DQIII8: Skill for Claude Code

/red-team — Adversarial Security Testing

Attack the codebase like a real hacker. Find vulnerabilities that static scanners miss. Think like an attacker, not a checker.

Usage

/red-team                          # Full attack on current project
/red-team $ARGUMENTS               # Attack specific path or component

Philosophy

• You are NOT a scanner. You are an attacker.
• Think: "How would I break this?" not "Does this follow best practices?"
• Chain vulnerabilities: a LOW finding + another LOW = potential CRITICAL
• Test the DEPLOYMENT, not just the code (env vars, permissions, exposed ports)
• Vibe-coded patterns are predictable — exploit that predictability

Attack Phases

Phase 0: External Attack Surface

Start here — simulate an external attacker with no inside knowledge:

1. Port scan — discover exposed services:

   for port in 22 80 443 3000 5000 8000 8080 8443 9000; do
     result=$(curl -s --connect-timeout 2 -o /dev/null -w "%{http_code}" http://localhost:$port 2>/dev/null)
     [ "$result" != "000" ] && echo "  port $port → HTTP $result"
   done
   ss -tlnp | grep LISTEN
   

2. Auth endpoints — probe without credentials:

   for path in / /api /api/health /api/admin /admin /metrics /debug; do
     code=$(curl -s --connect-timeout 2 -o /dev/null -w "%{http_code}" http://localhost:8000$path 2>/dev/null)
     echo "  $path → $code"
   done
   

3. CORS test — check for misconfigured cross-origin policy:

   curl -s -H "Origin: https://evil.com" -I http://localhost:8000/ 2>/dev/null | grep -i "access-control"
   

4. fail2ban — verify brute-force protection:

   fail2ban-client status 2>/dev/null || echo "fail2ban not running — SSH brute-force unprotected"
   fail2ban-client status sshd 2>/dev/null | grep -E "banned|failed"
   

5. SSL/TLS — check cipher weaknesses if HTTPS is exposed.

Phase 1: Reconnaissance

Map the internal attack surface:

# Find all entry points (web routes, API endpoints, CLI args)
grep -rn "@app\.\|@router\.\|argparse\|sys.argv" --include="*.py" .
# Find all external connections (DB, API, network)
grep -rn "connect\|requests\.\|urllib\|subprocess\|exec\|eval" --include="*.py" .
# Find authentication mechanisms
grep -rn "auth\|token\|session\|cookie\|password\|jwt\|oauth" --include="*.py" .
# Find file operations (path traversal candidates)
grep -rn "open(\|Path(\|os.path\|shutil" --include="*.py" .
# Map MCP servers and their permissions
cat ~/.claude.json 2>/dev/null | python3 -c "import json,sys; [print(f'MCP: {k}') for k in json.load(sys.stdin).get('mcpServers',{}).keys()]"