cybersec

Plugin cybersec from marketplace ferr079-cybersec in ferr079/claude-code-cybersec-skills. Commands read from the repo's manifest — 13 days ago.

Skills (31)

• aide-fim

  Set up file integrity monitoring with AIDE: database initialization, rule tuning, scheduled checks, change review. Use when adding FIM to a Linux host.

• binary-exploit

  Analyze ELF binaries for memory corruption — protections, fuzzing, ROP chains, exploit development. Use on an authorized target or a CTF binary.

• bloodhound

  Map Active Directory attack paths with BloodHound — collection, Cypher queries, shortest path to Domain Admin. Use during an authorized AD assessment.

• cis-linux-hardening

  Harden a Linux endpoint against the CIS Benchmark: audit, remediation and verification of the controls that matter. Use when securing a Debian, Ubuntu or RHEL host.

• credential-dump-detect

  Detect credential dumping: LSASS access, SAM and registry hive theft, and the telemetry that catches them. Use when hunting or building detections for credential theft.

• deserialization

  Exploit insecure deserialization in Java, PHP, Python and .NET, including gadget-chain selection with ysoserial. Use during an authorized test when the target processes serialized data.

• dns-enum

  DNS enumeration and zone transfers — record analysis, brute forcing, infrastructure mapping. Use during authorized reconnaissance of a target's external surface.

• dns-exfil-analysis

  Analyze DNS logs for tunneling and exfiltration using entropy, volume and query-pattern analysis. Use when investigating suspected data theft over DNS.

• dns-exfil-detect

  Build detection for DNS exfiltration: query analysis, thresholds, alerting rules. Use when adding tunnel detection to a monitoring or SIEM stack.

• docker-forensics

  Investigate a compromised container or container host — image and layer analysis, runtime artifacts, escape indicators. Use during container incident response.

• docker-hardening

  Harden Docker for production — daemon configuration, non-root containers, capabilities, seccomp and AppArmor, image supply chain. Use when reviewing or deploying container workloads.

• hashcat

  Crack captured hashes with hashcat: mode selection, wordlist and rule strategy, mask attacks, GPU tuning. Use on hashes obtained during an authorized engagement.

• internal-pentest

  Run an internal network penetration test: host discovery, relay attacks, credential reuse, lateral movement, domain escalation. Use to structure an authorized internal engagement.

• jwt-attack

  Attack JWT authentication: RS256 to HS256 algorithm confusion, none algorithm, weak secrets, kid injection. Use when testing an authorized API that accepts JWTs.

• kerberoasting

  Extract and crack Kerberos service tickets with Impacket. Use during an authorized Active Directory assessment when valid domain credentials are available.

• lateral-movement-detect

  Detect lateral movement — pass-the-hash, PSExec, RDP hopping, remote service creation — from Windows and network telemetry. Use when hunting post-compromise activity.

• linux-audit-logs

  Investigate a Linux host through auditd and system logs — rule design, searching, reconstructing an intrusion timeline. Use when triaging suspected unauthorized access or privilege escalation.

• nmap-advanced

  Advanced Nmap scanning — asset discovery, service and version enumeration, NSE scripting, timing and evasion tuning. Use during an authorized assessment when mapping a network or fingerprinting services.

• privesc-linux

  Enumerate and exploit Linux privilege escalation paths: SUID binaries, sudo rules, capabilities, cron jobs, kernel exploits. Use on an authorized engagement or CTF box after landing a low-privilege shell.

• race-condition

  Find and exploit race conditions (TOCTOU, limit overrun) with parallel-request techniques. Use when testing authorized transactional functionality such as payments or coupons.

• security-headers

  Audit HTTP security headers — CSP, HSTS, frame options, permissions policy — with concrete fixes for each gap. Use when reviewing a web application's configuration.

• sqli-sqlmap

  Exploit SQL injection with sqlmap — detection, DBMS fingerprinting, data extraction, WAF evasion, out-of-band techniques. Use during an authorized web application test.

• ssrf

  Exploit server-side request forgery: cloud metadata endpoints, internal port scanning, filter and DNS-rebinding bypasses. Use when an authorized target fetches user-supplied URLs.

• ssti

  Detect and exploit server-side template injection (Jinja2, Twig, Freemarker, Velocity) up to remote code execution. Use during an authorized test when input reaches a template engine.

• subdomain-enum

  Enumerate subdomains with subfinder and friends, then resolve, probe and triage what is actually live. Use during authorized recon or in-scope bug bounty discovery.

• suricata-config

  Configure Suricata as an IDS/IPS — multi-threading, capture tuning, rule management, alert output. Use when deploying or troubleshooting network monitoring.

• syslog-central

  Centralize logs with rsyslog: reliable forwarding, TLS, templates, rotation and retention. Use when building or fixing a central log pipeline.

• wazuh-detection

  Deploy and tune Wazuh endpoint detection: agent rollout, custom rules, file integrity monitoring, active response. Use when building or troubleshooting endpoint detection.

• web-pentest

  Run a full web application penetration test — recon, authentication, session, injection, access control, business logic — mapped to OWASP WSTG. Use to structure an authorized engagement end to end.

• wireshark-analysis

  Analyze captured traffic with Wireshark and tshark — display filters, stream reconstruction, command-and-control and exfiltration indicators. Use when investigating an intrusion from a pcap.

• xss-testing

  Test for reflected, stored and DOM-based XSS with context-aware payloads and CSP bypass checks, following OWASP WSTG. Use during an authorized web application test.