MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "skill-router" as configured in blacklanternsecurity/red-run. Runs locally from the tools/skill-router Python package. Needs 1 environment variable to run.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "nmap-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/nmap-server Python package.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "shell-server", hosted remotely at 127.0.0.1, as configured in blacklanternsecurity/red-run.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "browser-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/browser-server Python package.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "rdp-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/rdp-server Python package.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "state" as configured in blacklanternsecurity/red-run. Runs locally from the tools/state-server Python package.
MCP server Claude CodeCodexCursor +2
One of 7 in .mcp.json
MCP server "sliver-server", hosted remotely at 127.0.0.1, as configured in blacklanternsecurity/red-run.
Agent Claude Code
Active Directory discovery subagent for red-run. Performs AD enumeration, BloodHound collection, LDAP queries, and attack surface mapping as directed by the orchestrator. Use when the orchestrator needs to enumerate a domain and map AD attack paths.
Agent Claude Code
Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the orchestrator. Handles Kerberos attacks, ADCS abuse, ACL exploitation, credential operations, lateral movement, and domain persistence. Use when the orchestrator needs to exploit an AD vulnerability.
Agent Claude Code
Credential cracking subagent for red-run. Performs offline hash cracking and encrypted file cracking using hashcat and john as directed by the orchestrator. Handles hash identification, wordlist selection, rule escalation, and file extraction (2john tools). All operations are local — no target interaction. Use when…
Agent Claude Code
AV/EDR evasion subagent for red-run. Builds AV-safe payloads and applies runtime evasion techniques as directed by the orchestrator. Handles custom payload compilation (mingw, Go), AMSI bypass, ETW patching, and alternative execution methods. Use when an exploit or privesc agent reports that a payload was quarantined…
Agent Claude Code
Linux privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Linux host discovery, sudo/SUID/capabilities abuse, cron/service exploitation, file path abuse, kernel exploits, and container escapes. Use when the orchestrator has shell access on a…
Agent Claude Code
Network reconnaissance subagent for red-run. Performs host discovery, port scanning, service enumeration, and quick-win checks as directed by the orchestrator. Has access to nmap via MCP server — no sudo handoff needed. Use when the orchestrator needs to scan a target or subnet.
Agent Claude Code
Password spraying subagent for red-run. Executes credential spraying against any authentication service (AD, web forms, SSH, etc.) as directed by the orchestrator. Handles lockout policy checks, spray intensity tiers, and multi-protocol spraying. Use when the orchestrator needs to spray credentials against discovered…
Agent Claude Code
Pivoting and tunneling subagent for red-run. Sets up network tunnels through compromised hosts to reach internal subnets. Handles SSH tunnels, sshuttle, ligolo-ng, chisel, and socat as directed by the orchestrator. Use when the orchestrator has shell access on a dual-homed host and needs to reach an internal network.
Agent Claude Code
Deep analysis subagent for red-run. Analyzes custom applications, binaries, and scripts that standard technique skills could not crack. Performs source code review, binary analysis, CVE research, and PoC adaptation. Use when any technique agent returns saying standard patterns do not match.
Agent Claude Code
Web application discovery subagent for red-run. Performs web application enumeration, technology fingerprinting, and vulnerability identification as directed by the orchestrator. Handles content discovery, input mapping, and attack surface analysis. Use when the orchestrator needs to discover vulnerabilities in a web…
Agent Claude Code
Web application exploitation subagent for red-run. Executes one web technique skill per invocation as directed by the orchestrator. Handles injection testing, authentication bypass, file upload, deserialization, and all other web exploitation techniques. Use when the orchestrator needs to exploit a web vulnerability.
Agent Claude Code
Windows privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Windows host discovery, token impersonation, service/DLL abuse, UAC bypass, credential harvesting, and kernel exploits. Use when the orchestrator has shell access on a Windows host and…
Skill Claude CodeCodex
You are helping a penetration tester with . All testing is under explicit written authorization.
Skill Claude CodeCodex
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials (msDS-KeyCredentialLink → PKINIT), and AdminSDHolder persistence.
Skill Claude CodeCodex
Enumerates Active Directory domains and maps attack surface for penetration testing.
Skill Claude CodeCodex
Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key (LSASS master password), custom SSP injection (credential logging via mimilib/memssp), security descriptor backdoors (WMI/WinRM/ DCOM/registry ACL modification), ADFS…
Skill Claude CodeCodex
Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL → modify to ESC1), ESC5 (PKI object ACLs), ESC7 (ManageCA/ManageCertificates abuse), ESC8 (NTLM relay to HTTP enrollment), ESC11 (NTLM relay to ICPR RPC).
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: