21 procédures penetration testing issues de Anthropic-Cybersecurity-Skills, chargées par les agents CyberForge. Chaque skill est un fichier lisible, versionné, retirable.
| Skill | Ce qu'il fait |
|---|---|
| conducting api security testing | Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp |
| conducting external reconnaissance with osint | Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization''s external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, cer |
| conducting internal network penetration test | Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network. |
| conducting mobile app penetration test | Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific se |
| conducting network penetration test | Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infras |
| conducting social engineering penetration test | Design and execute a social engineering penetration test including phishing, vishing, smishing, and physical pretexting campaigns to measure human security resilience and identify training gaps. |
| conducting wireless network penetration test | Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-sid |
| executing active directory attack simulation | Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for at |
| executing phishing simulation campaign | Executes authorized phishing simulation campaigns to assess an organization''s susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing email |
| executing red team exercise | Executes comprehensive red team exercises that simulate real-world adversary operations against an organization''s people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial re |
| exploiting sql injection vulnerabilities | Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time |
| moving laterally with netexec | Use NetExec for SMB, WinRM, LDAP, and MSSQL enumeration, password spraying, and execution. |
| performing active directory penetration test | Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise. |
| performing external network penetration test | Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting. |
| performing iot security assessment | Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debuggin |
| performing privilege escalation assessment | Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquot |
| performing thick client application penetration test | Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite. |
| performing vulnerability scanning with nessus | Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner correlat |
| performing web application penetration test | Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses B |
| performing wireless network penetration test | Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools. |
| testing for xss vulnerabilities | Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation. The tester identifies al |
Source : Anthropic-Cybersecurity-Skills (Apache-2.0). Hub Forge AI indexe et exécute ; il n'est pas l'auteur de ces skills.
Ces skills, exécutés par vos agents
CyberForge déployé sur votre infrastructure
Cette bibliothèque est ce que les agents CyberForge chargent quand ils travaillent chez vous : à jour chaque semaine, en lecture seule par défaut, avec validation humaine sur toute action sensible.