Find specialist playbooks for internal network penetration testing after initial access is established. Covers movement between hosts, credential collection, privilege escalation, persistent access, tunneling, and assessments involving Active Directory, certificate services, Exchange, and SharePoint.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
当任务从互联网评估转入主机、域或内网操作时使用本 Skill。需要已获得初始访问权限或立足点。
前置条件：如果尚未获得初始访问，先完成外网渗透获取立足点。
| 目标类型 | 首选参考 |
|---|---|
| 横向移动（PsExec/WMI/WinRM/DCOM/SSH/RDP/PTH/PTT） | references/intranet-playbook-01-lateral-movement.md |
| 规避与反检测（AMSI绕过/ETW/注入/伪装/签名二进制滥用） | references/intranet-playbook-02-evasion-and-anti-detection.md |
| 凭据窃取（Mimikatz/Kerberoasting/DCSync/浏览器Vault） | references/intranet-playbook-03-credential-theft.md |
| 提权与持久化（Token/Service/Potato/Cron/Registry/WMI） | references/intranet-playbook-04-privilege-escalation.md + 05-persistence.md |
| 隧道与代理（FRP/Chisel/Ligolo/SOCKS/SSH/DNS/ICMP） | references/intranet-playbook-06-tunneling-and-proxy.md |
| 信息收集 | references/intranet-playbook-07-information-gathering.md |
| AD 攻击（BloodHound/AS-REP/Kerberoasting/Golden/Silver） | references/intranet-playbook-08-active-directory-attacks.md |
| ADCS 攻击（ESC1-8/Certipy/Certreq） | references/intranet-playbook-09-adcs-attacks.md |
| Exchange 攻击 | references/intranet-playbook-10-exchange-attacks.md |
| SharePoint 攻击 | references/intranet-playbook-11-sharepoint-attacks.md |
references/06-intranet-and-host-operations-integrated.md — 内网操作整合参考references/intranet-playbook-01~11-*.md — 各专项 Playbook（11 个）references/intranet-pentest-playbook-skill.md — Playbook 入口아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test Android app security by operating the app and inspecting network traffic first, then analyzing APK code or observing functions during execution when needed. Verify vulnerabilities and produce a report with screenshots, traffic evidence, and code review findings.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.