Skip to content

Commit c7b211b

Browse files
claudeclaude
committed
Phase 3: Wireless split — 12 new focused skills (13 total in wireless/)
Split the monolithic offensive-wifi into per-surface skills: - offensive-wifi-recon: adapter, monitor mode, multi-band recon - offensive-wpa2-psk: handshake, PMKID, hashcat 22000 - offensive-wpa3-sae: transition downgrade, Dragonblood, SAE - offensive-wpa-enterprise: 802.1X, EAP, eaphammer evil-twin RADIUS - offensive-wps: Pixie Dust, online brute, vendor PIN derivation - offensive-evil-twin: KARMA/Mana, captive portal, post-association MITM - offensive-krack-fragattacks: KRACK + FragAttacks supplicant testing - offensive-deauth-disassoc: deauth tactics, PMF, action frames - offensive-bluetooth-ble: GATT, pairing, MITM, BLE crackle - offensive-bluetooth-classic: BR/EDR, SDP/SPP, KNOB, BlueBorne - offensive-zigbee-thread-matter: KillerBee, Touchlink, ZCL commands - offensive-z-wave: S0/S2, hub pivots - offensive-lorawan-sub-ghz: LoRaWAN ABP/OTAA, KeeLoq, TPMS, sub-GHz Original offensive-wifi retained as category overview/index. README and MINDMAP updated; manifest regenerated (58 skills total).
1 parent d15bc36 commit c7b211b

16 files changed

Lines changed: 2540 additions & 7 deletions

File tree

‎MINDMAP.md‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
# claude-red — Library Mindmap
2+
3+
A visual map of every skill in the library, by category. Use it to navigate, to discover skills you didn't know existed, and to spot coverage gaps before an engagement.
4+
5+
References for completeness checking: [MITRE ATT&CK](https://attack.mitre.org/), [HackTricks](https://book.hacktricks.xyz/), [OWASP WSTG](https://owasp.org/www-project-web-security-testing-guide/), [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings).
6+
7+
---
8+
9+
## Library Map
10+
11+
```mermaid
12+
mindmap
13+
root((claude-red))
14+
Web
15+
sqli
16+
xss
17+
ssrf
18+
ssti
19+
xxe
20+
idor
21+
file-upload
22+
rce
23+
deserialization
24+
race-condition
25+
request-smuggling
26+
open-redirect
27+
parameter-pollution
28+
graphql
29+
waf-bypass
30+
business-logic
31+
Auth
32+
jwt
33+
oauth
34+
Active-Directory
35+
active-directory
36+
Wireless
37+
wifi
38+
wifi-recon
39+
wpa2-psk
40+
wpa3-sae
41+
wpa-enterprise
42+
wps
43+
evil-twin
44+
krack-fragattacks
45+
deauth-disassoc
46+
bluetooth-ble
47+
bluetooth-classic
48+
zigbee-thread-matter
49+
z-wave
50+
lorawan-sub-ghz
51+
Cloud
52+
cloud
53+
Mobile
54+
mobile
55+
IoT
56+
iot
57+
Infrastructure
58+
initial-access
59+
advanced-redteam
60+
edr-evasion
61+
shellcode
62+
keylogger-arch
63+
windows-mitigations
64+
windows-boundaries
65+
Exploit-Dev
66+
exploit-development
67+
exploit-dev-course
68+
basic-exploitation
69+
crash-analysis
70+
mitigations
71+
toctou
72+
Fuzzing
73+
fuzzing
74+
fuzzing-course
75+
bug-identification
76+
vuln-classes
77+
Recon
78+
osint
79+
osint-methodology
80+
AI
81+
ai-security
82+
Utility
83+
fast-checking
84+
reporting
85+
```
86+
87+
---
88+
89+
## Coverage Cross-Reference
90+
91+
Use this table to confirm coverage of common offensive surfaces. If a row has no skill, it's a gap.
92+
93+
### Web Application (OWASP WSTG)
94+
95+
| Surface | Skill |
96+
|---|---|
97+
| Information gathering | `recon/offensive-osint`, `recon/offensive-osint-methodology` |
98+
| Configuration / deployment | `web/offensive-waf-bypass` |
99+
| Identity management | `auth/offensive-jwt`, `auth/offensive-oauth` |
100+
| Authentication | _(planned: `web/auth-bypass`)_ |
101+
| Authorization | `web/offensive-idor` |
102+
| Session management | `auth/offensive-jwt`, `auth/offensive-oauth` |
103+
| Input validation | `web/offensive-sqli`, `web/offensive-xss`, `web/offensive-xxe`, `web/offensive-ssti`, `web/offensive-ssrf` |
104+
| Error handling | _(implicit across web skills)_ |
105+
| Cryptography | _(planned)_ |
106+
| Business logic | `web/offensive-business-logic` |
107+
| Client-side | `web/offensive-xss`, `web/offensive-open-redirect` |
108+
| API testing | `web/offensive-graphql` |
109+
110+
### Internal Network / Active Directory (MITRE ATT&CK Enterprise)
111+
112+
| Tactic | Skill |
113+
|---|---|
114+
| Reconnaissance | `recon/offensive-osint`, `active-directory/offensive-active-directory` |
115+
| Initial Access | `infrastructure/offensive-initial-access` |
116+
| Execution | `infrastructure/offensive-advanced-redteam` |
117+
| Persistence | `active-directory/offensive-active-directory` |
118+
| Privilege Escalation | `active-directory/offensive-active-directory` |
119+
| Defense Evasion | `infrastructure/offensive-edr-evasion`, `infrastructure/offensive-windows-mitigations`, `infrastructure/offensive-windows-boundaries` |
120+
| Credential Access | `active-directory/offensive-active-directory` |
121+
| Discovery | `recon/offensive-osint`, `active-directory/offensive-active-directory` |
122+
| Lateral Movement | `active-directory/offensive-active-directory`, `infrastructure/offensive-advanced-redteam` |
123+
| Collection | `infrastructure/offensive-advanced-redteam` |
124+
| Command and Control | `infrastructure/offensive-advanced-redteam` |
125+
| Exfiltration | `infrastructure/offensive-advanced-redteam` |
126+
| Impact | `infrastructure/offensive-advanced-redteam` |
127+
128+
### Wireless
129+
130+
| Surface | Skill |
131+
|---|---|
132+
| Recon / war-driving | `wireless/offensive-wifi-recon` |
133+
| WPA2-PSK | `wireless/offensive-wifi` |
134+
| WPA3-SAE | `wireless/offensive-wifi` |
135+
| WPA-Enterprise | `wireless/offensive-wifi` |
136+
| WPS | `wireless/offensive-wifi` |
137+
| Evil twin / KARMA / Mana | `wireless/offensive-wifi` |
138+
| KRACK / FragAttacks | `wireless/offensive-wifi` |
139+
| Bluetooth (BLE + Classic) | `wireless/offensive-wifi` |
140+
| Zigbee / Thread / Matter | `wireless/offensive-wifi` |
141+
| Z-Wave | `wireless/offensive-wifi` |
142+
| LoRa / sub-GHz | `wireless/offensive-wifi` |
143+
144+
### Cloud
145+
146+
| Provider / Surface | Skill |
147+
|---|---|
148+
| AWS — privesc, IMDS, persistence | `cloud/offensive-cloud` |
149+
| Azure — privesc, IMDS, persistence | `cloud/offensive-cloud` |
150+
| GCP — privesc, IMDS, persistence | `cloud/offensive-cloud` |
151+
| Cross-cloud / OIDC trust | `cloud/offensive-cloud` |
152+
| Hybrid identity (AAD Connect, ADFS) | _(planned: `cloud-identity/`)_ |
153+
154+
### Mobile
155+
156+
| Platform / Surface | Skill |
157+
|---|---|
158+
| Android static + dynamic | `mobile/offensive-mobile` |
159+
| iOS static + dynamic | `mobile/offensive-mobile` |
160+
| Firebase / cloud misconfig | `mobile/offensive-mobile` |
161+
| Mobile API testing | `mobile/offensive-mobile` |
162+
| Biometric / pinning bypass | `mobile/offensive-mobile` |
163+
164+
### IoT / Embedded
165+
166+
| Layer | Skill |
167+
|---|---|
168+
| Hardware recon | `iot/offensive-iot` |
169+
| UART / JTAG / SWD | `iot/offensive-iot` |
170+
| Flash extraction | `iot/offensive-iot` |
171+
| Firmware analysis | `iot/offensive-iot` |
172+
| Bootloader / secure boot | `iot/offensive-iot` |
173+
| RTOS exploitation | `iot/offensive-iot` |
174+
| ICS / OT protocols | `iot/offensive-iot` |
175+
| MQTT / CoAP | `iot/offensive-iot` |
176+
177+
### Exploit Development
178+
179+
| Topic | Skill |
180+
|---|---|
181+
| Beginner / mitigations off | `exploit-dev/offensive-basic-exploitation` |
182+
| Course curriculum | `exploit-dev/offensive-exploit-dev-course` |
183+
| Stack / heap / ROP | `exploit-dev/offensive-exploit-development` |
184+
| Modern mitigations | `exploit-dev/offensive-mitigations` |
185+
| Crash triage | `exploit-dev/offensive-crash-analysis` |
186+
| TOCTOU / race | `exploit-dev/offensive-toctou`, `web/offensive-race-condition` |
187+
188+
### Fuzzing & Vulnerability Research
189+
190+
| Topic | Skill |
191+
|---|---|
192+
| Coverage-guided fuzzing | `fuzzing/offensive-fuzzing` |
193+
| Fuzzing curriculum | `fuzzing/offensive-fuzzing-course` |
194+
| Static review patterns | `fuzzing/offensive-bug-identification` |
195+
| Vuln class taxonomy | `fuzzing/offensive-vuln-classes` |
196+
197+
### AI Security
198+
199+
| Topic | Skill |
200+
|---|---|
201+
| Prompt injection / jailbreak / RAG | `ai/offensive-ai-security` |
202+
203+
### Utility
204+
205+
| Topic | Skill |
206+
|---|---|
207+
| Fast triage checklist | `utility/offensive-fast-checking` |
208+
| Pro pentest reporting | `utility/offensive-reporting` |
209+
210+
---
211+
212+
## How to Use the Mindmap
213+
214+
- **Pre-engagement:** Walk the relevant category branch and confirm a skill exists per surface in scope. Gaps you spot here are gaps in the engagement plan.
215+
- **During engagement:** Click into the category for the surface you're testing; load only those skills into Claude.
216+
- **Post-engagement:** Cross-check findings against the relevant Mindmap branches to ensure no surface was skipped.

‎README.md‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
**Offensive security skills for Claude — drop-in `SKILL.md` files that turn Claude into a context-aware red team operator.**
88

99
[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
10-
[![Skills](https://img.shields.io/badge/skills-45-red.svg)](#skill-index)
10+
[![Skills](https://img.shields.io/badge/skills-58-red.svg)](#skill-index)
1111
[![Categories](https://img.shields.io/badge/categories-13-orange.svg)](#categories)
1212
[![Stars](https://img.shields.io/github/stars/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red)
1313
[![Forks](https://img.shields.io/github/forks/SnailSploit/claude-red?style=social)](https://github.com/SnailSploit/claude-red/network/members)
@@ -100,7 +100,7 @@ Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to
100100
| [Web Application](#web-application) | 16 | OWASP Top 10 + business logic + advanced web bug classes |
101101
| [Auth & Identity](#auth--identity) | 2 | JWT, OAuth |
102102
| [Active Directory](#active-directory) | 1 | On-prem AD attack methodology *(expanding)* |
103-
| [Wireless](#wireless) | 1 | 802.11, WPA2/3, EAP, BLE, Zigbee, sub-GHz *(expanding)* |
103+
| [Wireless](#wireless) | 13 | 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
104104
| [Cloud](#cloud) | 1 | AWS / Azure / GCP attack paths *(expanding)* |
105105
| [Mobile](#mobile) | 1 | Android + iOS pentest *(expanding)* |
106106
| [IoT & Embedded](#iot--embedded) | 1 | Hardware, firmware, RTOS, ICS *(expanding)* |
@@ -163,9 +163,20 @@ Paste the contents of a `SKILL.md` into a Project's system prompt or prepend to
163163

164164
| Skill | Description |
165165
|---|---|
166-
| [`offensive-wifi`](Skills/wireless/offensive-wifi/SKILL.md) | 802.11 — WPA2/3/EAP, KARMA/Mana, KRACK, WPS, BLE, Zigbee, sub-GHz |
167-
168-
> **Note:** Being split into 12 focused skills. See [Roadmap](#roadmap).
166+
| [`offensive-wifi`](Skills/wireless/offensive-wifi/SKILL.md) | 802.11 overview — entrypoint into the wireless category |
167+
| [`offensive-wifi-recon`](Skills/wireless/offensive-wifi-recon/SKILL.md) | Adapter selection, monitor mode, multi-band airspace mapping |
168+
| [`offensive-wpa2-psk`](Skills/wireless/offensive-wpa2-psk/SKILL.md) | Handshake capture, PMKID, hashcat 22000 cracking |
169+
| [`offensive-wpa3-sae`](Skills/wireless/offensive-wpa3-sae/SKILL.md) | Transition-mode downgrade, Dragonblood, SAE side-channels |
170+
| [`offensive-wpa-enterprise`](Skills/wireless/offensive-wpa-enterprise/SKILL.md) | 802.1X / EAP attacks, eaphammer evil-twin RADIUS |
171+
| [`offensive-wps`](Skills/wireless/offensive-wps/SKILL.md) | Pixie Dust, online PIN brute, vendor PIN generators |
172+
| [`offensive-evil-twin`](Skills/wireless/offensive-evil-twin/SKILL.md) | KARMA, Mana, captive portal, post-association MITM |
173+
| [`offensive-krack-fragattacks`](Skills/wireless/offensive-krack-fragattacks/SKILL.md) | KRACK + FragAttacks supplicant testing |
174+
| [`offensive-deauth-disassoc`](Skills/wireless/offensive-deauth-disassoc/SKILL.md) | Targeted/broadcast deauth, PMF awareness, action frames |
175+
| [`offensive-bluetooth-ble`](Skills/wireless/offensive-bluetooth-ble/SKILL.md) | BLE GATT enum, pairing downgrade, sniffing, MITM |
176+
| [`offensive-bluetooth-classic`](Skills/wireless/offensive-bluetooth-classic/SKILL.md) | BR/EDR — SDP, SPP, KNOB, BlueBorne, HID spoofing |
177+
| [`offensive-zigbee-thread-matter`](Skills/wireless/offensive-zigbee-thread-matter/SKILL.md) | 802.15.4 mesh — KillerBee, Touchlink abuse, ZCL command injection |
178+
| [`offensive-z-wave`](Skills/wireless/offensive-z-wave/SKILL.md) | S0 key derivation flaw, S2 commissioning, hub pivots |
179+
| [`offensive-lorawan-sub-ghz`](Skills/wireless/offensive-lorawan-sub-ghz/SKILL.md) | LoRaWAN ABP/OTAA, KeeLoq garage doors, fixed-code, TPMS |
169180

170181
### Cloud
171182

0 commit comments

Comments
 (0)