attack-path-architect

Name: attack-path-architect
Author: Orizon-eu

18stars4forks

How to install attack-path-architect?

orizon-eu/claude-code-pentest/attack-path-architect

$npx -y skills add Orizon-eu/claude-code-pentest --skill attack-path-architect

Installs into the current project.

Summary

Generates strategic attack trees and kill chains from reconnaissance data or domain input. Maps MITRE ATT&CK TTPs, identifies chaining opportunities, trust relationships, and prioritizes attack paths by feasibility and impact. Use when user asks for "attack path", "kill chain", "

Files · 1

View on GitHub

SKILL.md

1	# Attack Path Architect
2
3	Strategic attack path generator. Transforms reconnaissance data into actionable kill chains mapped to MITRE ATT&CK.
4
5	## Important
6
7	CRITICAL: This skill is for authorized penetration testing and red team engagements ONLY. Confirm authorization before generating attack paths.
8
9	## Instructions
10
11	### Step 1: Input Collection
12	Accept one of these inputs:
13	1. Recon JSON data from recon-dominator (consolidated.json or individual module outputs)
14	2. Raw domain - will perform lightweight recon first to gather data
15	3. Manual asset list - user provides hostnames, IPs, services, technologies
16
17	If the user provides only a domain, run a quick recon summary first using recon-dominator scripts, then proceed.
18
19	### Step 2: Asset Classification
20
21	```bash
22	python scripts/classify_assets.py --input {recon_data}
23	```
24
25	Classify every discovered asset by:
26
27	Exposure Level:
28	- EXTERNAL: Internet-facing, directly reachable
29	- SEMI-EXTERNAL: Behind CDN/WAF but still reachable
30	- INTERNAL-EXPOSED: Internal service accidentally exposed (common with cloud misconfig)
31
32	Asset Type:
33	- WEB_APP: Web applications (highest attack surface)
34	- API: REST/GraphQL/SOAP endpoints
35	- MAIL: Email infrastructure
36	- DNS: DNS servers
37	- VPN: VPN gateways
38	- DATABASE: Exposed database services
39	- ADMIN_PANEL: Management interfaces
40	- CI_CD: Build/deploy infrastructure
41	- MONITORING: Grafana, Kibana, Prometheus, etc.
42	- STORAGE: S3, GCS, Azure Blob, etc.
43	- LEGACY: Old/deprecated systems still running
44
45	Risk Score (1-10): Based on technology age, known CVE count, misconfiguration signals, exposure level.
46
47	### Step 3: Trust Relationship Mapping
48
49	```bash
50	python scripts/map_trust.py --input {recon_data}
51	```
52
53	Identify trust relationships between assets:
54	- SSO/OAuth connections: Shared authentication across subdomains
55	- Cookie scope: Wildcard cookies (.domain.com) enabling session sharing
56	- API dependencies: Internal APIs called by external apps
57	- DNS relationships: CNAME chains, shared nameservers
58	- Certificate sharing: Shared TLS certificates (SAN entries)
59	- IP proximity: Assets in same subnet/ASN suggesting shared infrastructure
60
61	Output: Directed graph of trust relationships in JSON format.
62
63	### Step 4: Attack Tree Generation
64
65	```bash
66	python scripts/generate_attack_tree.py --input {classified_assets} --trust-map {trust_map} --objective {objective}
67	```
68
69	For each objective (RCE, Data Access, Lateral Movement, Privilege Escalation), generate attack trees:
70
71	Tree Structure:
72	```
73	OBJECTIVE: Remote Code Execution on production
74	\|
75	+-- PATH 1: Web Application Exploitation (Feasibility: HIGH)
76	\| +-- Step 1: Identify injectable parameter on app.target.com
77	\| \| TTP: T1190 - Exploit Public-Facing Application
78	\| \| Tools: sqlmap, Burp Suite
79	\| +-- Step 2: Achieve SQL injection -> OS command execution
80	\| \| TTP: T1059 - Command and Scripting Interpreter
81	\| +-- Step 3: Establish reverse shell
82	\| TTP: T1059.004 - Unix Shell
83	\|
84	+-- PATH 2: Cloud Pivot via SSRF (Feasibility: MEDIUM)
85	\| +-- Step 1: Find SSRF in PDF generator on docs.target.com
86	\| \| TTP: T1190 - Exploit Public-Facing Application
87	\| +-- Step 2: Access cloud metadata (169.254.169.254)
88	\| \| TTP: T1552.005 - Cloud Instance Metadata API
89	\| +-- Step 3: Extract IAM credentials
90	\| \| TTP: T1078.004 - Cloud Accounts
91	\| +-- Step 4: Use credentials to access EC2/Lambda
92	\| TTP: T1078 - Valid Accounts
93	```
94
95	### Step 5: Chaining Opportunity Analysis
96
97	```bash
98	python scripts/find_chains.py --attack-tree {tree_file} --trust-map {trust_map}
99	```
100
101	Identify where vulnerabilities on different assets can be chained:
102	- XSS on subdomain A -> cookie theft -> session on subdomain B (shared cookie scope)
103	- SSRF on app -> cloud metadata -> credentials -> S3 bucket access
104	- SQL injection -> database credentials -> access to internal API
105	- Admin panel default creds -> CI/CD access -> code deployment -> RCE
106	- DNS takeover -> phishing page -> credential capture -> internal access
107
108	For each chain:
109	1. List all steps with specific assets
110	2. Assign overall feasibility score
111	3. Estimate impact (what access is gained)
112	4. Map full MITRE ATT&CK path
113
114	### Step 6: Priority Ranking
115
116	Score each attack path on:
117	- Feasibility (1-10): How likely is successful exploitation?
118	- Known CVEs: +3
119	- Default credentials: +3
120	- Missing security headers: +1
121	- Outdated software: +2
122	- Exposed admin panel: +2
123	-

People who liked this also viewed

6 picks

Type

attack-path-architect

18stars4forks

View on GitHub

How to install attack-path-architect?

orizon-eu/claude-code-pentest/attack-path-architect

$npx -y skills add Orizon-eu/claude-code-pentest --skill attack-path-architect

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Attack Path Architect
2
3	Strategic attack path generator. Transforms reconnaissance data into actionable kill chains mapped to MITRE ATT&CK.
4
5	## Important
6
7	CRITICAL: This skill is for authorized penetration testing and red team engagements ONLY. Confirm authorization before generating attack paths.
8
9	## Instructions
10
11	### Step 1: Input Collection
12	Accept one of these inputs:
13	1. Recon JSON data from recon-dominator (consolidated.json or individual module outputs)
14	2. Raw domain - will perform lightweight recon first to gather data
15	3. Manual asset list - user provides hostnames, IPs, services, technologies
16
17	If the user provides only a domain, run a quick recon summary first using recon-dominator scripts, then proceed.
18
19	### Step 2: Asset Classification
20
21	```bash
22	python scripts/classify_assets.py --input {recon_data}
23	```
24
25	Classify every discovered asset by:
26
27	Exposure Level:
28	- EXTERNAL: Internet-facing, directly reachable
29	- SEMI-EXTERNAL: Behind CDN/WAF but still reachable
30	- INTERNAL-EXPOSED: Internal service accidentally exposed (common with cloud misconfig)
31
32	Asset Type:
33	- WEB_APP: Web applications (highest attack surface)
34	- API: REST/GraphQL/SOAP endpoints
35	- MAIL: Email infrastructure
36	- DNS: DNS servers
37	- VPN: VPN gateways
38	- DATABASE: Exposed database services
39	- ADMIN_PANEL: Management interfaces
40	- CI_CD: Build/deploy infrastructure
41	- MONITORING: Grafana, Kibana, Prometheus, etc.
42	- STORAGE: S3, GCS, Azure Blob, etc.
43	- LEGACY: Old/deprecated systems still running
44
45	Risk Score (1-10): Based on technology age, known CVE count, misconfiguration signals, exposure level.
46
47	### Step 3: Trust Relationship Mapping
48
49	```bash
50	python scripts/map_trust.py --input {recon_data}
51	```
52
53	Identify trust relationships between assets:
54	- SSO/OAuth connections: Shared authentication across subdomains
55	- Cookie scope: Wildcard cookies (.domain.com) enabling session sharing
56	- API dependencies: Internal APIs called by external apps
57	- DNS relationships: CNAME chains, shared nameservers
58	- Certificate sharing: Shared TLS certificates (SAN entries)
59	- IP proximity: Assets in same subnet/ASN suggesting shared infrastructure
60
61	Output: Directed graph of trust relationships in JSON format.
62
63	### Step 4: Attack Tree Generation
64
65	```bash
66	python scripts/generate_attack_tree.py --input {classified_assets} --trust-map {trust_map} --objective {objective}
67	```
68
69	For each objective (RCE, Data Access, Lateral Movement, Privilege Escalation), generate attack trees:
70
71	Tree Structure:
72	```
73	OBJECTIVE: Remote Code Execution on production
74	\|
75	+-- PATH 1: Web Application Exploitation (Feasibility: HIGH)
76	\| +-- Step 1: Identify injectable parameter on app.target.com
77	\| \| TTP: T1190 - Exploit Public-Facing Application
78	\| \| Tools: sqlmap, Burp Suite
79	\| +-- Step 2: Achieve SQL injection -> OS command execution
80	\| \| TTP: T1059 - Command and Scripting Interpreter
81	\| +-- Step 3: Establish reverse shell
82	\| TTP: T1059.004 - Unix Shell
83	\|
84	+-- PATH 2: Cloud Pivot via SSRF (Feasibility: MEDIUM)
85	\| +-- Step 1: Find SSRF in PDF generator on docs.target.com
86	\| \| TTP: T1190 - Exploit Public-Facing Application
87	\| +-- Step 2: Access cloud metadata (169.254.169.254)
88	\| \| TTP: T1552.005 - Cloud Instance Metadata API
89	\| +-- Step 3: Extract IAM credentials
90	\| \| TTP: T1078.004 - Cloud Accounts
91	\| +-- Step 4: Use credentials to access EC2/Lambda
92	\| TTP: T1078 - Valid Accounts
93	```
94
95	### Step 5: Chaining Opportunity Analysis
96
97	```bash
98	python scripts/find_chains.py --attack-tree {tree_file} --trust-map {trust_map}
99	```
100
101	Identify where vulnerabilities on different assets can be chained:
102	- XSS on subdomain A -> cookie theft -> session on subdomain B (shared cookie scope)
103	- SSRF on app -> cloud metadata -> credentials -> S3 bucket access
104	- SQL injection -> database credentials -> access to internal API
105	- Admin panel default creds -> CI/CD access -> code deployment -> RCE
106	- DNS takeover -> phishing page -> credential capture -> internal access
107
108	For each chain:
109	1. List all steps with specific assets
110	2. Assign overall feasibility score
111	3. Estimate impact (what access is gained)
112	4. Map full MITRE ATT&CK path
113
114	### Step 6: Priority Ranking
115
116	Score each attack path on:
117	- Feasibility (1-10): How likely is successful exploitation?
118	- Known CVEs: +3
119	- Default credentials: +3
120	- Missing security headers: +1
121	- Outdated software: +2
122	- Exposed admin panel: +2
123	-

People who liked this also viewed

6 picks

Type