The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill describes a method to bulk extract TLS private keys from GoEdge CDN instances by iterating through certification IDs (1-500) via the /SSLCertService/findEnabledSSLCertConfig API endpoint using an administrative token. The extracted keys are explicitly identified as plaintext PEM data.
[DATA_EXFILTRATION]: Instructions are provided for an ARP MITM attack designed to capture SSH, FTP, and HTTP plaintext passwords using the dsniff tool on the local network (L2). Intercepted data is saved to a log file (/tmp/dsniff.log) for later exfiltration.
[PERSISTENCE]: The skill instructs setting up persistence mechanisms to ensure attack tools remain active. This includes adding a watchdog script to crontab (running every 2 minutes) and modifying rc.local to execute sniffing tools automatically upon system reboot.
[COMMAND_EXECUTION]: The playbook requires the execution of several sensitive networking and administrative tools, including arpspoof, tcpdump, dsniff, and pkill. It also includes commands to modify kernel parameters, such as enabling IP forwarding via echo 1 > /proc/sys/net/ipv4/ip_forward.
[PRIVILEGE_ESCALATION]: The skill describes bypassing ARP resolution issues in specific environments (Hyper-V/CentOS7) by manually replacing neighbor table entries using ip neigh replace, an operation that typically requires elevated (root) privileges.
[DYNAMIC_EXECUTION]: The skill references multiple external scripts designed for exploitation, including s3_sts_exploit.py for AWS credential escalation and stomp_sockjs_exploit.py, which is noted for SpEL (Spring Expression Language) injection and bypassing CDN security layers.

specialized-attack-playbooks