skills.rest
Carlos-Reyes-UTP
Carlos-Reyes-UTPCOMMUNITY
Explore all skills by this author →
GitHub

enterprise-vpn-attack

Fingerprint enterprise SSL VPN appliances and map CVE-relevant pre-auth testing paths.

2|Updated Apr 11, 2025
Search Tags:#security testing#fingerprinting#saml#cve triage#enterprise vpn#ssl vpn#pre-auth detection
One-click install
npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill enterprise-vpn-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: enterprise-vpn-attack
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/enterprise-vpn-attack
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill enterprise-vpn-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you quickly identify which enterprise SSL VPN/remote-access appliance a target uses and determine the most likely vulnerability classes and pre-auth testing paths, reducing guesswork during recon and triage.

Core Features & Use Cases

  • Vendor fingerprinting and session-marker detection: Guides detection via characteristic paths, cookies, and headers across Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure/Ivanti Connect Secure, SonicWall, and F5 Big-IP.
  • CVE-oriented pre-auth/auth-bypass triage (2018-2026): Provides a curated CVE matrix with non-disruptive detection tests and targeted exploit-type guidance aligned to SSL VPN web stacks.
  • AAA backend identification and SAML awareness: Helps infer whether authentication is driven by RADIUS/LDAP/local accounts or SAML/Entra flows, enabling safe downstream pivoting and misconfiguration checks.
  • Safety and operational discipline: Includes guardrails to avoid disruptive or high-impact tests without explicit OK, plus rate-limit guidance for critical infrastructure.

Quick Start

Use this skill to fingerprint the VPN gateway by probing likely vendor login and metadata endpoints and then select the relevant CVE tests for fast, low-disruption validation.

Frequently Asked Questions about enterprise-vpn-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint an enterprise SSL VPN appliance during reconnaissance?▼

To fingerprint an enterprise SSL VPN, probe vendor login portals, metadata endpoints, and session cookies to identify Cisco ASA, FortiGate, Citrix ADC, Palo Alto GlobalProtect, Pulse Secure, SonicWall, or F5 Big-IP.

Can I test SSL VPN pre-auth vulnerabilities without disrupting critical infrastructure?▼

Yes, you can test SSL VPN pre-auth vulnerabilities safely by applying non-disruptive validation checks and rate-limit guidance, ensuring critical infrastructure remains stable during vulnerability triage.

How does SAML backend inference work for enterprise VPN remote-access appliances?▼

SAML backend inference detects whether VPN authentication relies on RADIUS, LDAP, local accounts, or SAML/Entra flows by analyzing session markers and AAA backend responses from the exposed gateway.

What is the best way to triage SSL VPN CVEs across multiple vendors?▼

The best way to triage SSL VPN CVEs is mapping externally exposed appliances to a curated CVE matrix spanning 2018-2026, then applying targeted, non-disruptive detection tests for each vendor stack.

Do I need explicit authorization before probing SSL VPN web login portals?▼

Yes, you need explicit authorization before probing SSL VPN web login portals, as the skill enforces scoping guardrails and operational discipline to prevent high-impact tests without proper approval.

Why does enterprise VPN fingerprinting require YAML-defined discovery metadata?▼

Enterprise VPN fingerprinting requires YAML-defined discovery metadata to map characteristic paths, cookies, and headers systematically, enabling accurate vendor identification and CVE-relevant pre-auth testing paths.

Related Skills

Explore More Education & Research Skills→
pdparchitectpdparchitect
13

vmware-vcenter-attack

Assess internet-exposed VMware vCenter appliances for vulnerabilities and misconfigurations.

Community
Advanced
n4igmen4igme

enterprise-vpn-attack

Fingerprint enterprise VPN appliances and validate pre-auth CVEs.

Community
Advanced
Kisilev13Kisilev13

hunt-saml

Detect and exploit SAML/SSO authentication vulnerabilities in web applications.

Community
Advanced
securityfortechsecurityfortech
6

web-fingerprinting

Identify web server type, frameworks, and versions via banner and header analysis.

Official
Intermediate