offensive-fast-checking
starsforks
How to install offensive-fast-checking?
snailsploit/claude-red/offensive-fast-checking
$npx -y skills add SnailSploit/Claude-Red --skill offensive-fast-checkingWhen this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been
SKILL.md
| 1 | # SKILL: Fast Testing Checklist |
| 2 | |
| 3 | ## Metadata |
| 4 | - **Skill Name**: fast-checking |
| 5 | - **Folder**: offensive-fast-checking |
| 6 | - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/fast-checking.md |
| 7 | |
| 8 | ## Description |
| 9 | Speed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping. |
| 10 | |
| 11 | ## Trigger Phrases |
| 12 | Use this skill when the conversation involves any of: |
| 13 | `fast check, quick recon, rapid assessment, quick wins, fast triage, speed checklist, time-boxed, CTF, fast scan, quick vulnerability` |
| 14 | |
| 15 | ## Instructions for Claude |
| 16 | |
| 17 | When this skill is active: |
| 18 | 1. Load and apply the full methodology below as your operational checklist |
| 19 | 2. Follow steps in order unless the user specifies otherwise |
| 20 | 3. For each technique, consider applicability to the current target/context |
| 21 | 4. Track which checklist items have been completed |
| 22 | 5. Suggest next steps based on findings |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | ## Full Methodology |
| 27 | |
| 28 | # Fast Testing Checklist |
| 29 | |
| 30 | A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file |
| 31 | |
| 32 | - use [lostsec](https://lostsec.xyz/) |
| 33 | - maintain a personal payloads repo synced with BLNS/SecLists; keep a tiny “golden” set for smoke tests |
| 34 | |
| 35 | ## Reconnaissance and Analysis |
| 36 | |
| 37 | - [ ] Map visible content (Manually) |
| 38 | - [ ] Perform Functionality Mapping by browsing the application thoroughly. |
| 39 | - [ ] Check API Documentation (Public, Swagger/OpenAPI). |
| 40 | - [ ] Discover hidden & default content (Directory/File Bruteforce) |
| 41 | - [ ] Test for debug parameters |
| 42 | - [ ] Identify data entry points (Discover Dynamic Content in Burp Pro) |
| 43 | - [ ] Identify the technologies used (Wappalyzer or similiar) |
| 44 | - [ ] Research existing vulnerabilities in technology (Google ++) |
| 45 | - [ ] Gather wordlists for specific technology (Assetnote, SecList and Naughty Strings) |
| 46 | - [ ] Map the attack surface automatically (e.g Burp spider) |
| 47 | - [ ] Identify all javascript files for later analysis (in your proxy) |
| 48 | - [ ] Scope Discovery (DNS, IPs, Subdomains) |
| 49 | - [ ] Capture API contracts (OpenAPI/GraphQL) and diff against observed traffic |
| 50 | - [ ] Identify gateways/WAF/CDN (headers, cookies, control pages) |
| 51 | - [ ] Identify cache layers and behaviors (vary keys, CDN rules, edge rewrites) |
| 52 | |
| 53 | ### Find Origin IP behind CDN/WAF |
| 54 | |
| 55 | - [ ] Confirm WAF presence (IP Org check, headers, cookies, block pages). |
| 56 | - [ ] Check Historical DNS records (SecurityTrails, DNSDumpster). |
| 57 | - [ ] Enumerate Subdomains & check IPs (focus on dev/staging). |
| 58 | - [ ] Analyze SSL Certificates (Censys, Shodan - check SANs). |
| 59 | - [ ] Analyze Email Headers from target (Received, X-Originating-IP). |
| 60 | - [ ] Test potential IPs directly (`curl --resolve example.com:443:<IP> https://example.com/`). |
| 61 | - [ ] Verify potential origin IPs (compare content, headers, certs). |
| 62 | - [ ] Probe HTTP/3 Alt‑Svc leakage and SNI/Host mismatches. |
| 63 | |
| 64 | ## Access Control Testing |
| 65 | |
| 66 | ### Authentication |
| 67 | |
| 68 | - [ ] Test password quality rules |
| 69 | - [ ] Minimum length, complexity, history, common password checks? |
| 70 | - [ ] Paste functionality disabled? |
| 71 | - [ ] Test for username enumeration |
| 72 | - [ ] Analyze response time, error messages, status codes for valid/invalid users. |
| 73 | - [ ] Check account recovery flow for enumeration. |
| 74 | - [ ] Test resilience to password guessing |
| 75 | - [ ] Is there rate limiting on login attempts? |
| 76 | - [ ] Is there account lockout mechanism? |
| 77 | - [ ] Test any account recovery function |
| 78 | - [ ] Weak security questions? |
| 79 | - [ ] Host header injection in reset emails? |
| 80 | - [ ] Token leakage via Referer? |
| 81 | - [ ] Lack of token validation? |
| 82 | - [ ] Predictable reset tokens? |
| 83 | - [ ] Test any "remember me" function |
| 84 | - [ ] Analyze token entropy, expiration, security attributes. |
| 85 | - [ ] Test any impersonation function |
| 86 | - [ ] Test username uniqueness |
| 87 | - [ ] Case sensitivity issues? (`admin` vs `Admin`) |
| 88 | - [ ] Whitespace trimming issues? |
| 89 | - [ ] Check for unsafe distribution of credentials |
| 90 | - [ ] Test for fail-open conditions |
| 91 | - [ ] Test any multi-stage mechanisms |
| 92 | - [ ] MFA bypasses (enrollment skip, verification manipulation, brute-force codes)? |
| 93 | - [ ] Can MFA be disabled easily? |
| 94 | - [ ] Parameter pollution vulnerabilities? |
| 95 | - [ ] Test OAuth Flows (see dedicated section). |
| 96 | - [ ] Test JWT implementations (see dedicated section). |
| 97 | - [ ] Check for API Key leakage (source code, client-side JS, mobile apps). |
| 98 | - [ ] Test API Key usage (URL, Header, Cookie). |
| 99 | - [ ] Test HTTP Basic Auth strength. |
| 100 | - [ ] Test HMAC signature implementation if used. |
| 101 | - [ ] Validate DPoP/mTLS token binding if advertised. |
| 102 | - [ ] Refresh‑token rotation and reuse detection. |
| 103 | - [ ] Passkeys/WebAuthn flows including recovery/fallbacks. |
| 104 | |
| 105 | ### Session handling |
| 106 | |
| 107 | - [ ] Test tokens for meaning |
| 108 | - [ ] Test tokens for predictability |
| 109 | - [ ] Check for insecure transmission of tokens |
| 110 | - [ ] Missing Secure flag on cookies? |
| 111 | - [ ] Sent over HTTP? |
| 112 | - [ ] Check for disclosure of tokens in logs and URL pa |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
