Claude-Red - claude-red is a curated library of offensive secur

项目说明

!claude-red banner

<di="center">

claude-red

Offensi skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.

![Stars]()
![Forks]()

O &bull; Quickstart &bull; Categories &bull; Skill Index &bull; Roadmap &bull; Contributing

</div>

---

O

claude-red is a curated library of offensi skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-le for a specific attack surface — from SQL injection to shellcode, EDR e to ADCS abuse.

Drop a skill into your Claude en and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on con triggers — you don't pay context for skills you aren't using.

Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.

for our actual research using skills ->
---

Quickstart

Claude Skills System (Recommended)

Claude auto-loads matching skills based on con triggers (e.g., mentioning SQL injection loads offensi).

To install a single category:

Claude Code

Claude.ai (Manual)

Paste the contents of a SKILL.md into a Project's system prompt or prepend it to your con.

Install Script

---

Categories

| Category | Skills | Focus |
|---|---:|---|
| Web Application | 16 | OWASP Top 10, business logic, ad web classes |
| Auth & Identity | 2 | JWT exploitation, OAuth/OIDC abuse |
| Acti | 1 | On-prem AD attack methodology |
| Wireless | 14 | 802.11, WPA2/3, EAP, WPS, e, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
| Cloud | 1 | AWS, Azure, GCP attack paths |
| Mobile | 1 | Android and iOS application testing |
| IoT & Embedded | 1 | Hardware, firmware, RTOS, ICS/OT |
| Infrastructure & Red Team | 7 | Initial access, EDR e, ad red team operations, Windows internals |
| Exploit De | 6 | Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU |
| Fuzzing & Research | 4 | libFuzzer, AFL++, co fuzzing, taxonomy |
| Reconnaissance | 2 | OSINT tooling and structured intelligence collection |
| API Security | 2 | REST/gRPC/WebSocket testing, business logic abuse |
| Container & Kubernetes | 2 | Container escape, Kubernetes cluster exploitation |
| CI/CD & Pipeline | 2 | Pipeline exploitation, secrets extraction |
| Cryptography | 2 | Cryptographic implementation attacks, TLS/SSL |
| Pri Escalation | 2 | Linux and Windows pri escalation |
| Post-Exploitation | 3 | Lateral mo, persistence mechanisms, data exfiltration |
| Forensics & C2 | 2 | Anti-forensics tradecraft, C2 框架 operations |
| Supply Chain | 2 | Supply chain attacks, dependency confusion |
| Social Engineering | 2 | Phishing campaigns, physical//smishing |
| Network Attacks | 1 | Layer 2/3 attacks, MITM, 协议 poisoning |
| AI Security | 1 | Prompt injection, jailbreaking, RAG poisoning |
| Utility | 2 | Fast triage checklists, professional reporting |

---

Skill Index

Web Application

Skills/web/

| Skill | Description |
|---|---|
| offensi | SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs |
| offensi | Cross-site scripting — stored, reflected, DOM-based, mutation XSS |
| offensi | Ser request forgery — cloud metadata pivots, filter bypass |
| offensi | Ser template injection — engine fingerprinting, RCE chains |
| offensi | XML external entity — OOB exfiltration, blind XXE techniques |
| offensi | Insecure direct object references — enumeration, authorization bypass |
| offensi | File upload — extension bypass, polyglot files, webshell deployment |
| offensi | Remote code execution — command injection, deserialization chains |
| offensi | Insecure deserialization — Java, PHP, .NET gadget chains |
| offensi | Race conditions — TOCTOU, single-packet attacks, limit bypass |
| offensi | HTTP request smuggling — CL.TE, TE.CL, H2 desync |
| offensi | Open redirect — OAuth token theft, phishing, SSRF pivots |
| offensi | HTTP parameter pollution — WAF bypass, logic confusion |
| offensi | GraphQL — introspection abuse, batching attacks, alias-based IDOR |
| offensi | WAF bypass — encoding tricks, chunked transfer, case mutation |
| offensi | Business logic — workflow bypass, pricing abuse, multi-step chains |

Auth & Identity

Skills/auth/

| Skill | Description |
|---|---|
| offensi | JWT attacks — alg:none, key confusion, secret cracking, claim tampering |
| offensi | OAuth/OIDC — redirect URI abuse, token leakage, PKCE bypass |

Acti

Skills/acti/

| Skill | Description |
|---|---|
| offensi | AD methodology — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, hybrid AAD |

Wireless

Skills/wireless/

| Skill | Description |
|---|---|
| offensi | 802.11 o — entrypoint for wireless assessments |
| offensi | Adapter configuration, monitor mode, multi-band airspace mapping |
| offensi | WPA2-PSK — handshake capture, PMKID extraction, hashcat cracking |
| offensi | WPA3-SAE — transition-mode downgrade, Dragonblood, side-channel attacks |
| offensi | 802.1X/EAP — credential relay, e RADIUS, certificate abuse |
| offensi | WPS — Pixie Dust offline attack, online PIN brute force, PIN prediction |
| offensi | Evil twin — KARMA, Mana, capti credential capture, MITM |
| offensi | KRACK and FragAttacks — supplicant testing |
| offensi | Deauthentication — targeted/broadcast frames, PMF awareness |
| offensi | Bluetooth LE — GATT enumeration, pairing downgrade, sniffing, MITM |
| offensi | Bluetooth BR/EDR — SDP probing, KNOB attack, BlueBorne, HID spoofing |
| offensi | 802.15.4 mesh — KillerBee, Touchlink commissioning abuse, ZCL injection |
| offensi | Z-Wave — S0 key deri, S2 commissioning attacks, hub pivots |
| offensi | LoRaWAN and sub-GHz — ABP/OTAA attacks, KeeLoq, fixed-代码 replay, TPMS |

Cloud

Skills/cloud/

| Skill | Description |
|---|---|
| offensi | Multi-cloud — pri escalation, IMDS abuse, cross-account pivots, CSPM e |

Mobile

Skills/mobile/

| Skill | Description |
|---|---|
| offensi | Android and iOS — Frida hooking, certificate pinning bypass, storage, biometric flaws |

IoT & Embedded

Skills/iot/

| Skill | Description |
|---|---|
| offensi | IoT/OT — hardware interfaces, firmware extraction, RTOS, ICS protocols, MQTT/CoAP |

Infrastructure & Red Team

Skills/infrastructure/

| Skill | Description |
|---|---|
| offensi | Initial access — phishing payloads, drive-by delivery, supply chain (TA0001) |
| offensi | Full kill chain — C2 infrastructure, OPSEC, lateral mo, persistence |
| offensi | EDR e — userland unhooking, indirect syscalls, PPID spoofing |
| offensi | Shellcode — writing, encoding, injection techniques, position-independent 代码 |
| offensi | Input capture — keylogger architecture, hooking mechanisms |
| offensi | Windows mitigations — ACG, CIG, CFG, CET bypass techniques |
| offensi | Windows boundary defeat — sandbox escape, integrity le |

Exploit De

Skills/exploit-dev/

| Skill | Description |
|---|---|
| offensi | Exploit de — stack/heap corruption, ROP chains, mitigation bypass |
| offensi | Structured exploit de curriculum |
| offensi | Linux binary exploitation — beginner to intermediate, mitigations disabled |
| offensi | Crash triage — exploitability assessment, root-cause analysis |
| offensi | Modern mitigations — ASLR, CFG, CET, PAC analysis and bypass |
| offensi | TOCTOU race conditions — binary, kernel, web, and container contexts |

Fuzzing & Research

Skills/fuzzing/

| Skill | Description |
|---|---|
| offensi | Fuzzing — libFuzzer, AFL++, co strategies, mutation engines |
| offensi | discovery through fuzzing — structured curriculum |
| offensi | Bug identification — 代码 review patterns, static analysis triggers |
| offensi | taxonomy — real-world examples, classification frameworks |

Reconnaissance

Skills/recon/

| Skill | Description |
|---|---|
| offensi | OSINT tooling — recon-ng, theHar, Maltego, Spiderfoot |
| offensi | OSINT methodology — structured intelligence collection and analysis |

API Security

Skills/api/

| Skill | Description |
|---|---|
| offensi | API testing — OWASP API Top 10, BOLA, BFLA, mass assignment, rate limiting |
| offensi | API business logic — endpoint chaining, batching abuse, webhook hijacking |

Container & Kubernetes

Skills/container/

| Skill | Description |
|---|---|
| offensi | Container breakout — pri mode, Docker socket, capabilities, runc CVEs |
| offensi | Kubernetes attacks — RBAC abuse, etcd access, kubelet API, pod escape, CRD exploitation |

CI/CD & Pipeline

Skills/cicd/

| Skill | Description |
|---|---|
| offensi | CI/CD exploitation — GitHub Actions injection, Jenkins RCE, GitLab CI abuse |
| offensi | CI/CD secrets — en extraction, vault misconfigs, runner token abuse |

Cryptography

Skills/crypto/

| Skill | Description |
|---|---|
| offensi | Cryptographic attacks — padding oracle, ECB manipulation, hash extension, weak PRNG |
| offensi | TLS/SSL attacks — POODLE, DROWN, Heartbleed, pinning bypass, 0-RTT replay |

Pri Escalation

Skills/privesc/

| Skill | Description |
|---|---|
| offensi | Linux pri escalation — SUID, capabilities, sudo, cron, kernel exploits |
| offensi | Windows pri escalation — Potato family, service misconfigs, DLL hijacking, UAC bypass |

Post-Exploitation

Skills/post-exploitation/

| Skill | Description |
|---|---|
| offensi | Lateral mo — PTH, PTT, NTLM relay, WMI/WinRM/DCOM, tunneling |
| offensi | Persistence — registry, scheduled tasks, WMI subscriptions, ticket forgery, PAM backdoors |
| offensi | Data exfiltration — DNS/HTTPS/ICMP tunneling, cloud staging, steganography |

Forensics & C2

Skills/forensics/

| Skill | Description |
|---|---|
| offensi | Anti-forensics — log manipulation, timestomping, ADS abuse, memory cleanup |
| offensi | C2 tradecraft — Cobalt Strike, Sliver, Mythic, Havoc, redirectors, domain fronting |

Supply Chain

Skills/supply-chain/

| Skill | Description |
|---|---|
| offensi | Supply chain attacks — dependency confusion, typosquatting, build system compromise |
| offensi | Dependency confusion — npm/PyPI/NuGet/Ma attacks, safe PoC methodology |

Social Engineering

Skills/social-engineering/

| Skill | Description |
|---|---|
| offensi | Phishing — GoPhish, E, payload delivery, email authentication bypass |
| offensi | Social engineering — pretexting, , smishing, physical SE, USB drops |

Network Attacks

Skills/network/

| Skill | Description |
|---|---|
| offensi | Network layer attacks — ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, MITM |

AI Security

Skills/ai/

| Skill | Description |
|---|---|
| offensi | AI/ML security — prompt injection, jailbreaking, RAG poisoning, model extraction |

Utility

Skills/utility/

| Skill | Description |
|---|---|
| offensi | Fast triage — quick-win identification checklists |
| offensi | Professional reporting — C, e standards, executi |

---

Roadmap

The library is being expanded across multiple phases. See CHANGELOG.md for release history.

| Phase | Focus | Skills | Status |
|---|---|---:|---|
| 1 | Internal AD/Windows — split into focused skills | +16 | Planned |
| 2 | Cloud Identity — Entra, ADFS, Okta, M365 | +10 | Planned |
| 3 | Wireless — WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz | +12 | Complete |
| 4 | IoT — UART/JTAG, flash extraction, fault injection, RTOS, ICS | +10 | Planned |
| 5 | Web Fundamentals — recon, auth bypass, access control, CSRF, CORS | +8 | Planned |
| 6 | Web Ad — proto pollution, SAML, OIDC, WebSocket, SSI/ESI | +10 | Planned |
| 7 | Documentation and tooling polish | — | Complete |
| 8 | New categories — 10 new domains with 20 skills | +20 | Complete |
| 9 | Deep rewrites — deserialization, GraphQL, ad red team, SSTI | — | Complete |

Target: ~130 skills across 23+ categories.

---

Contributing

Contributions welcome. See CONTRIBUTING.md for the skill template, frontmatter standard, and review process. Focused, single-surface skills are preferred o o.

License

MIT — use freely, attribution appreciated.

Acknowledgements

---

<di="center">

*Gi the right skill and it stops being a chatbot — it becomes an operator.*

snailsploit.com &bull; GitHub &bull; Research &bull; X

</div>

项目信息

开发语言：Python

Star 数：7270

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕claude-red is a curated library of offensi skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-le for a specific attack surface — from SQLi to shellcode, EDR e to exploit de.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。