offensive-initial-access

Name: offensive-initial-access
Author: SnailSploit

2.8kstars447forks

How to install offensive-initial-access?

snailsploit/claude-red/offensive-initial-access

$npx -y skills add SnailSploit/Claude-Red --skill offensive-initial-access

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Modern Initial Access
2
3	## Metadata
4	- Skill Name: initial-access
5	- Folder: offensive-initial-access
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/initial-access.md
7
8	## Description
9	Initial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`initial access, phishing, spear phishing, credential stuffing, exposed service, supply chain, watering hole, VPN brute force, RDP attack, MITRE TA0001, initial foothold`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Modern Initial Access
29
30	## Introduction
31
32	### Typical Initial Access Vectors
33
34	- Email with malware attached/linked
35	- Most attacks using attached malware won't work
36	- Out of the box protection may not cover `PDF, ISO, IMG, HTML, SVG, PPTM, PPSM, ACCDE`
37	- Most URL-based attacks do work
38	- domain's reputation, age, category should be sound
39	- domain should use https
40	- limit number of GET elements and their names
41	- use HTML Smuggling to evade
42	- get your domain warmed up (send some legitimate emails first with no attachment and links)
43	- Advanced attacks may involve delivering backdoored trusted applications (e.g., older Electron apps with V8 exploits) via phishing to bypass application control like WDAC.
44	- Spear-phishing/ phishing / stealing valid credentials
45	- Check your mail with [Phishious](https://github.com/CanIPhish/Phishious) before sending it to your victim
46	- use [decode-spam-headers](https://github.com/mgeeky/decode-spam-headers) to analyze returned SMTP headers
47	- Be aware that default Microsoft Office settings now block macros in files downloaded from the internet (marked with `MOTW`). Success often requires significant social engineering to convince users to bypass these protections or using alternative delivery methods (e.g., containers that don't propagate `MOTW`, signed add-ins).
48	- images and link increase spam score, be wary of it
49	- don't use `no-reply` like usernames
50	- send through `GoPhis -> AWS SOCAT :587 -> smtp.gmail.com -> @target.com`
51	- link to websites on trusted domains, like cloud-facing resources
52	- make sure your webserver blocks automated bots
53	- Deep‑fake voice or video social‑engineering calls (help‑desk or executive impersonation) to obtain password resets or approve MFA prompts. Generative‑AI tools make cloning voices trivial.
54	- Business Email Compromise (BEC) / OAuth consent phishing that targets finance or vendor‑portal users, yielding cloud‑token access even where MFA is enabled.
55	- Malicious OneNote `.one` attachments and OneDrive "Add to Shortcut" abuse: embedded HTA/JS payloads bypass Office macro blocking and spread via cloud sync.
56	- Excel blocks untrusted Internet-origin XLL add-ins by default (M365, 2023+). Smuggled XLLs inside containers may still be blocked once MOTW propagates.
57	- Malicious browser extensions (Chrome, Edge, Firefox) delivered through fake Web Store listings; hijack session cookies or inject scripts into authenticated SaaS sessions.
58	- attackers register malicious cloud apps and trick users into granting scopes, giving token-based access that bypasses MFA
59	- Reusing stolen credentials against external single factor VPN, gateways, etc
60	- Password Spraying against Office365, custom login pages, VPN gateways
61	- Exposed RDP with weak credentials and lacking controls
62	- Unpatched known vulnerable perimeter device, application bugs, default credentials, etc
63	- Rarely HID-emulating USB sticks
64	- WiFi Evil Twin -> Route WPA2 Enterprise -> NetNTLMv2 hash cracking -> authenticated network access -> Responder
65	- Plugging into on-premises LAN -> Responder/mitm6/Ldaprelayx
66	- SEO poisoning / paid‑search malvertising (e.g., fake PuTTY & WinSCP ads, dominant loader delivery 2024–25) and "quishing" PDFs whose QR codes redirect victims to mobile OAuth login pages
67	- Consent‑/token‑phishing and Adversary‑in‑the‑Middle (AiTM) proxy kits that steal OAuth session cookies or proxy MFA (e.g., EvilProxy, Tycoon, Dadsec). These vectors bypass MFA by tricking users into granting access to rogue Azure AD / Google Workspace apps.
68	- Supply‑chain compromise of developer ecosystems:
69	- malicious NPM / PyPI typosquat packages
70	- poisoned GitHub Actions or CI/CD secrets exfiltration
71	- container‑registry deception (imageless Docker Hub repos or `curl \| bash` installers).
72	- First contact often occurs on developer workstatio

People who liked this also viewed

6 picks

Type

offensive-initial-access

2.8kstars447forks

View on GitHub

How to install offensive-initial-access?

snailsploit/claude-red/offensive-initial-access

$npx -y skills add SnailSploit/Claude-Red --skill offensive-initial-access

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Modern Initial Access
2
3	## Metadata
4	- Skill Name: initial-access
5	- Folder: offensive-initial-access
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/initial-access.md
7
8	## Description
9	Initial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`initial access, phishing, spear phishing, credential stuffing, exposed service, supply chain, watering hole, VPN brute force, RDP attack, MITRE TA0001, initial foothold`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Modern Initial Access
29
30	## Introduction
31
32	### Typical Initial Access Vectors
33
34	- Email with malware attached/linked
35	- Most attacks using attached malware won't work
36	- Out of the box protection may not cover `PDF, ISO, IMG, HTML, SVG, PPTM, PPSM, ACCDE`
37	- Most URL-based attacks do work
38	- domain's reputation, age, category should be sound
39	- domain should use https
40	- limit number of GET elements and their names
41	- use HTML Smuggling to evade
42	- get your domain warmed up (send some legitimate emails first with no attachment and links)
43	- Advanced attacks may involve delivering backdoored trusted applications (e.g., older Electron apps with V8 exploits) via phishing to bypass application control like WDAC.
44	- Spear-phishing/ phishing / stealing valid credentials
45	- Check your mail with [Phishious](https://github.com/CanIPhish/Phishious) before sending it to your victim
46	- use [decode-spam-headers](https://github.com/mgeeky/decode-spam-headers) to analyze returned SMTP headers
47	- Be aware that default Microsoft Office settings now block macros in files downloaded from the internet (marked with `MOTW`). Success often requires significant social engineering to convince users to bypass these protections or using alternative delivery methods (e.g., containers that don't propagate `MOTW`, signed add-ins).
48	- images and link increase spam score, be wary of it
49	- don't use `no-reply` like usernames
50	- send through `GoPhis -> AWS SOCAT :587 -> smtp.gmail.com -> @target.com`
51	- link to websites on trusted domains, like cloud-facing resources
52	- make sure your webserver blocks automated bots
53	- Deep‑fake voice or video social‑engineering calls (help‑desk or executive impersonation) to obtain password resets or approve MFA prompts. Generative‑AI tools make cloning voices trivial.
54	- Business Email Compromise (BEC) / OAuth consent phishing that targets finance or vendor‑portal users, yielding cloud‑token access even where MFA is enabled.
55	- Malicious OneNote `.one` attachments and OneDrive "Add to Shortcut" abuse: embedded HTA/JS payloads bypass Office macro blocking and spread via cloud sync.
56	- Excel blocks untrusted Internet-origin XLL add-ins by default (M365, 2023+). Smuggled XLLs inside containers may still be blocked once MOTW propagates.
57	- Malicious browser extensions (Chrome, Edge, Firefox) delivered through fake Web Store listings; hijack session cookies or inject scripts into authenticated SaaS sessions.
58	- attackers register malicious cloud apps and trick users into granting scopes, giving token-based access that bypasses MFA
59	- Reusing stolen credentials against external single factor VPN, gateways, etc
60	- Password Spraying against Office365, custom login pages, VPN gateways
61	- Exposed RDP with weak credentials and lacking controls
62	- Unpatched known vulnerable perimeter device, application bugs, default credentials, etc
63	- Rarely HID-emulating USB sticks
64	- WiFi Evil Twin -> Route WPA2 Enterprise -> NetNTLMv2 hash cracking -> authenticated network access -> Responder
65	- Plugging into on-premises LAN -> Responder/mitm6/Ldaprelayx
66	- SEO poisoning / paid‑search malvertising (e.g., fake PuTTY & WinSCP ads, dominant loader delivery 2024–25) and "quishing" PDFs whose QR codes redirect victims to mobile OAuth login pages
67	- Consent‑/token‑phishing and Adversary‑in‑the‑Middle (AiTM) proxy kits that steal OAuth session cookies or proxy MFA (e.g., EvilProxy, Tycoon, Dadsec). These vectors bypass MFA by tricking users into granting access to rogue Azure AD / Google Workspace apps.
68	- Supply‑chain compromise of developer ecosystems:
69	- malicious NPM / PyPI typosquat packages
70	- poisoned GitHub Actions or CI/CD secrets exfiltration
71	- container‑registry deception (imageless Docker Hub repos or `curl \| bash` installers).
72	- First contact often occurs on developer workstatio

People who liked this also viewed

6 picks

Type