SnailSploit / Claude-Red

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Title: SnailSploit / Claude-Red

claude-red Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator. Overview • Quickstart • Categories • Skill Index • Roadmap • Contributing Overview claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse. Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don’t pay context for skills you aren’t using. Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration. for our actual research using skills -> https://snailsploit.com

claude-red 是为 Claude 提供的进攻性安全技能库，通过插入 SKILL.md 文件，将 Claude 转变为具备上下文感知能力的红队操作员。概述 • 快速入门 • 分类 • 技能索引 • 路线图 • 贡献。claude-red 是一个为 Claude Skills 系统精心策划的进攻性安全技能库。每个技能都是一个结构化的 SKILL.md 文件，为 Claude 提供针对特定攻击面的专家级方法论——从 SQL 注入到 Shellcode，从 EDR 规避到 ADCS 滥用。将技能放入 Claude 环境中，它就会表现得像一名领域专家：了解相关技术、工具、边缘情况和提权路径。技能会根据对话触发器按需加载，因此无需为未使用的技能支付上下文成本。使用场景包括：授权红队演练、漏洞赏金分类、安全研究、CTF 准备、操作员培训以及系统化的攻击面探索。实际研究请访问 -> https://snailsploit.com

Quickstart Claude Skills System (Recommended) git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads offensive-sqli). To install a single category: git clone —filter=blob:none —sparse https://github.com/SnailSploit/claude-red cd claude-red && git sparse-checkout set Skills/web Skills/active-directory Claude Code cat Skills/web/offensive-sqli/SKILL.md | claude —system-file - cat Skills/active-directory/**/SKILL.md | claude —system-file - Claude.ai (Manual) Paste the contents of a SKILL.md into a Project’s system prompt or prepend it to your conversation. Install Script ./install.sh # interactive ./install.sh —target ~/.claude/skills # explicit target ./install.sh —category web # single category

快速入门：Claude Skills 系统（推荐）。执行 git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red。Claude 会根据对话触发器自动加载匹配的技能（例如，提到 SQL 注入会加载 offensive-sqli）。若要安装单个类别，请使用：git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red，随后进入目录并设置稀疏检出。Claude Code 使用方式：cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -。Claude.ai（手动）：将 SKILL.md 的内容粘贴到项目的系统提示词中，或将其置于对话开头。安装脚本：./install.sh（交互式）、./install.sh --target ~/.claude/skills（指定目标）、./install.sh --category web（单个类别）。

Categories Category Skills Focus Web Application 16 OWASP Top 10, business logic, advanced web vulnerability classes Auth & Identity 2 JWT exploitation, OAuth/OIDC abuse Active Directory 1 On-prem AD attack methodology Wireless 14 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz Cloud 1 AWS, Azure, GCP attack paths Mobile 1 Android and iOS application testing IoT & Embedded 1 Hardware, firmware, RTOS, ICS/OT Infrastructure & Red Team 7 Initial access, EDR evasion, advanced red team operations, Windows internals Exploit Development 6 Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU Fuzzing & Vulnerability Research 4 libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy Reconnaissance 2 OSINT tooling and structured intelligence collection API Security 2 REST/gRPC/WebSocket testing, business logic abuse Container & Kubernetes 2 Container escape, Kubernetes cluster exploitation CI/CD & Pipeline 2 Pipeline exploitation, secrets extraction Cryptography 2 Cryptographic implementation attacks, TLS/SSL Privilege Escalation 2 Linux and Windows privilege escalation Post-Exploitation 3 Lateral movement, persistence mechanisms, data exfiltration Forensics & C2 2 Anti-forensics tradecraft, C2 framework operations Supply Chain 2 Supply chain attacks, dependency confusion Social Engineering 2 Phishing campaigns, physical/vishing/smishing Network Attacks 1 Layer 2/3 attacks, MITM, protocol poisoning AI Security 1 Prompt injection, jailbreaking, RAG poisoning Utility 2 Fast triage checklists, professional reporting

分类：Web 应用（16 项，涵盖 OWASP Top 10、业务逻辑、高级 Web 漏洞）、身份验证与识别（2 项，JWT/OAuth 滥用）、Active Directory（1 项，本地 AD 攻击方法）、无线网络（14 项，802.11、WPA2/3、BLE 等）、云安全（1 项，AWS/Azure/GCP 攻击路径）、移动端（1 项，Android/iOS 测试）、物联网与嵌入式（1 项，硬件/固件/RTOS）、基础设施与红队（7 项，初始访问、EDR 规避、Windows 内核）、漏洞开发（6 项，堆栈溢出、ROP、崩溃分析）、模糊测试与漏洞研究（4 项，libFuzzer、AFL++）、侦察（2 项，OSINT 工具）、API 安全（2 项，REST/gRPC 测试）、容器与 Kubernetes（2 项，容器逃逸）、CI/CD 与流水线（2 项，流水线攻击）、密码学（2 项，加密实现攻击）、提权（2 项，Linux/Windows 提权）、后渗透（3 项，横向移动、持久化）、取证与 C2（2 项，反取证、C2 框架）、供应链（2 项，供应链攻击）、社会工程学（2 项，钓鱼）、网络攻击（1 项，二/三层攻击）、AI 安全（1 项，提示词注入）、实用工具（2 项，分类清单、专业报告）。

Skill Index Web Application Skills/web/ Skill Description offensive-sqli SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs offensive-xss Cross-site scripting — stored, reflected, DOM-based, mutation XSS offensive-ssrf Server-side request forgery — cloud metadata pivots, filter bypass offensive-ssti Server-side template injection — engine fingerprinting, RCE chains offensive-xxe XML external entity — OOB exfiltration, blind XXE techniques offensive-idor Insecure direct object references — enumeration, authorization bypass offensive-file-upload File upload — extension bypass, polyglot files, webshell deployment offensive-rce Remote code execution — command injection, deserialization chains offensive-deserialization Insecure deserialization — Java, PHP, .NET gadget chains offensive-race-condition Race conditions — TOCTOU, single-packet attacks, limit bypass offensive-request-smuggling HTTP request smuggling — CL.TE, TE.CL, H2 desync offensive-open-redirect Open redirect — OAuth token theft, phishing, SSRF pivots offensive-parameter-pollution HTTP parameter pollution — WAF bypass, logic confusion offensive-graphql GraphQL — introspection abuse, batching attacks, alias-based IDOR offensive-waf-bypass WAF bypass — encoding tricks, chunked transfer, case mutation offensive-business-logic Business logic — workflow bypass, pricing abuse, multi-step chains

技能索引：Web 应用（Skills/web/）。offensive-sqli：SQL 注入（报错、盲注、OOB、数据库特定载荷、ORM CVE）；offensive-xss：跨站脚本（存储型、反射型、DOM 型、变异 XSS）；offensive-ssrf：服务端请求伪造（云元数据透传、过滤器绕过）；offensive-ssti：服务端模板注入（引擎指纹、RCE 链）；offensive-xxe：XML 外部实体（OOB 外带、盲注 XXE）；offensive-idor：不安全的对象直接引用（枚举、授权绕过）；offensive-file-upload：文件上传（扩展名绕过、多语言文件、Webshell 部署）；offensive-rce：远程代码执行（命令注入、反序列化链）；offensive-deserialization：不安全的反序列化（Java/PHP/.NET 小工具链）；offensive-race-condition：竞争条件（TOCTOU、单包攻击）；offensive-request-smuggling：HTTP 请求走私（CL.TE、TE.CL、H2 同步）；offensive-open-redirect：开放重定向（OAuth 令牌窃取、钓鱼、SSRF 透传）；offensive-parameter-pollution：HTTP 参数污染（WAF 绕过、逻辑混淆）；offensive-graphql：GraphQL（内省滥用、批量攻击、基于别名的 IDOR）；offensive-waf-bypass：WAF 绕过（编码技巧、分块传输、大小写变异）；offensive-business-logic：业务逻辑（工作流绕过、定价滥用、多步链）。

Auth & Identity Skills/auth/ Skill Description offensive-jwt JWT attacks — alg:none, key confusion, secret cracking, claim tampering offensive-oauth OAuth/OIDC — redirect URI abuse, token leakage, PKCE bypass Active Directory Skills/active-directory/ Skill Description offensive-active-directory AD methodology — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, hybrid AAD Wireless Skills/wireless/ Skill Description offensive-wifi 802.11 overview — entrypoint for wireless assessments offensive-wifi-recon Adapter configuration, monitor mode, multi-band airspace mapping offensive-wpa2-psk WPA2-PSK — handshake capture, PMKID extraction, hashcat cracking offensive-wpa3-sae WPA3-SAE — transition-mode downgrade, Dragonblood, side-channel attacks offensive-wpa-enterprise 802.1X/EAP — credential relay, evil-twin RADIUS, certificate abuse offensive-wps WPS — Pixie Dust offline attack, online PIN brute force, vendor PIN prediction offensive-evil-twin Evil twin — KARMA, Mana, captive portal credential capture, MITM offensive-krack-fragattacks KRACK and FragAttacks — supplicant vulnerability testing offensive-deauth-disassoc Deauthentication — targeted/broadcast frames, PMF awareness offensive-bluet

身份验证与识别（Skills/auth/）：offensive-jwt（JWT 攻击：alg:none、密钥混淆、秘密破解、声明篡改）；offensive-oauth（OAuth/OIDC：重定向 URI 滥用、令牌泄露、PKCE 绕过）。Active Directory（Skills/active-directory/）：offensive-active-directory（AD 方法论：Kerberoast、ASREProast、ACL 滥用、ADCS ESC1-15、委派、混合 AAD）。无线网络（Skills/wireless/）：offensive-wifi（802.11 概述）；offensive-wifi-recon（适配器配置、监听模式、多频段映射）；offensive-wpa2-psk（WPA2-PSK：握手捕获、PMKID 提取、hashcat 破解）；offensive-wpa3-sae（WPA3-SAE：降级攻击、Dragonblood、侧信道攻击）；offensive-wpa-enterprise（802.1X/EAP：凭据中继、邪恶双子 RADIUS、证书滥用）；offensive-wps（WPS：Pixie Dust 离线攻击、PIN 暴力破解）；offensive-evil-twin（邪恶双子：KARMA、Mana、门户凭据捕获、MITM）；offensive-krack-fragattacks（KRACK 和 FragAttacks：客户端漏洞测试）；offensive-deauth-disassoc（去认证：目标/广播帧、PMF 感知）；offensive-bluet（蓝牙相关）。