensive-deserialization/SKILL.md) | Insecure deserialization — Java/PHP/.NET gadget chains | +| [`offensive-race-condition`](Skills/web/offensive-race-condition/SKILL.md) | Race conditions — TOCTOU, single-packet, limit bypass | +| [`offensive-request-smuggling`](Skills/web/offensive-request-smuggling/SKILL.md) | HTTP request smuggling — CL.TE, TE.CL, h2 desync | +| [`offensive-open-redirect`](Skills/web/offensive-open-redirect/SKILL.md) | Open redirect — OAuth abuse, phishing, SSRF pivots | +| [`offensive-parameter-pollution`](Skills/web/offensive-parameter-pollution/SKILL.md) | HTTP parameter pollution — WAF bypass, logic confusion | +| [`offensive-graphql`](Skills/web/offensive-graphql/SKILL.md) | GraphQL — introspection, batching, IDOR via aliases | +| [`offensive-waf-bypass`](Skills/web/offensive-waf-bypass/SKILL.md) | WAF bypass — encoding, chunking, case mutation | +| [`offensive-business-logic`](Skills/web/offensive-business-logic/SKILL.md) | Business logic — workflow bypass, pricing, refunds, chains | ### Auth & Identity -| Skill | Description | -|---|---| -| `offensive-jwt` | JWT Security — alg:none, key confusion, secret cracking | -| `offensive-oauth` | OAuth Security Testing — open redirect abuse, token leakage, PKCE bypass | - -### Infrastructure & Binary +`Skills/auth/` | Skill | Description | |---|---| -| `offensive-shellcode` | Shellcode — writing, encoding, injection techniques | -| `offensive-edr-evasion` | EDR Evasion — unhooking, indirect syscalls, PPID spoofing | -| `offensive-exploit-development` | Exploit Development — stack/heap, ROP chains, mitigations | -| `offensive-exploit-dev-course` | Exploit Development (Course) — structured curriculum format | -| `offensive-basic-exploitation` | Basic Exploitation — Linux, mitigations disabled, beginner-to-mid | -| `offensive-crash-analysis` | Crash Analysis & Exploitability Assessment — triage, root cause | -| `offensive-mitigations` | Modern Kernel Exploit Mitigations — ASLR, CFG, CET, PAC | -| `offensive-windows-mitigations` | Windows Mitigations — ACG, Arbitrary Code Guard, exploit guard | -| `offensive-windows-boundaries` | Defeating Windows Security Boundaries — sandbox escape, privilege | -| `offensive-keylogger-arch` | Keylogger Architecture — novel research, input capture techniques | -| `offensive-patch-diffing` | Patch Diffing — binary diff, silent CVE discovery, variant hunting | -| `offensive-initial-access` | Modern Initial Access — phishing, drive-by, supply chain | -| `offensive-advanced-redteam` | Advanced Red Team Ops — full kill chain, C2, OpSec | +| [`offensive-jwt`](Skills/auth/offensive-jwt/SKILL.md) | JWT — alg:none, key confusion, secret cracking | +| [`offensive-oauth`](Skills/auth/offensive-oauth/SKILL.md) | OAuth — open redirect abuse, token leakage, PKCE bypass | -### Reconnaissance & OSINT +### Active Directory + +`Skills/active-directory/` | Skill | Description | |---|---| -| `offensive-osint` | OSINT Tools — recon-ng, theHarvester, Maltego, automated pipelines | -| `offensive-osint-methodology` | OSINT Methodology — structured intelligence collection framework | +| [`offensive-active-directory`](Skills/active-directory/offensive-active-directory/SKILL.md) | AD — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD | + +> **Note:** This category is being expanded. The AD overview is being split into 16 focused skills (Kerberoasting, ASREProasting, ADCS, coercion, NTLM relay, BloodHound, ticket forgery, GPO abuse, etc.). See [Roadmap](#roadmap). + +### Wireless + +`Skills/wireless/` + +| Skill | Description | +|---|---| +| [`offensive-wifi`](Skills/wireless/offensive-wifi/SKILL.md) | 802.11 — WPA2/3/EAP, KARMA/Mana, KRACK, WPS, BLE, Zigbee, sub-GHz | + +> **Note:** Being split into 12 focused skills. See [Roadmap](#roadmap). + +### Cloud + +`Skills/cloud/` + +| Skill | Description | +|---|---| +| [`offensive-cloud`](Skills/cloud/offensive-cloud/SKILL.md) | AWS / Azure / GCP — privesc, IMDS, cross-account, persistence, CSPM evasion | + +> **Note:** Cloud-identity (Entra/AAD/Okta hybrid) skills coming separately. See [Roadmap](#roadmap). + +### Mobile + +`Skills/mobile/` + +| Skill | Description | +|---|---| +| [`offensive-mobile`](Skills/mobile/offensive-mobile/SKILL.md) | Android + iOS — Frida, pinning, storage, biometric, deep links | + +### IoT & Embedded + +`Skills/iot/` + +| Skill | Description | +|---|---| +| [`offensive-iot`](Skills/iot/offensive-iot/SKILL.md) | Hardware recon, firmware, RTOS, ICS/OT, MQTT/CoAP | + +> **Note:** Being split into 10 focused skills (UART/JTAG, flash dump, fault injection, U-Boot, secure boot, RTOS, ICS protocols). See [Roadmap](#roadmap). + +### Infrastructure & Red Team + +`Skills/infrastructure/` + +| Skill | Description | +|---|---| +| [`offensive-initial-access`](Skills/infrastructure/offensive-initial-access/SKILL.md) | Phishing, drive-by, supply chain — TA0001 | +| [`offensive-advanced-redteam`](Skills/infrastructure/offensive-advanced-redteam/SKILL.md) | Full kill chain, C2, OPSEC, lateral, persistence | +| [`offensive-edr-evasion`](Skills/infrastructure/offensive-edr-evasion/SKILL.md) | Unhooking, indirect syscalls, PPID spoofing | +| [`offensive-shellcode`](Skills/infrastructure/offensive-shellcode/SKILL.md) | Writing, encoding, injection techniques | +| [`offensive-keylogger-arch`](Skills/infrastructure/offensive-keylogger-arch/SKILL.md) | Keylogger architecture and input-capture techniques | +| [`offensive-windows-mitigations`](Skills/infrastructure/offensive-windows-mitigations/SKILL.md) | Windows mitigations — ACG, Arbitrary Code Guard | +| [`offensive-windows-boundaries`](Skills/infrastructure/offensive-windows-boundaries/SKILL.md) | Defeating Windows boundaries — sandbox escape, privilege | + +### Exploit Development + +`Skills/exploit-dev/` + +| Skill | Description | +|---|---| +| [`offensive-exploit-development`](Skills/exploit-dev/offensive-exploit-development/SKILL.md) | Stack/heap, ROP chains, mitigations | +| [`offensive-exploit-dev-course`](Skills/exploit-dev/offensive-exploit-dev-course/SKILL.md) | Structured curriculum format | +| [`offensive-basic-exploitation`](Skills/exploit-dev/offensive-basic-exploitation/SKILL.md) | Linux exploitation, mitigations disabled — beginner-to-mid | +| [`offensive-crash-analysis`](Skills/exploit-dev/offensive-crash-analysis/SKILL.md) | Crash triage, exploitability assessment, root cause | +| [`offensive-mitigations`](Skills/exploit-dev/offensive-mitigations/SKILL.md) | Modern kernel mitigations — ASLR, CFG, CET, PAC | +| [`offensive-toctou`](Skills/exploit-dev/offensive-toctou/SKILL.md) | Time-of-check/use across binary, kernel, web, container | ### Fuzzing & Vulnerability Research +`Skills/fuzzing/` + | Skill | Description | |---|---| -| `offensive-fuzzing` | Fuzzing — libFuzzer, AFL++, coverage-guided, mutation strategies | -| `offensive-fuzzing-course` | Fuzzing (Course) — structured curriculum, finding vulns via fuzzing | -| `offensive-bug-identification` | Bug Identification — code review patterns, static analysis triggers | -| `offensive-vuln-classes` | Vulnerability Classes — real-world examples, root cause taxonomy | +| [`offensive-fuzzing`](Skills/fuzzing/offensive-fuzzing/SKILL.md) | libFuzzer, AFL++, coverage-guided, mutation strategies | +| [`offensive-fuzzing-course`](Skills/fuzzing/offensive-fuzzing-course/SKILL.md) | Curriculum — finding vulns via fuzzing | +| [`offensive-bug-identification`](Skills/fuzzing/offensive-bug-identification/SKILL.md) | Code review patterns, static analysis triggers | +| [`offensive-vuln-classes`](Skills/fuzzing/offensive-vuln-classes/SKILL.md) | Vulnerability classes — real-world examples, taxonomy | + +### Reconnaissance + +`Skills/recon/` + +| Skill | Description | +|---|---| +| [`offensive-osint`](Skills/recon/offensive-osint/SKILL.md) | OSINT tools — recon-ng, theHarvester, Maltego pipelines | +| [`offensive-osint-methodology`](Skills/recon/offensive-osint-methodology/SKILL.md) | OSINT methodology — structured intelligence collection | ### AI Security +`Skills/ai/` + | Skill | Description | |---|---| -| `offensive-ai-security` | AI Pentest — prompt injection, jailbreaking, RAG poisoning, LLM abuse | +| [`offensive-ai-security`](Skills/ai/offensive-ai-security/SKILL.md) | AI pentest — prompt injection, jailbreaking, RAG poisoning | ### Utility +`Skills/utility/` + | Skill | Description | |---|---| -| `offensive-fast-checking` | Fast Testing Checklist — rapid triage, quick win identification | +| [`offensive-fast-checking`](Skills/utility/offensive-fast-checking/SKILL.md) | Fast triage checklist — quick-win identification | +| [`offensive-reporting`](Skills/utility/offensive-reporting/SKILL.md) | Pro pentest reporting — CVSS, evidence, exec summary, retest | --- -## Usage +## Roadmap -### With Claude Code -```bash -# Point Claude at a skill before starting your session -cat skills-output/offensive-sqli/SKILL.md | claude --system-file - -``` +The library is being expanded in seven phases. Track progress in [CHANGELOG.md](CHANGELOG.md). -### With the Claude Skills System -Place any skill folder under your configured skills path (e.g., `/mnt/skills/user/`) and Claude will auto-load it based on trigger keywords. +| Phase | Category | New Skills | Status | +|---|---|---:|---| +| 1 | Internal AD/Windows (rename `active-directory/` → `internal/`) | +16 | Planned | +| 2 | Cloud Identity (Entra/AAD, ADFS, Okta, M365) | +10 | Planned | +| 3 | Wireless split (WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz) | +12 | **Mandatory** | +| 4 | IoT split (UART/JTAG, flash, fault injection, RTOS, ICS) | +10 | Planned | +| 5 | Web Basics (recon, auth bypass, access control, CSRF, headers, CORS, cache, clickjack) | +8 | Planned | +| 6 | Web Advanced (proto pollution, SAML, OIDC, WebSocket, gRPC, postMessage, SSI/ESI, CSTI) | +10 | Planned | +| 7 | Polish (README, LICENSE, manifest, install) | — | **In progress** | -### Manual (Claude.ai) -Paste the contents of any `SKILL.md` into a Project's system prompt or prepend it to your conversation. +End state: ~107 skills across the same 13+ categories. --- -## About +## Contributing -These skills were developed through real-world red team engagements, bug bounty hunting, and security research. They encode the decision trees, tool selection logic, and escalation patterns that an experienced operator uses — not just a list of commands. +Contributions welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the skill template, frontmatter standard, and review process. Focused, single-surface skills are preferred over monolithic overviews. -**Author:** Kai Aizen (SnailSploit) — [snailsploit.com](https://snailsploit.com) -**Original Checklists:** [Sahar Shlichov](https://github.com/sahar042/offensive-checklist) — the offensive checklist collection this skill library is based on. -**License:** MIT — use freely, attribution appreciated. +## License + +[MIT](LICENSE) — use freely, attribution appreciated. + +## Acknowledgements + +- **Author:** Kai Aizen (SnailSploit) — [snailsploit.com](https://snailsploit.com) +- **Original Checklists:** [Sahar Shlichov](https://github.com/sahar042/offensive-checklist) — the offensive checklist collection many of these skills are based on. +- **Community:** PRs and feedback that keep the library current with the threat landscape. --- +
+ > *"Give Claude the right skill and it stops being a chatbot. It becomes an operator."* + +
diff --git a/SECURITY.md b/SECURITY.md index 034e848..c81b158 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,21 +1,63 @@ # Security Policy -## Supported Versions +`claude-red` is an offensive security tooling library. Its content describes attack methodologies for use by authorized red team operators, penetration testers, and security researchers. -Use this section to tell people about which versions of your project are -currently being supported with security updates. +## Intended Use -| Version | Supported | -| ------- | ------------------ | -| 5.1.x | :white_check_mark: | -| 5.0.x | :x: | -| 4.0.x | :white_check_mark: | -| < 4.0 | :x: | +These skills are intended for: -## Reporting a Vulnerability +- Authorized penetration testing engagements with documented scope and rules of engagement +- Bug bounty programs with explicit written permission for the techniques described +- CTF competitions and security training environments +- Independent vulnerability research with responsible disclosure -Use this section to tell people how to report a vulnerability. +These skills are **not** intended for unauthorized access to systems you do not own or do not have explicit, written permission to test. Misuse may violate computer-misuse laws in your jurisdiction (CFAA in the US, Computer Misuse Act in the UK, equivalent statutes elsewhere). -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. +## Reporting a Vulnerability in claude-red Itself + +If you discover a security issue in this repository — for example a malicious payload accidentally committed, a credential leaked in an example, a typosquat-prone install path, or an unsafe shell command in `install.sh` — please report it privately rather than opening a public issue. + +**Contact:** security@snailsploit.com + +Please include: + +- Affected file(s) and commit hash +- A description of the issue and its impact +- Reproduction steps if applicable +- Any suggested remediation + +We aim to acknowledge reports within 72 hours and resolve confirmed issues within 14 days. + +## Reporting a Vulnerability Found Using This Library + +If you discover a vulnerability in a third-party product or service while using `claude-red`'s methodologies, follow that vendor's responsible disclosure process. The [`offensive-reporting`](Skills/utility/offensive-reporting/SKILL.md) skill includes guidance on responsible disclosure, evidence handling, and report writing. + +If the vendor has no published security contact: + +- Try `security@`, then their PSIRT page, then `report` mailing addresses +- For ICS/OT vendors, escalate via [CISA ICS-CERT](https://www.cisa.gov/uscert/ics) +- For broad-impact bugs, request a CVE via [MITRE CNAs](https://www.cve.org/PartnerInformation/ListofPartners) +- Allow at least 90 days before public disclosure unless the vulnerability is being actively exploited + +## Supply Chain Integrity + +This repository is signed by SnailSploit. Verify commit signatures with: + +```bash +git log --show-signature +``` + +If you receive a `claude-red` archive from a third party (mirror, pastebin, package manager), verify it against the upstream repository before using. + +## Scope + +| In scope | Out of scope | +|---|---| +| Issues in repository content (skills, scripts, install logic) | Vulnerabilities in third-party tools mentioned in skills | +| Malicious payloads in examples | The Claude platform itself (report to Anthropic) | +| Unsafe installation defaults | Bugs in tools you find using this library | +| Leaked credentials in example traffic | Bugs in your own implementation of techniques described | + +## Acknowledgements + +We credit researchers who report security issues responsibly in the project [CHANGELOG](CHANGELOG.md). Let us know if you'd prefer to remain anonymous. diff --git a/claude-skills.json b/claude-skills.json new file mode 100644 index 0000000..112e1e9 --- /dev/null +++ b/claude-skills.json @@ -0,0 +1,353 @@ +{ + "name": "claude-red", + "version": "0.2.0", + "license": "MIT", + "homepage": "https://github.com/SnailSploit/claude-red", + "categories": { + "active-directory": [ + "offensive-active-directory" + ], + "ai": [ + "offensive-ai-security" + ], + "auth": [ + "offensive-jwt", + "offensive-oauth" + ], + "cloud": [ + "offensive-cloud" + ], + "exploit-dev": [ + "offensive-basic-exploitation", + "offensive-crash-analysis", + "offensive-exploit-dev-course", + "offensive-exploit-development", + "offensive-mitigations", + "offensive-toctou" + ], + "fuzzing": [ + "offensive-bug-identification", + "offensive-fuzzing", + "offensive-fuzzing-course", + "offensive-vuln-classes" + ], + "infrastructure": [ + "offensive-advanced-redteam", + "offensive-edr-evasion", + "offensive-initial-access", + "offensive-keylogger-arch", + "offensive-shellcode", + "offensive-windows-boundaries", + "offensive-windows-mitigations" + ], + "iot": [ + "offensive-iot" + ], + "mobile": [ + "offensive-mobile" + ], + "recon": [ + "offensive-osint", + "offensive-osint-methodology" + ], + "utility": [ + "offensive-fast-checking", + "offensive-reporting" + ], + "web": [ + "offensive-business-logic", + "offensive-deserialization", + "offensive-file-upload", + "offensive-graphql", + "offensive-idor", + "offensive-open-redirect", + "offensive-parameter-pollution", + "offensive-race-condition", + "offensive-rce", + "offensive-request-smuggling", + "offensive-sqli", + "offensive-ssrf", + "offensive-ssti", + "offensive-waf-bypass", + "offensive-xss", + "offensive-xxe" + ], + "wireless": [ + "offensive-wifi" + ] + }, + "skills": [ + { + "name": "offensive-active-directory", + "category": "active-directory", + "path": "Skills/active-directory/offensive-active-directory/SKILL.md", + "description": "Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments." + }, + { + "name": "offensive-ai-security", + "category": "ai", + "path": "Skills/ai/offensive-ai-security/SKILL.md", + "description": "" + }, + { + "name": "offensive-jwt", + "category": "auth", + "path": "Skills/auth/offensive-jwt/SKILL.md", + "description": "JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps." + }, + { + "name": "offensive-oauth", + "category": "auth", + "path": "Skills/auth/offensive-oauth/SKILL.md", + "description": "" + }, + { + "name": "offensive-cloud", + "category": "cloud", + "path": "Skills/cloud/offensive-cloud/SKILL.md", + "description": "Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or when assessing cloud posture." + }, + { + "name": "offensive-basic-exploitation", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-basic-exploitation/SKILL.md", + "description": "" + }, + { + "name": "offensive-crash-analysis", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-crash-analysis/SKILL.md", + "description": "" + }, + { + "name": "offensive-exploit-dev-course", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-exploit-dev-course/SKILL.md", + "description": "" + }, + { + "name": "offensive-exploit-development", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-exploit-development/SKILL.md", + "description": "" + }, + { + "name": "offensive-mitigations", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-mitigations/SKILL.md", + "description": "" + }, + { + "name": "offensive-toctou", + "category": "exploit-dev", + "path": "Skills/exploit-dev/offensive-toctou/SKILL.md", + "description": "Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators." + }, + { + "name": "offensive-bug-identification", + "category": "fuzzing", + "path": "Skills/fuzzing/offensive-bug-identification/SKILL.md", + "description": "" + }, + { + "name": "offensive-fuzzing", + "category": "fuzzing", + "path": "Skills/fuzzing/offensive-fuzzing/SKILL.md", + "description": "Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes." + }, + { + "name": "offensive-fuzzing-course", + "category": "fuzzing", + "path": "Skills/fuzzing/offensive-fuzzing-course/SKILL.md", + "description": "" + }, + { + "name": "offensive-vuln-classes", + "category": "fuzzing", + "path": "Skills/fuzzing/offensive-vuln-classes/SKILL.md", + "description": "" + }, + { + "name": "offensive-advanced-redteam", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-advanced-redteam/SKILL.md", + "description": "" + }, + { + "name": "offensive-edr-evasion", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-edr-evasion/SKILL.md", + "description": "" + }, + { + "name": "offensive-initial-access", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-initial-access/SKILL.md", + "description": "" + }, + { + "name": "offensive-keylogger-arch", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-keylogger-arch/SKILL.md", + "description": "" + }, + { + "name": "offensive-shellcode", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-shellcode/SKILL.md", + "description": "Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques." + }, + { + "name": "offensive-windows-boundaries", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-windows-boundaries/SKILL.md", + "description": "" + }, + { + "name": "offensive-windows-mitigations", + "category": "infrastructure", + "path": "Skills/infrastructure/offensive-windows-mitigations/SKILL.md", + "description": "" + }, + { + "name": "offensive-iot", + "category": "iot", + "path": "Skills/iot/offensive-iot/SKILL.md", + "description": "IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research." + }, + { + "name": "offensive-mobile", + "category": "mobile", + "path": "Skills/mobile/offensive-mobile/SKILL.md", + "description": "Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance." + }, + { + "name": "offensive-osint", + "category": "recon", + "path": "Skills/recon/offensive-osint/SKILL.md", + "description": "Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map." + }, + { + "name": "offensive-osint-methodology", + "category": "recon", + "path": "Skills/recon/offensive-osint-methodology/SKILL.md", + "description": "" + }, + { + "name": "offensive-fast-checking", + "category": "utility", + "path": "Skills/utility/offensive-fast-checking/SKILL.md", + "description": "" + }, + { + "name": "offensive-reporting", + "category": "utility", + "path": "Skills/utility/offensive-reporting/SKILL.md", + "description": "Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice." + }, + { + "name": "offensive-business-logic", + "category": "web", + "path": "Skills/web/offensive-business-logic/SKILL.md", + "description": "Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact." + }, + { + "name": "offensive-deserialization", + "category": "web", + "path": "Skills/web/offensive-deserialization/SKILL.md", + "description": "" + }, + { + "name": "offensive-file-upload", + "category": "web", + "path": "Skills/web/offensive-file-upload/SKILL.md", + "description": "" + }, + { + "name": "offensive-graphql", + "category": "web", + "path": "Skills/web/offensive-graphql/SKILL.md", + "description": "" + }, + { + "name": "offensive-idor", + "category": "web", + "path": "Skills/web/offensive-idor/SKILL.md", + "description": "" + }, + { + "name": "offensive-open-redirect", + "category": "web", + "path": "Skills/web/offensive-open-redirect/SKILL.md", + "description": "" + }, + { + "name": "offensive-parameter-pollution", + "category": "web", + "path": "Skills/web/offensive-parameter-pollution/SKILL.md", + "description": "" + }, + { + "name": "offensive-race-condition", + "category": "web", + "path": "Skills/web/offensive-race-condition/SKILL.md", + "description": "" + }, + { + "name": "offensive-rce", + "category": "web", + "path": "Skills/web/offensive-rce/SKILL.md", + "description": "" + }, + { + "name": "offensive-request-smuggling", + "category": "web", + "path": "Skills/web/offensive-request-smuggling/SKILL.md", + "description": "" + }, + { + "name": "offensive-sqli", + "category": "web", + "path": "Skills/web/offensive-sqli/SKILL.md", + "description": "SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks." + }, + { + "name": "offensive-ssrf", + "category": "web", + "path": "Skills/web/offensive-ssrf/SKILL.md", + "description": "" + }, + { + "name": "offensive-ssti", + "category": "web", + "path": "Skills/web/offensive-ssti/SKILL.md", + "description": "" + }, + { + "name": "offensive-waf-bypass", + "category": "web", + "path": "Skills/web/offensive-waf-bypass/SKILL.md", + "description": "" + }, + { + "name": "offensive-xss", + "category": "web", + "path": "Skills/web/offensive-xss/SKILL.md", + "description": "" + }, + { + "name": "offensive-xxe", + "category": "web", + "path": "Skills/web/offensive-xxe/SKILL.md", + "description": "" + }, + { + "name": "offensive-wifi", + "category": "wireless", + "path": "Skills/wireless/offensive-wifi/SKILL.md", + "description": "Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X bypass, MAC randomization defeat, BLE/Zigbee/IEEE 802.15.4 sidebands, and Wi-Fi 6/6E/7 considerations. Use when scoping wireless pentest, war-driving an estate, or testing corporate wireless segmentation." + } + ], + "skill_count": 45, + "category_count": 13 +} diff --git a/install.sh b/install.sh new file mode 100755 index 0000000..2000837 --- /dev/null +++ b/install.sh @@ -0,0 +1,108 @@ +#!/usr/bin/env bash +# claude-red installer +# Copies offensive security skills into a Claude skills directory. +# +# Usage: +# ./install.sh # interactive (asks for target) +# ./install.sh --target ~/.claude/skills # explicit target +# ./install.sh --category web # one category only +# ./install.sh --target DIR --category web # combined +# ./install.sh --list # list available categories +# ./install.sh --dry-run # show what would be copied +# +# Default target: ~/.claude/skills/claude-red + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +SKILLS_DIR="$SCRIPT_DIR/Skills" +DEFAULT_TARGET="${HOME}/.claude/skills/claude-red" + +TARGET="" +CATEGORY="" +DRY_RUN=0 +LIST_ONLY=0 + +usage() { + sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//' + exit "${1:-0}" +} + +list_categories() { + echo "Available categories:" + for d in "$SKILLS_DIR"/*/; do + [ -d "$d" ] || continue + name=$(basename "$d") + count=$(find "$d" -name SKILL.md | wc -l | tr -d ' ') + printf " %-20s %s skill(s)\n" "$name" "$count" + done +} + +while [ $# -gt 0 ]; do + case "$1" in + --target) TARGET="$2"; shift 2 ;; + --category) CATEGORY="$2"; shift 2 ;; + --dry-run) DRY_RUN=1; shift ;; + --list) LIST_ONLY=1; shift ;; + -h|--help) usage 0 ;; + *) echo "Unknown option: $1" >&2; usage 1 ;; + esac +done + +if [ "$LIST_ONLY" -eq 1 ]; then + list_categories + exit 0 +fi + +if [ ! -d "$SKILLS_DIR" ]; then + echo "Error: Skills directory not found at $SKILLS_DIR" >&2 + exit 1 +fi + +# Interactive prompt if no target given +if [ -z "$TARGET" ]; then + if [ -t 0 ]; then + read -r -p "Install target [$DEFAULT_TARGET]: " TARGET || true + fi + TARGET="${TARGET:-$DEFAULT_TARGET}" +fi + +# Validate category if specified +if [ -n "$CATEGORY" ]; then + if [ ! -d "$SKILLS_DIR/$CATEGORY" ]; then + echo "Error: Category '$CATEGORY' not found." >&2 + echo "" >&2 + list_categories >&2 + exit 1 + fi + SOURCE="$SKILLS_DIR/$CATEGORY" + DEST="$TARGET/$CATEGORY" +else + SOURCE="$SKILLS_DIR" + DEST="$TARGET" +fi + +echo "Source: $SOURCE" +echo "Target: $DEST" +echo + +if [ "$DRY_RUN" -eq 1 ]; then + echo "[dry-run] Would copy:" + find "$SOURCE" -name SKILL.md | sed "s|^$SOURCE| $DEST|" + exit 0 +fi + +mkdir -p "$DEST" + +# Use rsync if available for nicer output, else cp -r +if command -v rsync >/dev/null 2>&1; then + rsync -a --info=stats1 "$SOURCE/" "$DEST/" +else + cp -r "$SOURCE/." "$DEST/" + echo "Copied via cp (install rsync for progress info)." +fi + +skill_count=$(find "$DEST" -name SKILL.md | wc -l | tr -d ' ') +echo +echo "Installed $skill_count skill(s) to $DEST" +echo "Claude should now auto-discover them on next session start." diff --git a/tools/build_manifest.py b/tools/build_manifest.py new file mode 100755 index 0000000..b5536ba --- /dev/null +++ b/tools/build_manifest.py @@ -0,0 +1,91 @@ +#!/usr/bin/env python3 +"""Generate claude-skills.json manifest from Skills/ tree. + +Reads YAML frontmatter from each SKILL.md and emits a compact JSON manifest +of all skills, grouped by category, for tooling that needs a machine-readable +index of the library. +""" +from __future__ import annotations + +import json +import re +import sys +from pathlib import Path + +ROOT = Path(__file__).resolve().parent.parent +SKILLS_DIR = ROOT / "Skills" +OUT = ROOT / "claude-skills.json" + +FRONTMATTER_RE = re.compile(r"^---\n(.*?)\n---", re.DOTALL) + + +def parse_frontmatter(text: str) -> dict: + m = FRONTMATTER_RE.match(text) + if not m: + return {} + block = m.group(1) + out: dict[str, str] = {} + current_key: str | None = None + buf: list[str] = [] + for line in block.splitlines(): + if not line.strip(): + continue + if ":" in line and not line.startswith(" "): + if current_key is not None: + out[current_key] = "\n".join(buf).strip().strip('"') + buf = [] + key, _, val = line.partition(":") + current_key = key.strip() + val = val.strip() + if val: + buf.append(val) + else: + buf.append(line.strip()) + if current_key is not None: + out[current_key] = "\n".join(buf).strip().strip('"') + return out + + +def main() -> int: + if not SKILLS_DIR.is_dir(): + print(f"Error: {SKILLS_DIR} not found", file=sys.stderr) + return 1 + + manifest: dict = { + "name": "claude-red", + "version": "0.2.0", + "license": "MIT", + "homepage": "https://github.com/SnailSploit/claude-red", + "categories": {}, + "skills": [], + } + + for category_dir in sorted(SKILLS_DIR.iterdir()): + if not category_dir.is_dir(): + continue + category = category_dir.name + manifest["categories"][category] = [] + for skill_dir in sorted(category_dir.iterdir()): + skill_md = skill_dir / "SKILL.md" + if not skill_md.is_file(): + continue + fm = parse_frontmatter(skill_md.read_text(encoding="utf-8")) + entry = { + "name": fm.get("name", skill_dir.name), + "category": category, + "path": str(skill_md.relative_to(ROOT)), + "description": fm.get("description", ""), + } + manifest["categories"][category].append(entry["name"]) + manifest["skills"].append(entry) + + manifest["skill_count"] = len(manifest["skills"]) + manifest["category_count"] = len(manifest["categories"]) + + OUT.write_text(json.dumps(manifest, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") + print(f"Wrote {OUT} with {manifest['skill_count']} skills across {manifest['category_count']} categories.") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main())