SnailSploit/Claude-Red

AI Pentest provides an offensive AI/LLM security checklist covering prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, and AI reconnaissance. Use it when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors.

Advanced Red Team Ops provides a methodology for red team engagements covering OPSEC, C2 infrastructure, living-off-the-land, lateral movement, persistence, and exfiltration. Use it when planning advanced red team operations or studying APT TTPs.

Basic Exploitation teaches foundational Linux exploitation techniques such as controlling EIP/RIP, ROP chain construction, ret2libc, shellcode injection, and heap spraying. Use it when building initial proofs of concept or understanding classic exploitation primitives with mitigations disabled.

Bug Identification provides a systematic methodology for discovering software vulnerabilities through static analysis, dynamic analysis, fuzzing, and AI-assisted techniques. Use it for code audits, bug bounty triage, or building vulnerability identification pipelines.

Crash Analysis triages crash dumps and debugger output to determine if a vulnerability is exploitable. Use it when assessing fuzzer crashes, reading stack traces, or identifying root causes with WinDbg, GDB, ASAN, or MSAN.

EDR Evasion provides an offensive checklist for hook unhooking, direct syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, and memory encryption. Use it when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.

Exploit Development provides a structured course roadmap and syllabus for learning exploit development, covering fuzzing with AFL++ and FuzzTest, vulnerability classes, and advanced exploitation. Use it to structure training, track progress, or onboard new vulnerability researchers.

Exploit Development provides an operational guide for environment setup, debugging workflow, PoC development, writing reliable exploits, using pwntools/pwndbg, heap exploitation, and weaponization. Use it when actively developing exploits or setting up an exploit dev environment.

Kernel Exploit Mitigations catalogs modern OS security mitigations like ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, and seccomp, along with detection methods and known bypass techniques. Use it when assessing target hardening or planning exploit mitigation bypasses.

Keylogger Architecture documents low-level Windows keyboard input capture techniques, including SetWindowsHookEx and ETW-based hooks, and their IOCs. Use it when researching keyloggers, EDR evasion, or malware architecture analysis.

Modern Initial Access provides a checklist of techniques for gaining initial foothold in red team engagements, including phishing, credential attacks, exposed services, and supply chain compromise. Use it when planning attack paths mapped to MITRE ATT&CK TA0001.

OAuth Security Testing applies an OAuth 2.0 attack checklist covering redirect_uri bypass, state parameter abuse, PKCE bypass, token leakage, and scope escalation when testing web apps or bug bounty.

OSINT Methodology provides a structured framework for open source intelligence campaigns, covering target profiling, collection workflows, data correlation, timeline reconstruction, and reporting.

Offensive Active Directory provides red team attack methodology for Active Directory, covering reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, ADCS abuse, and Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID, or ADCS deployments.

Offensive Cloud provides a cloud security attack methodology for AWS, Azure, and GCP covering credential harvesting, enumeration, privilege escalation, persistence, and exfiltration. Use when testing cloud accounts, after stealing cloud credentials, or assessing cloud posture.

Offensive Fuzzing teaches a structured methodology for discovering vulnerabilities using coverage-guided fuzzing with AFL++ and libFuzzer. Use it when setting up fuzz campaigns, selecting harness strategies, or triaging fuzzer output.

Offensive Fuzzing covers fuzzer selection, harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage for fuzz campaigns against file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.

Offensive IoT provides a methodology for security testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction, analysis, and exploitation. Use for pentests, smart-home assessments, ICS/OT testing, or embedded vulnerability research.

Offensive JWT catalogs JWT attack techniques for penetration testers, covering algorithm confusion, weak secrets, header injection, and mobile token extraction. Use it when testing JWT-based authentication or evaluating JWT implementation security in web or mobile apps.

Offensive Mobile provides a methodology for penetration testing Android and iOS applications, covering static analysis, dynamic instrumentation with Frida, SSL pinning bypass, and insecure data storage audits.

Offensive Shellcode provides a reference for developing custom shellcode, loaders, and evasion techniques for offensive security engagements. Use when writing x86/x64 shellcode, implementing position-independent code, or evading AV/EDR.

Offensive TOCTOU provides a methodology for exploiting time-of-check/time-of-use race conditions in filesystems, kernels, web applications, and containers. Use it when auditing privileged binaries, fuzzing for race conditions, or testing concurrency bugs in orchestrators.

Vulnerability Classes covers core memory corruption classes like stack/heap overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions with real-world CVE case studies. Use when learning exploit development, researching vulnerability patterns, or teaching offensive security.

Windows Mitigations covers Windows exploit mitigations such as ASLR, DEP, CFG, CET, SEHOP, and ACG, including known bypass techniques. Use it when researching Windows hardening, planning mitigation bypass strategies, or analyzing crash dumps to identify which protection stopped an exploit.

Windows Security Boundaries maps Windows security boundary taxonomy and enumerates attack surfaces such as kernel/user, sandbox, COM/RPC, and hypervisor boundaries, used when planning privilege escalation and sandbox escape paths.