Enterprise Vpn Attack
External SSL VPN / remote-access appliance attack matrix, Cisco ASA/AnyConnect...
Install
npx skills add elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Testing
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
External SSL VPN / remote-access appliance attack matrix, Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway, these are the most common initial-access points in 2024-2026 actor TTPs.
When to use this skill
Trigger when recon surfaces:
*.<client>.example/+CSCOE+/logon.htmlor similar+CSCOE+paths → Cisco ASA / AnyConnectintranet.*/vpn.*/connect.*/webvpn.*/wc.*/remote.*subdomains- Port 443 returning login pages with
Server: Apacheor banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti" - TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
- HTTP responses with
Set-Cookie: webvpn=(Cisco) /SVPNCOOKIE=(Fortinet) /NSC_AAA=(Citrix) /DSAuthSession=(Pulse) /BIGipServer*(F5)
DO NOT use for:
- Internal lateral-movement post-foothold (out of scope per user's boundary)
- VPN client-side bugs (different attack class)
- IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)
Vendor identification (fingerprinting)
Cisco ASA / AnyConnect
curl -skI 'https://target/+CSCOE+/logon.html' | head -10
# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content
# Login page contains: "AnyConnect", "CSCOE", "logon.html"
ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.
# Path-based version hints (older builds leaked builds in URLs)
curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
curl -sk 'https://target/+CSCOE+/saml/sp/metadata' # 200 = SAML auth enabled
curl -sk 'https://target/CSCOSSLC/config-auth' # AnyConnect handshake endpoint
Fortinet FortiGate / FortiOS
curl -skI 'https://target/remote/login' | head -10
# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx"
# Login page contains: "FortiGate", "Fortinet", "SSL-VPN"
Version: /remote/info sometimes leaks (older), or /login?username= 302 response
