kmshihab7878/claude-code-setup/offensive-security

Offensive Security

AI-powered security testing patterns for authorized engagements.

how to use

• /offensive-security

Apply offensive security methodology to the current engagement.

• /offensive-security <target-context>

Plan a security assessment for the given context.

when to apply

Reference these guidelines when:

• conducting authorized penetration tests
• participating in CTF competitions
• building security testing automation
• reviewing code for exploitable vulnerabilities
• designing red team exercises
• building honeypots or deception technology

authorization requirements

CRITICAL: All offensive security activities require explicit authorization.

Before any engagement:

1. Verify written authorization (scope document, rules of engagement)
2. Confirm target scope boundaries
3. Establish communication channels with asset owners
4. Document all activities for audit trail
5. Integration: Use the operator's PostToolUse hook (audit.log) for activity logging

methodology: PTES framework

Phase 1: Pre-Engagement

• Define scope, rules of engagement, emergency contacts
• Legal review and authorization documentation
• Tool preparation and environment setup

Phase 2: Intelligence Gathering

• Passive OSINT: See osint-recon skill for detailed workflows
• Active scanning: Nmap, Masscan for service enumeration
• Web enumeration: Directory brute-force, subdomain discovery
• Integration: Use memory MCP server to store findings as entities/relations

Phase 3: Threat Modeling

• Map attack surface from gathered intelligence
• Identify high-value targets and likely attack paths
• Prioritize by impact × probability
• Integration: Use sequential MCP thinking for complex threat models

Phase 4: Vulnerability Analysis

• Automated scanning (Nessus, OpenVAS, Nuclei)
• Manual code review (see security-review skill)
• Configuration audit
• API security testing

Phase 5: Exploitation

• Proof-of-concept development
• Privilege escalation chains
• Lateral movement mapping
• Data exfiltration simulation (authorized only)

Phase 6: Post-Exploitation

• Persistence mechanism analysis
• Credential harvesting assessment
• Impact demonstration
• Clean-up and evidence removal

Phase 7: Reporting

• Executive summary with business impact
• Technical findings with CVSS scores
• Remediation recommendations with priority
• Evidence documentation (screenshots, logs, PoC code)

AI-powered security testing patterns

Automated Reconnaissance (from HexStrike-AI concepts)

# Pattern: AI-driven target profiling
from typing import TypedDict
class ReconProfile(TypedDict):
    target: str
    open_ports: list[int]
    services: dict[str, str]
    technologies: list[str]
    potential_vulns: list[str]
    attack_surface_score: float  # 0.0 - 10.0
def ai_recon_pipeline(target: str) -> ReconProfile:
    """AI-enhanced reconnaissance pipeline."""
    # 1. Port scan → service detection
    # 2. Technology fingerprinting
    # 3. CVE correlation
    # 4. Attack surface scoring
    # 5. AI-generated attack path suggestions
    ...

Vulnerability Prioritization

# Pattern: ML-based vulnerability prioritization
def prioritize_vulns(vulns: list[dict]) -> list[dict]:
    """Prioritize vulnerabilities using CVSS + contextual factors."""
    for vuln in vulns:
        base_score = vuln['cvss_score']
        # Contextual adjustments
        if vuln['exploitable_remotely']:
            base_score *= 1.3
        if vuln['has_public_exploit']:
            base_score *= 1.5
        if vuln['affects_auth']:
            base_score *= 1.4
        vuln['priority_score'] = min(base_score, 10.0)
    return sorted(vulns, key=lambda v: v['priority_score'], reverse=True)

web application testing checklist

Authentication Testing

• [ ] Brute force protection (rate limiting, lockout)
• [ ] Password policy enforcement
• [ ] Session management (token entropy, expiration, fixation)
• [ ] Multi-factor authentication bypass attempts
• [ ] OAuth/OIDC misconfiguration
• [ ] JWT algorithm confusion (none, HS256/RS256 swap)

Authorization Testing

• [ ] IDOR (Insecure Direct Object Reference)
• [ ] Privilege escalation (horizontal and vertical)
• [ ] Function-level access control
• [ ] API endpoint authorization

Injection Testing

• [ ] SQL injection (union, blind, time-based, error-based)
• [ ] XSS (reflected, stored, DOM-based)
• [ ] Command injection
• [ ] SSTI (Server-Side Template Injection)
• [ ] LDAP injection
• [ ] XML/XXE injection

Business Logic

• [ ] Race conditions (TOCTOU)
• [ ] Integer overflow/underflow
• [ ] Price manipulation
• [ ] Workflow bypass

CTF patterns

Common Challenge Categories

Quick pwntools Template

from pwn import *
# Connect
context.binary = elf = ELF('./challenge')
p = remote('target.ctf', 1337)  # or process('./challenge')
# Exploit pattern
payload = flat(
    b'A' * offset,
    p64(rop_gadget),
    p64(target_function),
)
p.sendlineafter(b'> ', payload)
p.interactive()

social engineering awareness

Patterns to test (from SET concepts):

• Phishing email templates (for authorized awareness testing)
• Credential harvesting page detection
• Pretexting scenarios
• USB drop simulation
• Vishing call scripts

Integration: CoreMind GAOS output_validator (Layer 4) should detect and block phishing content in agent outputs.

tool integration map

cross-references

• osint-recon skill: OSINT investigation workflows
• security-review skill: Code-level security analysis
• security-auditor agent: Automated vulnerability scanning
• security-engineer agent: Compliance and hardening
• SECURITY_PLAYBOOK.md: 36 rules across 8 categories
• SECURITY_ARSENAL.md: Tool inventory reference
• CoreMind GAOS: 5-layer safety stack for agent security