skills.rest
cmndcntrlcyber
cmndcntrlcyberCOMMUNITY
Explore all skills by this author →
GitHub

enterprise-vpn-attack

Identify and exploit known vulnerabilities in enterprise VPN appliances.

3|Updated Nov 12, 2025
Search Tags:#vulnerability#CVE#VPN#exploit#fingerprinting#red-teaming
One-click install
npx skills add https://github.com/cmndcntrlcyber/rtpi --skill enterprise-vpn-attack-cmndcntrlcyber
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: enterprise-vpn-attack
Source: https://github.com/cmndcntrlcyber/rtpi/tree/main/knowledge_seed/bug_hunter_skills/enterprise-vpn-attack
Command: npx skills add https://github.com/cmndcntrlcyber/rtpi --skill enterprise-vpn-attack-cmndcntrlcyber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides an attack matrix for various enterprise VPN appliances, including Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, and SonicWall. It helps red teamers identify potential vulnerabilities in the target's perimeter and launch targeted attacks.

Core Features & Use Cases

  • Version Fingerprinting: Identify the version and configuration of the target VPN appliance.
  • CVE Matrix: List known vulnerabilities for each VPN appliance, categorized by CVE number and type.
  • Default Credentials: Provide information on default credentials for different vendors.
  • Configuration Disclosure: Identify paths and methods for obtaining configuration information.
  • Exploit Information: Provide instructions and PoCs for exploiting identified vulnerabilities.
  • Use Case: A red teamer can use this Skill to target a specific VPN appliance at a client and attempt to exploit a known vulnerability to gain access to the network.

Quick Start

To start the skill, simply execute the following command:

enterprise-vpn-attack

Frequently Asked Questions about enterprise-vpn-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify known VPN appliance vulnerabilities for red teaming?▼

You can identify known VPN appliance vulnerabilities by using a CVE matrix that lists exploits and configuration disclosure paths for Cisco ASA, Fortinet FortiGate, Citrix NetScaler, Palo Alto GlobalProtect, Pulse Secure, and SonicWall.

What is version fingerprinting for enterprise VPN appliances?▼

Version fingerprinting for enterprise VPN appliances is the process of identifying the specific version and configuration of a target VPN appliance to match it against known CVEs and default credentials.

How do I exploit pre-auth RCE or path traversal on FortiGate or Pulse Secure?▼

You can exploit pre-auth RCE or path traversal on FortiGate or Pulse Secure by referencing included exploit instructions and PoCs mapped to specific CVEs within the attack matrix.

Does this VPN attack matrix include default credentials for Cisco ASA and SonicWall?▼

Yes, this VPN attack matrix includes default credentials for various vendors, including Cisco ASA and SonicWall, to assist red teamers in gaining initial network access.

Can I find configuration disclosure methods for Citrix NetScaler and GlobalProtect?▼

Yes, you can find configuration disclosure methods for Citrix NetScaler and Palo Alto GlobalProtect, specifically identifying paths and techniques to extract configuration information from the target VPN appliance.

What VPN appliance vulnerabilities are covered by this attack matrix?▼

This attack matrix covers VPN appliance vulnerabilities including pre-auth RCE, SSRF, and path traversal exploits for Cisco ASA, Fortinet FortiOS, Citrix ADC, Palo Alto GlobalProtect, Pulse Secure, and SonicWall.

Related Skills

chainreactorschainreactors
235

gogo

Automate network reconnaissance to identify live hosts, open ports, and service fingerprints.

Official
Intermediate
Prohao42Prohao42
120

tunneling-and-pivoting

Establish network tunnels and pivot paths from compromised hosts.

Community
Advanced
pdparchitectpdparchitect
13

enterprise-vpn-attack

Fingerprint enterprise SSL VPN appliances and test for known CVEs.

Community
Advanced
0x0pointer0x0pointer
13

metasploit

Validate and exploit CVEs with Metasploit in a controlled container.

Official
Advanced