SnailSploit | Kai Aizen

via GitHub · Posted Jul 12, 2026 · 1 min read

Claude Red

Claude Skill

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.

2,744Stars

449Forks

3Open issues

26Watching

Python MIT Snail Updated 2 months ago

#claude-ai #claude-pt #claude-skills #redteam

View on GitHub

A curated collection of SKILL.md files that extend Claude's capabilities for authorized offensive security work across web applications, cloud infrastructure, wireless networks, and exploit development. Each skill provides structured methodology, tooling guidance, and attack surface expertise for red team operations, bug bounty research, and security training.

0 comments

README

claude-red

Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.

Built by SnailSploit — GenAI Security Research.

What is this
Quickstart
Categories
Skill Index
Roadmap
Contributing
License
Acknowledgements

What is this

claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to ADCS abuse.

Drop a skill into your Claude environment and it behaves like a specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.

Use it for: authorized red team engagements, bug bounty triage, security research, CTF preparation, training operators, and exploring attack surfaces methodically.

Quickstart

Claude Skills System (recommended)

# Clone into a directory Claude will scan
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red

# Or install only one category
git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory

Claude will auto-load matching skills based on conversational triggers (e.g. mentioning SQLi loads offensive-sqli).

Claude Code

# Point Claude at a single skill before a session
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -

# Or load a whole category
cat Skills/active-directory/**/SKILL.md | claude --system-file -

Claude.ai (Manual)

Paste the contents of a SKILL.md into a Project's system prompt or prepend to your conversation.

Install Script

./install.sh                           # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web            # one category

Skill Index

Web Application

Skills/web/

Skill	Description
`offensive-sqli`	SQL injection — error/blind/OOB, DB-specific, ORM CVEs, cloud paths
`offensive-xss`	Cross-site scripting — stored, reflected, DOM, mutation
`offensive-ssrf`	Server-side request forgery — cloud metadata, filter bypass
`offensive-ssti`	Server-side template injection — engine ID, RCE paths
`offensive-xxe`	XML external entity — OOB exfil, blind exploitation
`offensive-idor`	Insecure direct object references — enumeration, business logic
`offensive-file-upload`	File upload — extension bypass, polyglots, webshells
`offensive-rce`	Remote code execution — chaining, command injection
`offensive-deserialization`	Insecure deserialization — Java/PHP/.NET gadget chains
`offensive-race-condition`	Race conditions — TOCTOU, single-packet, limit bypass
`offensive-request-smuggling`	HTTP request smuggling — CL.TE, TE.CL, h2 desync
`offensive-open-redirect`	Open redirect — OAuth abuse, phishing, SSRF pivots
`offensive-parameter-pollution`	HTTP parameter pollution — WAF bypass, logic confusion
`offensive-graphql`	GraphQL — introspection, batching, IDOR via aliases
`offensive-waf-bypass`	WAF bypass — encoding, chunking, case mutation
`offensive-business-logic`	Business logic — workflow bypass, pricing, refunds, chains

Auth & Identity

Skills/auth/

Skill	Description
`offensive-jwt`	JWT — alg:none, key confusion, secret cracking
`offensive-oauth`	OAuth — open redirect abuse, token leakage, PKCE bypass

Active Directory

Skills/active-directory/

Skill	Description
`offensive-active-directory`	AD — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD

Note: This category is being expanded. The AD overview is being split into 16 focused skills (Kerberoasting, ASREProasting, ADCS, coercion, NTLM relay, BloodHound, ticket forgery, GPO abuse, etc.). See Roadmap.

Wireless

Skills/wireless/

Skill	Description
`offensive-wifi`	802.11 overview — entrypoint into the wireless category
`offensive-wifi-recon`	Adapter selection, monitor mode, multi-band airspace mapping
`offensive-wpa2-psk`	Handshake capture, PMKID, hashcat 22000 cracking
`offensive-wpa3-sae`	Transition-mode downgrade, Dragonblood, SAE side-channels
`offensive-wpa-enterprise`	802.1X / EAP attacks, eaphammer evil-twin RADIUS
`offensive-wps`	Pixie Dust, online PIN brute, vendor PIN generators
`offensive-evil-twin`	KARMA, Mana, captive portal, post-association MITM
`offensive-krack-fragattacks`	KRACK + FragAttacks supplicant testing
`offensive-deauth-disassoc`	Targeted/broadcast deauth, PMF awareness, action frames
`offensive-bluetooth-ble`	BLE GATT enum, pairing downgrade, sniffing, MITM
`offensive-bluetooth-classic`	BR/EDR — SDP, SPP, KNOB, BlueBorne, HID spoofing
`offensive-zigbee-thread-matter`	802.15.4 mesh — KillerBee, Touchlink abuse, ZCL command injection
`offensive-z-wave`	S0 key derivation flaw, S2 commissioning, hub pivots
`offensive-lorawan-sub-ghz`	LoRaWAN ABP/OTAA, KeeLoq garage doors, fixed-code, TPMS

Cloud

Skills/cloud/

Skill	Description
`offensive-cloud`	AWS / Azure / GCP — privesc, IMDS, cross-account, persistence, CSPM evasion

Note: Cloud-identity (Entra/AAD/Okta hybrid) skills coming separately. See Roadmap.

Mobile

Skills/mobile/

Skill	Description
`offensive-mobile`	Android + iOS — Frida, pinning, storage, biometric, deep links

IoT & Embedded

Skills/iot/

Skill	Description
`offensive-iot`	Hardware recon, firmware, RTOS, ICS/OT, MQTT/CoAP

Note: Being split into 10 focused skills (UART/JTAG, flash dump, fault injection, U-Boot, secure boot, RTOS, ICS protocols). See Roadmap.

Infrastructure & Red Team

Skills/infrastructure/

Skill	Description
`offensive-initial-access`	Phishing, drive-by, supply chain — TA0001
`offensive-advanced-redteam`	Full kill chain, C2, OPSEC, lateral, persistence
`offensive-edr-evasion`	Unhooking, indirect syscalls, PPID spoofing
`offensive-shellcode`	Writing, encoding, injection techniques
`offensive-keylogger-arch`	Keylogger architecture and input-capture techniques
`offensive-windows-mitigations`	Windows mitigations — ACG, Arbitrary Code Guard
`offensive-windows-boundaries`	Defeating Windows boundaries — sandbox escape, privilege

Exploit Development

Skills/exploit-dev/

Skill	Description
`offensive-exploit-development`	Stack/heap, ROP chains, mitigations
`offensive-exploit-dev-course`	Structured curriculum format
`offensive-basic-exploitation`	Linux exploitation, mitigations disabled — beginner-to-mid
`offensive-crash-analysis`	Crash triage, exploitability assessment, root cause
`offensive-mitigations`	Modern kernel mitigations — ASLR, CFG, CET, PAC
`offensive-toctou`	Time-of-check/use across binary, kernel, web, container

Fuzzing & Vulnerability Research

Skills/fuzzing/

Skill	Description
`offensive-fuzzing`	libFuzzer, AFL++, coverage-guided, mutation strategies
`offensive-fuzzing-course`	Curriculum — finding vulns via fuzzing
`offensive-bug-identification`	Code review patterns, static analysis triggers
`offensive-vuln-classes`	Vulnerability classes — real-world examples, taxonomy

Reconnaissance

Skills/recon/

Skill	Description
`offensive-osint`	OSINT tools — recon-ng, theHarvester, Maltego pipelines
`offensive-osint-methodology`	OSINT methodology — structured intelligence collection

AI Security

Skills/ai/

Skill	Description
`offensive-ai-security`	AI pentest — prompt injection, jailbreaking, RAG poisoning

Utility

Skills/utility/

Skill	Description
`offensive-fast-checking`	Fast triage checklist — quick-win identification
`offensive-reporting`	Pro pentest reporting — CVSS, evidence, exec summary, retest

Roadmap

The library is being expanded in seven phases. Track progress in CHANGELOG.md.

Phase	Category	New Skills	Status
1	Internal AD/Windows (rename `active-directory/` → `internal/`)	+16	Planned
2	Cloud Identity (Entra/AAD, ADFS, Okta, M365)	+10	Planned
3	Wireless split (WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz)	+12	Mandatory
4	IoT split (UART/JTAG, flash, fault injection, RTOS, ICS)	+10	Planned
5	Web Basics (recon, auth bypass, access control, CSRF, headers, CORS, cache, clickjack)	+8	Planned
6	Web Advanced (proto pollution, SAML, OIDC, WebSocket, gRPC, postMessage, SSI/ESI, CSTI)	+10	Planned
7	Polish (README, LICENSE, manifest, install)	—	In progress

End state: ~107 skills across the same 13+ categories.

Contributing

Contributions welcome. See CONTRIBUTING.md for the skill template, frontmatter standard, and review process. Focused, single-surface skills are preferred over monolithic overviews.

License

MIT — use freely, attribution appreciated.

Acknowledgements

Author: Kai Aizen (SnailSploit) — snailsploit.com
Original Checklists: Sahar Shlichov — the offensive checklist collection many of these skills are based on.
Community: PRs and feedback that keep the library current with the threat landscape.

"Give Claude the right skill and it stops being a chatbot. It becomes an operator."

📚 Documentation & Author

This project's full writeup, methodology, and related research lives at:

https://snailsploit.com/claude-red

Created by Kai Aizen — independent offensive security researcher.

snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter

Same attack. Different substrate.

58 skills in this repo

Copy into ~/.claude/skills

offensive-active-directory

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalat...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/active-directory/offensive-active-directory ~/.claude/skills/offensive-active-directory

offensive-advanced-redteam

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-advanced-redteam ~/.claude/skills/offensive-advanced-redteam

offensive-ai-security

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/ai/offensive-ai-security ~/.claude/skills/offensive-ai-security

offensive-basic-exploitation

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-basic-exploitation ~/.claude/skills/offensive-basic-exploitation

offensive-bluetooth-ble

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Uberto...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-bluetooth-ble ~/.claude/skills/offensive-bluetooth-ble

offensive-bluetooth-classic

Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abu...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-bluetooth-classic ~/.claude/skills/offensive-bluetooth-classic

offensive-bug-identification

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/fuzzing/offensive-bug-identification ~/.claude/skills/offensive-bug-identification

offensive-business-logic

Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback ab...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-business-logic ~/.claude/skills/offensive-business-logic

offensive-cloud

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enu...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/cloud/offensive-cloud ~/.claude/skills/offensive-cloud

offensive-crash-analysis

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-crash-analysis ~/.claude/skills/offensive-crash-analysis

offensive-deauth-disassoc

Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 /...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-deauth-disassoc ~/.claude/skills/offensive-deauth-disassoc

offensive-deserialization

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-deserialization ~/.claude/skills/offensive-deserialization

offensive-edr-evasion

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-edr-evasion ~/.claude/skills/offensive-edr-evasion

offensive-evil-twin

Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-evil-twin ~/.claude/skills/offensive-evil-twin

offensive-exploit-dev-course

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-exploit-dev-course ~/.claude/skills/offensive-exploit-dev-course

offensive-exploit-development

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-exploit-development ~/.claude/skills/offensive-exploit-development

offensive-fast-checking

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/utility/offensive-fast-checking ~/.claude/skills/offensive-fast-checking

offensive-file-upload

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-file-upload ~/.claude/skills/offensive-file-upload

offensive-fuzzing

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use w...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/fuzzing/offensive-fuzzing ~/.claude/skills/offensive-fuzzing

offensive-fuzzing-course

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/fuzzing/offensive-fuzzing-course ~/.claude/skills/offensive-fuzzing-course

offensive-graphql

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-graphql ~/.claude/skills/offensive-graphql

offensive-idor

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-idor ~/.claude/skills/offensive-idor

offensive-initial-access

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-initial-access ~/.claude/skills/offensive-initial-access

offensive-iot

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analy...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/iot/offensive-iot ~/.claude/skills/offensive-iot

offensive-jwt

JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE co...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/auth/offensive-jwt ~/.claude/skills/offensive-jwt

offensive-keylogger-arch

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-keylogger-arch ~/.claude/skills/offensive-keylogger-arch

offensive-krack-fragattacks

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (m...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-krack-fragattacks ~/.claude/skills/offensive-krack-fragattacks

offensive-lorawan-sub-ghz

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fix...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-lorawan-sub-ghz ~/.claude/skills/offensive-lorawan-sub-ghz

offensive-mitigations

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-mitigations ~/.claude/skills/offensive-mitigations

offensive-mobile

Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jail...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/mobile/offensive-mobile ~/.claude/skills/offensive-mobile

offensive-oauth

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/auth/offensive-oauth ~/.claude/skills/offensive-oauth

offensive-open-redirect

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-open-redirect ~/.claude/skills/offensive-open-redirect

offensive-osint

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breac...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/recon/offensive-osint ~/.claude/skills/offensive-osint

offensive-osint-methodology

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/recon/offensive-osint-methodology ~/.claude/skills/offensive-osint-methodology

offensive-parameter-pollution

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-parameter-pollution ~/.claude/skills/offensive-parameter-pollution

offensive-race-condition

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-race-condition ~/.claude/skills/offensive-race-condition

offensive-rce

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-rce ~/.claude/skills/offensive-rce

offensive-reporting

Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact,...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/utility/offensive-reporting ~/.claude/skills/offensive-reporting

offensive-request-smuggling

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-request-smuggling ~/.claude/skills/offensive-request-smuggling

offensive-shellcode

Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to she...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-shellcode ~/.claude/skills/offensive-shellcode

offensive-sqli

SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF byp...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-sqli ~/.claude/skills/offensive-sqli

offensive-ssrf

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-ssrf ~/.claude/skills/offensive-ssrf

offensive-ssti

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-ssti ~/.claude/skills/offensive-ssti

offensive-toctou

Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/exploit-dev/offensive-toctou ~/.claude/skills/offensive-toctou

offensive-vuln-classes

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/fuzzing/offensive-vuln-classes ~/.claude/skills/offensive-vuln-classes

offensive-waf-bypass

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-waf-bypass ~/.claude/skills/offensive-waf-bypass

offensive-wifi

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wifi ~/.claude/skills/offensive-wifi

offensive-wifi-recon

Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe a...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wifi-recon ~/.claude/skills/offensive-wifi-recon

offensive-windows-boundaries

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-windows-boundaries ~/.claude/skills/offensive-windows-boundaries

offensive-windows-mitigations

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/infrastructure/offensive-windows-mitigations ~/.claude/skills/offensive-windows-mitigations

offensive-wpa2-psk

WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wpa2-psk ~/.claude/skills/offensive-wpa2-psk

offensive-wpa3-sae

WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Elem...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wpa3-sae ~/.claude/skills/offensive-wpa3-sae

offensive-wpa-enterprise

WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-respon...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wpa-enterprise ~/.claude/skills/offensive-wpa-enterprise

offensive-wps

WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-butt...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-wps ~/.claude/skills/offensive-wps

offensive-xss

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-xss ~/.claude/skills/offensive-xss

offensive-xxe

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/web/offensive-xxe ~/.claude/skills/offensive-xxe

offensive-zigbee-thread-matter

Zigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection atta...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-zigbee-thread-matter ~/.claude/skills/offensive-zigbee-thread-matter

offensive-z-wave

Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brut...

Install

git clone --depth 1 https://github.com/SnailSploit/Claude-Red
cp -r Claude-Red/Skills/wireless/offensive-z-wave ~/.claude/skills/offensive-z-wave

Comments (0)

No comments yet

Be the first to share your take.

Category	Skills	Focus
Web Application	16	OWASP Top 10 + business logic + advanced web bug classes
Auth & Identity	2	JWT, OAuth
Active Directory	1	On-prem AD attack methodology (expanding)
Wireless	13	802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz
Cloud	1	AWS / Azure / GCP attack paths (expanding)
Mobile	1	Android + iOS pentest (expanding)
IoT & Embedded	1	Hardware, firmware, RTOS, ICS (expanding)
Infrastructure & Red Team	7	Initial access, EDR evasion, Windows ops
Exploit Development	6	Stack/heap, mitigations, crash analysis, TOCTOU
Fuzzing & VR	4	libFuzzer, AFL++, bug ID, vuln classes
Reconnaissance	2	OSINT tooling and methodology
AI Security	1	Prompt injection, jailbreaks, RAG poisoning
Utility	2	Fast-checking, professional reporting

Claude Red

README

claude-red

Table of Contents

What is this

Quickstart

Claude Skills System (recommended)

Claude Code

Claude.ai (Manual)

Install Script

Categories

Skill Index

Web Application

Auth & Identity

Active Directory

Wireless

Cloud

Mobile

IoT & Embedded

Infrastructure & Red Team

Exploit Development

Fuzzing & Vulnerability Research

Reconnaissance

AI Security

Utility

Roadmap

Contributing

License

Acknowledgements

📚 Documentation & Author

58 skills in this repo

Comments (0)