s0ld13rr

s0ld13rr/pentestcode

Skill Claude CodeCodex

Work with Effect v4 / effect-smol TypeScript code in this repo.

s0ld13rr/pentestcode

Instructions file CodexOpenCode

Instructions for s0ld13rr/pentestcode, covering branch names, commits and pr titles, style guide, general principles and destructuring.

s0ld13rr/pentestcode

Instructions file

Instructions for s0ld13rr/pentestcode, covering claude.md, what this is, project structure, multi-agent architecture and key files.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, or chat applications. Covers Agent class, state management, callable RPC, Workflows integration, and React hooks.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POSTEXPLOIT.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULNASSESS.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web- skill to load for each surface. Use on any web app / HTTP API engagement.

s0ld13rr/pentestcode

Skill Claude CodeCodex

CI/CD & dev-infra attack techniques — credential exposure, RCE (script console / build), pipeline abuse, secret stores. Use when a CI/CD or SCM service is exposed. Triggers - Jenkins /job/ or script console, GitLab, ArgoCD, TeamCity, Gitea, Drone, exposed .git, runner token, pipeline.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Database service attack techniques — auth bypass, UDF/xpcmdshell/COPY-TO-PROGRAM RCE, file read/write, cred dump. Use when a database service is found or you have DB creds. Triggers - MySQL 3306, PostgreSQL 5432, MSSQL 1433, Oracle 1521, Redis 6379, MongoDB 27017, db banner, default DB creds, NOAUTH.

s0ld13rr/pentestcode

Skill Claude CodeCodex

DNS attack techniques — zone transfer, subdomain enumeration/takeover, cache poisoning. Use when DNS is found or you're mapping a domain. Triggers - port 53, named/bind, AXFR zone transfer, dangling CNAME, subdomain takeover, wildcard DNS.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet 10250, etcd 2379, /version, privileged pod, service-account token, docker.sock.

s0ld13rr/pentestcode

Skill Claude CodeCodex

FTP attack techniques — anonymous access, writable dirs, version CVEs, credential attacks. Use when FTP is open. Triggers - port 21, ftp banner, vsftpd 2.3.4, ProFTPD modcopy, anonymous login, pure-ftpd.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Mail server attack techniques — SMTP open relay, VRFY/EXPN/RCPT user enumeration, header injection, IMAP/POP3 access. Use when a mail service is found. Triggers - SMTP 25/465/587, POP3 110, IMAP 143, Postfix/Exim/Sendmail/Dovecot banner, VRFY.

s0ld13rr/pentestcode

Skill Claude CodeCodex

Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold…

s0ld13rr/pentestcode

Skill Claude CodeCodex

SMB/CIFS attack techniques — null sessions, share enumeration, NTLM relay, EternalBlue, signing checks. Use when SMB is found. Triggers - ports 445/139, netbios, MS17-010 EternalBlue, signing:False, null session, share access, PetitPotam/coerce.

s0ld13rr/pentestcode

Skill Claude CodeCodex

SSH attack techniques — version CVEs, auth-method/user enumeration, key issues, targeted brute. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, user-enum CVE-2018-15473, authorizedkeys, weak/leaked key.