offensive-fast-checking
The offensive-fast-checking skill provides a speed-optimized vulnerability assessment methodology combining reconnaissance shortcuts, quick-win pattern detection, and automated scanner configurations. Apply this skill during time-boxed penetration tests, CTF competitions, or initial rapid surface mapping phases when quick vulnerability identification takes priority over comprehensive analysis.
git clone --depth 1 https://github.com/SnailSploit/Claude-Red /tmp/offensive-fast-checking && cp -r /tmp/offensive-fast-checking/Skills/utility/offensive-fast-checking ~/.claude/skills/offensive-fast-checkingSKILL.md
# SKILL: Fast Testing Checklist
## Metadata
- **Skill Name**: fast-checking
- **Folder**: offensive-fast-checking
- **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/fast-checking.md
## Description
Speed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping.
## Trigger Phrases
Use this skill when the conversation involves any of:
`fast check, quick recon, rapid assessment, quick wins, fast triage, speed checklist, time-boxed, CTF, fast scan, quick vulnerability`
## Instructions for Claude
When this skill is active:
1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings
---
## Full Methodology
# Fast Testing Checklist
A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file
- use [lostsec](https://lostsec.xyz/)
- maintain a personal payloads repo synced with BLNS/SecLists; keep a tiny “golden” set for smoke tests
## Reconnaissance and Analysis
- [ ] Map visible content (Manually)
- [ ] Perform Functionality Mapping by browsing the application thoroughly.
- [ ] Check API Documentation (Public, Swagger/OpenAPI).
- [ ] Discover hidden & default content (Directory/File Bruteforce)
- [ ] Test for debug parameters
- [ ] Identify data entry points (Discover Dynamic Content in Burp Pro)
- [ ] Identify the technologies used (Wappalyzer or similiar)
- [ ] Research existing vulnerabilities in technology (Google ++)
- [ ] Gather wordlists for specific technology (Assetnote, SecList and Naughty Strings)
- [ ] Map the attack surface automatically (e.g Burp spider)
- [ ] Identify all javascript files for later analysis (in your proxy)
- [ ] Scope Discovery (DNS, IPs, Subdomains)
- [ ] Capture API contracts (OpenAPI/GraphQL) and diff against observed traffic
- [ ] Identify gateways/WAF/CDN (headers, cookies, control pages)
- [ ] Identify cache layers and behaviors (vary keys, CDN rules, edge rewrites)
### Find Origin IP behind CDN/WAF
- [ ] Confirm WAF presence (IP Org check, headers, cookies, block pages).
- [ ] Check Historical DNS records (SecurityTrails, DNSDumpster).
- [ ] Enumerate Subdomains & check IPs (focus on dev/staging).
- [ ] Analyze SSL Certificates (Censys, Shodan - check SANs).
- [ ] Analyze Email Headers from target (Received, X-Originating-IP).
- [ ] Test potential IPs directly (`curl --resolve example.com:443:<IP> https://example.com/`).
- [ ] Verify potential origin IPs (compare content, headers, certs).
- [ ] Probe HTTP/3 Alt‑Svc leakage and SNI/Host mismatches.
## Access Control Testing
### Authentication
- [ ] Test password quality rules
- [ ] Minimum length, complexity, history, common password checks?
- [ ] Paste functionality disabled?
- [ ] Test for username enumeration
- [ ] Analyze response time, error messages, status codes for valid/invalid users.
- [ ] Check account recovery flow for enumeration.
- [ ] Test resilience to password guessing
- [ ] Is there rate limiting on login attempts?
- [ ] Is there account lockout mechanism?
- [ ] Test any account recovery function
- [ ] Weak security questions?
- [ ] Host header injection in reset emails?
- [ ] Token leakage via Referer?
- [ ] Lack of token validation?
- [ ] Predictable reset tokens?
- [ ] Test any "remember me" function
- [ ] Analyze token entropy, expiration, security attributes.
- [ ] Test any impersonation function
- [ ] Test username uniqueness
- [ ] Case sensitivity issues? (`admin` vs `Admin`)
- [ ] Whitespace trimming issues?
- [ ] Check for unsafe distribution of credentials
- [ ] Test for fail-open conditions
- [ ] Test any multi-stage mechanisms
- [ ] MFA bypasses (enrollment skip, verification manipulation, brute-force codes)?
- [ ] Can MFA be disabled easily?
- [ ] Parameter pollution vulnerabilities?
- [ ] Test OAuth Flows (see dedicated section).
- [ ] Test JWT implementations (see dedicated section).
- [ ] Check for API Key leakage (source code, client-side JS, mobile apps).
- [ ] Test API Key usage (URL, Header, Cookie).
- [ ] Test HTTP Basic Auth strength.
- [ ] Test HMAC signature implementation if used.
- [ ] Validate DPoP/mTLS token binding if advertised.
- [ ] Refresh‑token rotation and reuse detection.
- [ ] Passkeys/WebAuthn flows including recovery/fallbacks.
### Session handling
- [ ] Test tokens for meaning
- [ ] Test tokens for predictability
- [ ] Check for insecure transmission of tokens
- [ ] Missing Secure flag on cookies?
- [ ] Sent over HTTP?
- [ ] Check for disclosure of tokens in logs and URL params
- [ ] Check mapping of tokens to sessions(can they be reused?)
- [ ] Check session termination
- [ ] Does logout fully invalidate the session token?
- [ ] Is there session rotation on login/logout/privilege change?
- [ ] Check session timeout enforcement (client/server).
- [ ] Token reuse across devices; device binding enforced?
- [ ] Cookie partitioning/CHIPS behavior in embedded/3rd‑party contexts.
- [ ] Check for session fixation
- [ ] Are session tokens retained pre/post-authentication?
- [ ] Can a specific token be forced on a user?
- [ ] Check for cross-site request forgery
- [ ] Presence and validation of Anti-CSRF tokens?
- [ ] Use of SameSite cookie attribute?
- Check if `Lax` or `Strict`. `None` requires `Secure`.
- [ ] Check Referer/Origin header validation.
- [ ] Try removing token parameter.
- [ ] Try switching request method (POST -> GET).
- [ ] Try changing Content-Type.
- [ ] Use Burp CSRF PoC generator.
- [ ] Test login CSRF and OActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.