enterprise-vpn-attack

Identify enterprise SSL VPN gateways and map exposure to CVEs and misconfigurations.

3.3k|507|Updated May 5, 2026

Search Tags:#vulnerability #vpn #red-team #cve #pentest #ssl-vpn

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: enterprise-vpn-attack
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/enterprise-vpn-attack
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill enterprise-vpn-attack-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The VPN attack matrix helps security teams quickly identify external SSL VPN gateways, fingerprint vendor/version details, and map exposure to CVEs and misconfigurations across major vendors.

Core Features & Use Cases

Fingerprinting and vendor/version identification of SSL VPN appliances (Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP).
Pre-auth and post-auth CVE coverage with practical test procedures, configuration-disclosure checks, and default-credential checks for initial access paths.
Use cases include red-team engagements, enterprise perimeter assessment, and risk-based prioritization for remediation and hardening.

Quick Start

Describe the current enterprise VPN perimeter exposure and map relevant CVE chains for authorized testing.

Frequently Asked Questions about enterprise-vpn-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify enterprise SSL VPN gateways and map their CVE exposure?▼

Fingerprint SSL VPN appliances across major vendors like Cisco ASA, Fortinet FortiGate, and Palo Alto GlobalProtect to identify versions. Map discovered gateway exposures to relevant CVEs and misconfigurations, quantifying risk to guide remediation efforts during authorized perimeter testing.

What SSL VPN vendors and appliances are covered for perimeter testing?▼

Supported SSL VPN appliances include Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler, Palo Alto GlobalProtect, Pulse Secure, Ivanti Connect Secure, SonicWall, and F5 Big-IP. Vendor fingerprinting identifies specific versions to map exposure against known vulnerabilities.

Can I check for pre-auth CVEs and default credentials on SSL VPN gateways?▼

Yes. The attack matrix includes pre-auth and post-auth CVE coverage with practical test procedures. It performs configuration-disclosure checks and default-credential validation to discover initial access paths during red-team engagements and enterprise perimeter assessments.

How do I prioritize VPN vulnerabilities discovered during a red-team engagement?▼

Apply risk-based prioritization to quantify exposure by mapping identified CVEs and misconfigurations to practical exploitability. This guides remediation and hardening efforts by highlighting the most critical initial access paths found on the enterprise VPN perimeter.