{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/red-team-tools",
  "version": "1.0.0",
  "name": "Red Team Tools",
  "description": "This skill should be used when the user asks to \"follow red team methodology\", \"perform bug bounty hunting\", \"automate reconnaissance\", \"hunt for XSS vulnerabilities\", \"enumerate su...",
  "system_prompt_fragment": "# Red Team Tools and Methodology\n\n## Purpose\n\nImplement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.\n\n## Inputs/Prerequisites\n\n- Target scope definition (domains, IP ranges, applications)\n- Linux-based attack machine (Kali, Ubuntu)\n- Bug bounty program rules and scope\n- Tool dependencies installed (Go, Python, Ruby)\n- API keys for various services (Shodan, Censys, etc.)\n\n## Outputs/Deliverables\n\n- Comprehensive subdomain enumeration\n- Live host discovery and technology fingerprinting\n- Identified vulnerabilities and attack vectors\n- Automated recon pipeline outputs\n- Documented findings for reporting\n\n## Core Workflow\n\n### 1. Project Tracking and Acquisitions\n\nSet up reconnaissance tracking:\n\n```bash\n# Create project structure\nmkdir -p target/{recon,vulns,reports}\ncd target\n\n# Find acquisitions using Crunchbase\n# Search manually for subsidiary companies\n\n# Get ASN for targets\namass intel -org \"Target Company\" -src\n\n# Alternative ASN lookup\ncurl -s \"https://bgp.he.net/search?search=targetcompany&commit=Search\"\n```\n\n### 2. Subdomain Enumeration\n\nComprehensive subdomain discovery:\n\n```bash\n# Create wildcards file\necho \"target.com\" > wildcards\n\n# Run Amass passively\namass enum -passive -d target.com -src -o amass_passive.txt\n\n# Run Amass actively\namass enum -active -d target.com -src -o amass_active.txt\n\n# Use Subfinder\nsubfinder -d target.com -silent -o subfinder.txt\n\n# Asset discovery\ncat wildcards | assetfinder --subs-only | anew domains.txt\n\n# Alternative subdomain tools\nfindomain -t target.com -o\n\n# Generate permutations with dnsgen\ncat domains.txt | dnsgen - | httprobe > permuted.txt\n\n# Combine all sources\ncat amass_*.txt subfinder.txt | sort -u > all_subs.txt\n```\n\n### 3. Live Host Discovery\n\nIdentify responding hosts:\n\n```bash\n# Check which hosts are live with httprobe\ncat domains.txt | httprobe -c 80 --prefer-https | anew hosts.txt\n\n# Use httpx for more details\ncat domains.txt | httpx -title -tech-detect -status-code -o live_hosts.txt\n\n# Alternative with massdns\nmassdns -r resolvers.txt -t A -o S domains.txt > resolved.txt\n```\n\n### 4. Technology Fingerprinting\n\nIdentify technologies for targeted attacks:\n\n```bash\n# Whatweb scanning\nwhatweb -i hosts.txt -a 3 -v > tech_stack.txt\n\n# Nuclei technology detection\nnuclei -l hosts.txt -t technologies/ -o tech_nuclei.txt\n\n# Wappalyzer (if available)\n# Browser extension for manual review\n```\n\n### 5. Content Discovery\n\nFind hidden endpoints and files:\n\n```bash\n# Directory bruteforce with ffuf\nffuf -ac -v -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt\n\n# Historical URLs from Wayback\nwaybackurls target.com | tee wayback.txt\n\n# Find all URLs with gau\ngau target.com | tee all_urls.txt\n\n# Parameter discovery\ncat all_urls.txt | grep \"=\" | sort -u > params.txt\n\n# Generate custom wordlist from historical data\ncat all_urls.txt | unfurl paths | sort -u > custom_wordlist.txt\n```\n\n### 6. Application Analysis (Jason Haddix Method)\n\n**Heat Map Priority Areas:**\n\n1. **File Uploads** - Test for injection, XXE, SSRF, shell upload\n2. **Content Types** - Filter Burp for multipart forms\n3. **APIs** - Look for hidden methods, lack of auth\n4. **Profile Sections** - Stored XSS, custom fields\n5. **Integrations** - SSRF through third parties\n6. **Error Pages** - Exotic injection points\n\n**Analysis Questions:**\n- How does the app pass data? (Params, API, Hybrid)\n- Where does the app talk about users? (UID, UUID endpoints)\n- Does the site have multi-tenancy or user levels?\n- Does it have a unique threat model?\n- How does the site handle XSS/CSRF?\n- Has the site had past writeups/exploits?\n\n### 7. Automated XSS Hunting\n\n```bash\n# ParamSpider for parameter extraction\npython3 paramspider.py --domain target.com -o params.txt\n\n# Filter with Gxss\ncat params.txt | Gxss -p test\n\n# Dalfox for XSS testing\ncat params.txt | dalfox pipe --mining-dict params.txt -o xss_results.txt\n\n# Alternative workflow\nwaybackurls target.com | grep \"=\" | qsreplace '\"><script>alert(1)</script>' | while read url; do\n    curl -s \"$url\" | grep -q 'alert(1)' && echo \"$url\"\ndone > potential_xss.txt\n```\n\n### 8. Vulnerability Scanning\n\n```bash\n# Nuclei comprehensive scan\nnuclei -l hosts.txt -t ~/nuclei-templates/ -o nuclei_results.txt\n\n# Check for common CVEs\nnuclei -l hosts.txt -t cves/ -o cve_results.txt\n\n# Web vulnerabilities\nnuclei -l hosts.txt -t vulnerabilities/ -o vuln_results.txt\n```\n\n### 9. API Enumeration\n\n**Wordlists for API fuzzing:**\n\n```bash\n# Enumerate API endpoints\nffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt\n\n# Test API versions\nffuf -u https://target.com/api/v1/FUZZ -w api_wordlist.txt\nffuf -u https://target.com/api/v2/FUZZ -w api_wordlist.txt\n\n# Check for hidden methods\nfor method in GET POST PUT DELETE PATCH; do\n    curl -X $method https://target.com/api/users -v\ndone\n```\n\n### 10. Automated Recon Script\n\n```bash\n#!/bin/bash\ndomain=$1\n\nif [[ -z $domain ]]; then\n    echo \"Usage: ./recon.sh <domain>\"\n    exit 1\nfi\n\nmkdir -p \"$domain\"\n\n# Subdomain enumeration\necho \"[*] Enumerating subdomains...\"\nsubfinder -d \"$domain\" -silent > \"$domain/subs.txt\"\n\n# Live host discovery\necho \"[*] Finding live hosts...\"\ncat \"$domain/subs.txt\" | httpx -title -tech-detect -status-code > \"$domain/live.txt\"\n\n# URL collection\necho \"[*] Collecting URLs...\"\ncat \"$domain/live.txt\" | waybackurls > \"$domain/urls.txt\"\n\n# Nuclei scanning\necho \"[*] Running Nuclei...\"\nnuclei -l \"$domain/live.txt\" -o \"$domain/nuclei.txt\"\n\necho \"[+] Recon complete!\"\n```\n\n## Quick Reference\n\n### Essential Tools\n\n| Tool | Purpose |\n|------|---------|\n| Amass | Subdomain enumeration |\n| Subfinder | Fast subdomain discovery |\n| httpx/httprobe | Live host detection |\n| ffuf | Content discovery |\n| Nuclei | Vulnerability scanning |\n| Burp Suite | Manual testing |\n| Dalfox | XSS automation |\n| waybackurls | Historical URL mining |\n\n### Key API Endpoints to Check\n\n```\n/api/v1/users\n/api/v1/admin\n/api/v1/profile\n/api/users/me\n/api/config\n/api/debug\n/api/swagger\n/api/graphql\n```\n\n### XSS Filter Testing\n\n```html\n<!-- Test encoding handling -->\n<h1><img><table>\n<script>\n%3Cscript%3E\n%253Cscript%253E\n%26lt;script%26gt;\n```\n\n## Constraints\n\n- Respect program scope boundaries\n- Avoid DoS or fuzzing on production without permission\n- Rate limit requests to avoid blocking\n- Some tools may generate false positives\n- API keys required for full functionality of some tools\n\n## Examples\n\n### Example 1: Quick Subdomain Recon\n\n```bash\nsubfinder -d target.com | httpx -title | tee results.txt\n```\n\n### Example 2: XSS Hunting Pipeline\n\n```bash\nwaybackurls target.com | grep \"=\" | qsreplace \"test\" | httpx -silent | dalfox pipe\n```\n\n### Example 3: Comprehensive Scan\n\n```bash\n# Full recon chain\namass enum -d target.com | httpx | nuclei -t ~/nuclei-templates/\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Rate limited | Use proxy rotation, reduce concurrency |\n| Too many results | Focus on specific technology stacks |\n| False positives | Manually verify findings before reporting |\n| Missing subdomains | Combine multiple enumeration sources |\n| API key errors | Verify keys in config files |\n| Tools not found | Install Go tools with `go install` |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/red-team-tools"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/red-team-tools",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/red-team-tools",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}