competition-mailbox-abuse

Name: competition-mailbox-abuse
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-mailbox-abuse?

zhaoxuya520/reverse-skill/competition-mailbox-abuse

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-mailbox-abuse

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox ru

Files · 1

View on GitHub

SKILL.md

1	# Competition Mailbox Abuse
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive path runs through mailbox behavior, consent flow, or message-routing effects rather than generic AD evidence alone.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Decide whether the active path is phishing-to-consent, token-to-mailbox, rule-based persistence, or transport-level mail rerouting.
12	2. Keep mailbox evidence, identity evidence, and message-trace evidence tied to the same user, mailbox, token, or message ID.
13	3. Separate possession of a token or delegate edge from the actual mailbox effect it enables.
14	4. Record forwarding targets, rule predicates, consent scopes, shared mailbox edges, and resulting mail flow in compact blocks.
15	5. Reproduce the smallest mail effect that proves persistence, exfiltration, or privilege.
16
17	## Workflow
18
19	### 1. Map The Mail Trust Path
20
21	- Identify the principal, mailbox, token or session, consent grant, delegate edge, shared mailbox relationship, or app registration involved.
22	- Record consent scopes, mailbox permissions, rule ownership, transport actions, and message-trace identifiers.
23	- Distinguish client-visible symptoms from server-side mailbox or transport state.
24
25	### 2. Prove The Mailbox Effect
26
27	- Correlate consent logs, sign-ins, message traces, inbox rules, transport rules, forwarding settings, and mailbox audit events.
28	- Show which rule or token produces which concrete effect: silent forwarding, marking read, deletion, delegate access, or message rerouting.
29	- Keep message IDs, sender or recipient pairs, and timestamps aligned across logs.
30
31	### 3. Reduce To The Decisive Abuse Chain
32
33	- Compress the path to the smallest sequence: lure or grant -> token or delegate edge -> mailbox or transport mutation -> resulting mail effect.
34	- State clearly whether persistence lives in consent, mailbox rules, transport config, or shared mailbox permissions.
35	- If the task broadens into host pivots or Kerberos acceptance, switch back to the broader identity skill.
36
37	## Read This Reference
38
39	- Load `references/mailbox-abuse.md` for the consent checklist, rule checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Consent scopes, token claims, mailbox permissions, rule definitions, forwarding targets, and message IDs
44	- Message-trace lines, audit events, and mailbox effects tied to the same mail path
45	- The smallest replayable sequence that proves persistence, exfiltration, or delegate access

People who liked this also viewed

6 picks

Type

competition-mailbox-abuse

8.8kstars1.4kforks

View on GitHub

How to install competition-mailbox-abuse?

zhaoxuya520/reverse-skill/competition-mailbox-abuse

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-mailbox-abuse

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Mailbox Abuse
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive path runs through mailbox behavior, consent flow, or message-routing effects rather than generic AD evidence alone.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Decide whether the active path is phishing-to-consent, token-to-mailbox, rule-based persistence, or transport-level mail rerouting.
12	2. Keep mailbox evidence, identity evidence, and message-trace evidence tied to the same user, mailbox, token, or message ID.
13	3. Separate possession of a token or delegate edge from the actual mailbox effect it enables.
14	4. Record forwarding targets, rule predicates, consent scopes, shared mailbox edges, and resulting mail flow in compact blocks.
15	5. Reproduce the smallest mail effect that proves persistence, exfiltration, or privilege.
16
17	## Workflow
18
19	### 1. Map The Mail Trust Path
20
21	- Identify the principal, mailbox, token or session, consent grant, delegate edge, shared mailbox relationship, or app registration involved.
22	- Record consent scopes, mailbox permissions, rule ownership, transport actions, and message-trace identifiers.
23	- Distinguish client-visible symptoms from server-side mailbox or transport state.
24
25	### 2. Prove The Mailbox Effect
26
27	- Correlate consent logs, sign-ins, message traces, inbox rules, transport rules, forwarding settings, and mailbox audit events.
28	- Show which rule or token produces which concrete effect: silent forwarding, marking read, deletion, delegate access, or message rerouting.
29	- Keep message IDs, sender or recipient pairs, and timestamps aligned across logs.
30
31	### 3. Reduce To The Decisive Abuse Chain
32
33	- Compress the path to the smallest sequence: lure or grant -> token or delegate edge -> mailbox or transport mutation -> resulting mail effect.
34	- State clearly whether persistence lives in consent, mailbox rules, transport config, or shared mailbox permissions.
35	- If the task broadens into host pivots or Kerberos acceptance, switch back to the broader identity skill.
36
37	## Read This Reference
38
39	- Load `references/mailbox-abuse.md` for the consent checklist, rule checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Consent scopes, token claims, mailbox permissions, rule definitions, forwarding targets, and message IDs
44	- Message-trace lines, audit events, and mailbox effects tied to the same mail path
45	- The smallest replayable sequence that proves persistence, exfiltration, or delegate access

People who liked this also viewed

6 picks

Type