enterprise-vpn-attack

What problem does it solve?

It helps you quickly identify which enterprise SSL VPN/remote-access appliance a target uses and determine the most likely vulnerability classes and pre-auth testing paths, reducing guesswork during recon and triage.

Core Features & Use Cases

• Vendor fingerprinting and session-marker detection: Guides detection via characteristic paths, cookies, and headers across Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure/Ivanti Connect Secure, SonicWall, and F5 Big-IP.
• CVE-oriented pre-auth/auth-bypass triage (2018-2026): Provides a curated CVE matrix with non-disruptive detection tests and targeted exploit-type guidance aligned to SSL VPN web stacks.
• AAA backend identification and SAML awareness: Helps infer whether authentication is driven by RADIUS/LDAP/local accounts or SAML/Entra flows, enabling safe downstream pivoting and misconfiguration checks.
• Safety and operational discipline: Includes guardrails to avoid disruptive or high-impact tests without explicit OK, plus rate-limit guidance for critical infrastructure.

Quick Start

Use this skill to fingerprint the VPN gateway by probing likely vendor login and metadata endpoints and then select the relevant CVE tests for fast, low-disruption validation.