offensive-claude - Offensive security toolkit for Claude Code coverin

项目说明

Offensi Research Config for Claude Code

A spec-dri security framework for Claude Code — structured engagement workflows based on the Cyber Kill Chain, 32 kill-chain skills (multi-file progressi) plus a discipline layer (a SessionStart dispatcher + 6 process/discipline skills), 8 collaborati, and a shared 47-file reference library. Inspired by GitHub's spec-kit, obra/superpowers, and gadievron/raptor (crash→exploitability + OSS-repo forensics).

Quick Setup

Installing as a plugin registers a SessionStart hook that injects the
using-offensi dispatcher into every con, so the skill-in discipline
(scope → finding → OPSEC) is active from the first message.

Skills and agents activate automatically — no additional configuration needed.

Engagement Workflow

Engagements follow the Cyber Kill Chain as a structured 9-phase pipeline with quality gates:

Quick Start — Web App Pentest

Orchestration Commands

| Command | Phase | Action |
|---------|-------|--------|
| /engage.init <preset> | — | Initialize engagement with workflow preset |
| /engage.scope | 0 | Define targets, ROE, authorization |
| /engage.recon | 1 | Passi reconnaissance |
| /engage.weaponize | 2 | Payload de, exploit design |
| /engage.deliver | 3 | Delivery execution |
| /engage.exploit | 4 | Exploitation, finding documentation |
| /engage.install | 5 | Persistence establishment |
| /engage.c2 | 6 | C2 infrastructure setup |
| /engage.actions | 7 | Objecti, lateral mo |
| /engage.report | 8 | Report generation |
| /engage.status | — | Show pipeline status and progress |
| /engage.gate | — | current phase gate |
| /engage.crash | 4 | Crash → root cause (rr) → reachability (gco) → empirical exploitability |
| /engage.c | 2,4 | Find a CVE's canonical fix commit(s) across sources, then scope-gated diff for root cause |
| /engage.scorecard | — | Calibrate model trust (Wilson-bounded miss-rate) to short-circuit re- |
| /engage.threatmodel | 1 | Materialize / lint / drift-check the engagement threat model |
| /engage.memory | — | Recall prior patterns / record confirmed findings (cross-engagement learning) |
| /engage.pickup | — | Resume an engagement from the engine trace (skip completed steps) |

Workflow Presets

| Preset | Phases | Use Case |
|--------|--------|----------|
| web-app | 0,1,2,3,4,8 | OWASP-focused web application assessment |
| network | 0,1,2,4,5,6,7,8 | Internal network penetration test |
| red-team | ALL (0-8) | Full ad simulation |
| cloud | 0,1,4,8 | AWS/Azure/GCP security audit |
| mobile | 0,1,2,4,8 | Android/iOS application pentest |
| ad-domain | 0,1,2,4,5,7,8 | Acti domain assessment |
| bug-bounty | 0,1,4,8 | Bug bounty hunting |

Quality Gates

Each phase transition :

Structure

Safety, Testing & Autonomy

The framework's safety controls are executable, not prose, and covered by an automated test suite:

| Control | What it does |
|---------|--------------|
| scope_guard.py | Enforces the engagement scope (scope.json); host parsing matches HTTP clients (userinfo/IPv6/IDN safe), fails closed |
| .py | E + per-class FP harness proof signals; nati reachability bar (gco) + [E] citation gate (e.py re- e) |
| safe_subprocess.py | Hardened exec for untrusted inputs/repos: shell=False, clean en+fail-closed, UTF-8 decode, git_safe() (hooks/prompt/host-config/ext-transport disabled) |
| action_guard.py | 3-state gate (allow / require_approval / block): out-of-scope → block, safe-method policy, per-host circuit breaker |
| redact_headers.py | Masks Authorization/Cookie/API-key/JWT at the data boundary (fail-closed) before traffic reaches the model |
| finding-checker + engine/rebuttal.py | Blind artifact-only ad checker driving a bounded generator↔checker rebuttal loop (default-to-skeptic; EXHAUSTED/STALLED ne) |
| engine/model_scorecard.py | Fail-closed model- trust calibration (Wilson 95% upper-bound miss-rate) to short-circuit re- only on a pro record |
| engagement-memory/ | Persists confirmed findings as impact-ranked patterns; recalls top-N prior techniques at recon/weaponize |
| engine/ | Bounded autopilot: hard step/time budget, loop detection, append-only trace, --resume; offensi stay operator-gated |
| tests/ + CI | pytest suite (run pytest); GitHub Actions runs it + byte-compile (skills/ + engine/) + shellcheck on every push |

All safety code is ad red-teamed and regression-tested. See TERMS.md for the
authorization requirement — every request the toolkit sends is the operator's responsibility.

Crash → Exploitability Pipeline

For nati work, a staged-proof pipeline turns "it crashes" into a defensible,
artefact-backed exploitability — run via /engage.crash in the .de/ toolchain:

1. Root cause — rr deterministic record/replay re to the corrupting write
(rr_root_cause.sh, emits a trace_proof).
2. Reachability — gcov line-hit / function trace proves the line actually ran; the
harness will not mark a native bug [CONFIRMED] without a co/trace_proof.
3. Empirical feasibility — rebuild the crash witness under permissi/hardened/asan
profiles and record which still fire (feasibility_profile.py); exploit_context.py then forbids
/exploit from using a technique the empirical mitigation map marks blocked.
4. Path feasibility — branch guards → tri-state SAT/UNSAT (path_conditions.py, Z3 optional;
a tool limit is null/manual, never a false "infeasible").

Supporting tools: e.py (typed, re- [E] e), .py
(one finding → all siblings, clustered by root cause), c.py (multi-source fix-commit discovery
→ scope-gated diff), and the incident-response repo-compromise forensics kit.

Skill-In Discipline (dispatcher + process skills)

Installed as a plugin, a SessionStart hook injects the using-offensi dispatcher into
every con: *if there's even a 1% chance a skill applies, invoke it before acting.* Process /
discipline skills come before domain skills (the offensi of brainstorming / TDD / debugging):

| Process skill | Rule | Backed by |
|---------------|------|-----------|
| engagement-flow | Sequence the kill chain with quality gates | /engage.*, engine/ |
| scope-discipline | No target without authorization | scope_guard.py, action_guard.py |
| threat-model-discipline | Model the attack surface + detect drift before exploiting | threatmodel_lint.py, /engage.threatmodel |
| finding-discipline | No [CONFIRMED] without proof | .py, finding-, finding-checker |
| opsec-discipline | Decide detection / cleanup / redaction before acting | redact_headers.py |
| writing-offensi | Con for authoring skills in this repo | — |

Each discipline skill carries an Iron Law + Red-Flags + Rationalizations table (resists shortcutting
under pressure). The dispatcher auto-loads; domain skills below are invoked via the Skill tool.

Skills (32 domain)

Each skill is a progressi module: a thin SKILL.md router (when-to-activate, a technique
map of *technique → ATT&CK ID → CWE → reference → script*, and an OPSEC/detection summary), backed by
per-skill references/ deep-dives and runnable scripts/. Every technique pairs the offensive path with
a Sigma/EDR detection signature and OPSEC notes, and cites current (2024–2026) C.
Descriptions use Use when… triggers so the dispatcher routes to the right skill.

| # | Skill | Kill Chain | Co |
|---|-------|-----------|----------|
| 01 | recon-osint | Recon | Subdomain enum, C, breach intel, DNS history, Shodan/Censys |
| 02 | | Recon, Exploit | Taint analysis, source-sink tracing, false positi |
| 03 | exploit-de | Weaponize, Exploit | ROP chains, heap exploitation, shellcode, deserialization, mitigation bypass |
| 04 | re | Weaponize, Exploit | IDA/Ghidra, Frida, angr, firmware extraction, anti-RE bypass |
| 05 | web-pentest | Delivery, Exploit | SQLi, XSS, SSRF, race conditions, GraphQL, JWT, business logic |
| 06 | network-attack | Recon, Actions | AD exploitation, lateral mo, pi, wireless, protocol attacks |
| 07 | red-team-ops | Install, Actions | C2, persistence, privesc, defense e, LOLBins, exfiltration |
| 08 | cloud-security | Recon, Exploit | AWS/Azure/GCP privesc, container escape, Kubernetes, IaC review |
| 09 | malware-analysis | Weaponize | Static/dynamic analysis, YARA rules, unpacking, C2 protocol RE |
| 10 | ai-security | Recon, Exploit | Prompt injection, RAG poisoning, model extraction, ad ML |
| 11 | threat-hunting | Report | MITRE ATT&CK mapping, Sigma rules, log correlation, beha detection |
| 12 | pri | Exploit, Actions | SUID, capabilities, sudo, kernel exploits, Docker escape, cron abuse |
| 13 | pri | Exploit, Actions | Token abuse, service exploitation, UAC bypass, credential har |
| 14 | coding-mastery | Weaponize | Python/C/Go/Rust/ASM for exploit de, C2, crypto |
| 15 | crypto-analysis | Recon, Exploit | TLS auditing, hash cracking, RSA attacks, side-channel, implementation review |
| 16 | incident-response | Report | Memory forensics (), timeline analysis, IOC extraction, containment, repo/OSS-compromise forensics (dangling-commit recovery, GH Archive / Wayback / Events API) |
| 17 | edr-e | Delivery, Install | Hook unhooking, direct/indirect syscalls, AMSI/ETW bypass, sleep masking |
| 18 | initial-access | Delivery | HTML smuggling, ISO/MOTW bypass, DLL sideload, staged payloads, phishing |
| 19 | shellcode-de | PEB walk, API hashing, loaders, PE-to-shellcode, cross-platform |
| 20 | windows-mitigations | Exploit | ASLR/DEP/CFG/CET/ACG bypass, WDAC/ASR bypass, PPL exploitation |
| 21 | windows-boundaries | Exploit, Install | Kernel/user boundary, sandbox escape, AppContainer, COM ele |
| 22 | keylogger-arch | Install, Actions | SetWindowsHookEx, RawInput, direct HID, ETW capture, stealth IOCs |
| 23 | mobile-pentest | Recon, Exploit | Android/iOS, Frida, SSL pinning bypass, exported components, biometric bypass |
| 24 | ad | C2, Actions | C2 infra (redirectors, malleable profiles), OPSEC, tiered infrastructure |
| 25 | acti | Exploit, Actions | Kerberoasting, NTLM relay, Golden/Sil, ADCS, delegation abuse |
| 26 | cicd-supply-chain | Weaponize, Delivery | Pipeline poisoning (Actions/GitLab/Jenkins), dependency confusion, OIDC abuse, SLSA/pro |
| 27 | ai-agent-redteam | Delivery, Exploit | Agentic AI/MCP tool abuse, indirect prompt-injection chains, RAG/memory poisoning, jailbreaks |
| 28 | container-k8s-escape | Exploit, Actions | Container breakout, runc CVEs, K8s RBAC escalation, admission/ingress attacks, node pivot |
| 29 | browser-exploitation | Weaponize, Exploit | V8/JSC JIT type confusion, heap-sandbox & renderer→browser escape, Electron/IPC RCE |
| 30 | macos-offensive | Exploit, Install | TCC/Gatekeeper bypass, keychain, LaunchAgent persistence, ESF e *(planned)* |
| 31 | engagement-memory | Recon, Weaponize, Report | Cross-engagement pattern learning — ranked recall of prior techniques *(support)* |
| 32 | wireless-rf | Recon, Exploit, Actions | Non-Wi-Fi radio: Bluetooth/BLE (GATT, crackle, KNOB/BIAS), Zigbee/Thread/Matter & Z-Wave mesh, LoRaWAN/Sub-GHz capture-replay |

Agents (8)

| Agent | Layer | Acti | Role |
|-------|-------|---------------|------|
| redteam-planner | Planning | Scope, Recon, Weaponize, Actions | Attack path design, OPSEC strategy |
| exploit-researcher | Execution | Recon, Weaponize, Exploit | C, exploit chain de |
| security-re | Analysis | Recon, Exploit, Report | Finding , gate checks |
| re | Execution | Weaponize, Exploit, Install | Binary analysis, discovery |
| ai-researcher | Execution | Recon, Weaponize, Exploit | AI/ML security assessment |
| network-analyst | Analysis | Recon, Delivery, C2, Actions | Protocol analysis, C2 review |
| finding- | Analysis | Exploit, Actions, Report | Ad PASS/KILL/DOWNGRADE on findings |
| finding-checker | Analysis | Exploit, Actions, Report | Blind artifact-only checker driving the bounded generator↔checker rebuttal loop |

Agents collaborate through structured handoffs — planning agents feed execution agents, execution agents feed analysis agents for .

References (47 files)

Detailed patterns with /secure code examples, organized by category:

MCP Servers

| Server | Purpose |
|--------|---------|
| mitm-search | Web search via mcp.mitm.vn |
| ida-multi-mcp | IDA Pro integration (decompile, rename, xrefs, patching) |
| jadx-mcp-server | Android APK decompilation and analysis |

How It Works

1. Claude Code reads CLAUDE.md — sets offensi persona with Kill Chain methodology
2. Use /engage.init <preset> to start a structured engagement, or use skills standalone
3. Each phase has templates, quality gates, skill mappings, and agent coordination
4. Agents collaborate through structured handoffs — planning → execution → analysis layers
5. Quality gates findings before phase transitions (CWE, CVSS, e required)
6. Reports are generated from structured finding records with e linking

Customization

Requirements

<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset=" />
<source media="(prefers-color-scheme: light)" srcset=" />
<img alt="Star History Chart" src=" />
</picture>
</a>

项目信息

开发语言：Python

Star 数：384

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。