network-appliance-offensive
Installation
SKILL.md
Network-Appliance Offensive
firewall-review audits a config statically; infrastructure covers generic ports/DNS/SMB. Neither tests a live perimeter appliance or its VPN crypto — so IKE builders, SIC/OPSEC fingerprinting, and TTL discriminators were reinvented from raw sockets each engagement, often shallowly, and CVE applicability was left UNDETERMINED across whole estates. This skill provides the deterministic, tested tools and the precondition-gated methodology. Non-destructive only — every tool observes/decodes/infers; none fires an exploit, and CVE applicability is a precondition check, never a blind "vulnerable."
Tools
| Tool | Does | Anti-footgun |
|---|---|---|
tools/ike_enum.py |
IKEv1 aggressive-mode detection, IKEv1/IKEv2 transform + DH-group enum, NOTIFY / NAT-T decode (wraps ike-scan, raw ISAKMP SA_INIT builder fallback) |
Aggressive-mode support (PSK-hash leak) is the finding; enumerate, don't crack in-band |
tools/checkpoint_sic_opsec.py |
Fingerprint SIC (18190/1), OPSEC LEA/ELA (18183/4), CA (18192/18210), FW1 (256/264), Gaia Portal; emit a CVE-precondition map incl. CVE-2024-24919 | CVE-2024-24919 is applicable ONLY when the RA/Mobile-Access marker is observed — else undetermined |
tools/appliance_version_infer.py |
Safe firmware/patch-level inference for FortiGate / PAN-OS / Cisco ASA / Citrix from headers, login markers, cert CN/serial → CVE applicability | Never asserts applicable on a low-confidence / unknown version — returns undetermined |
tools/tls_handshake_probe.py |
Which TLS versions are supported, by completed handshake per pinned protocol | Fixes the openssl s_client exit/SECLEVEL false-positive — an aborted handshake ≠ support |
tools/ntlm_decode.py |
Decode an NTLM Type-2 (CHALLENGE) AV_PAIR block → NetBIOS/DNS host, domain, forest, OS build | Info-leak finding from an unauthenticated challenge; no auth attempted |
tools/perimeter_forensics.py |
RST-TTL forgery discriminator (real host vs firewall forging a RST) + IKE NOTIFY decode | Never asserts "internal host behind FW" on RSTs alone — a firewall forges RSTs indistinguishably at this layer; returns undetermined without an open-service TTL baseline |