skills.rest
jellaharshith
jellaharshithCOMMUNITY
Explore all skills by this author →
GitHub

enterprise-vpn-attack

Map pre-auth and auth-bypass CVE test paths for SSL VPN appliances.

1|Updated Apr 18, 2026
Search Tags:#saml#vulnerability mapping#rules of engagement#cve triage#ssl vpn#vendor fingerprinting#pre-auth exploitation
One-click install
npx skills add https://github.com/jellaharshith/SWIFT --skill enterprise-vpn-attack-jellaharshith
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: enterprise-vpn-attack
Source: https://github.com/jellaharshith/SWIFT/tree/main/swift/skills/cbh/skills/enterprise-vpn-attack
Command: npx skills add https://github.com/jellaharshith/SWIFT --skill enterprise-vpn-attack-jellaharshith

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you quickly identify common enterprise SSL VPN / remote-access appliances and determine which pre-auth or auth-bypass CVE paths are relevant, so you can plan targeted testing under Rules of Engagement.

Core Features & Use Cases

  • Vendor fingerprinting & version hints: Detect Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure/Ivanti Connect Secure, SonicWall, and F5 Big-IP using observable login pages, cookies, and endpoint patterns.
  • CVE mapping for 2018–2026 VPN attack surface: Provides a CVE matrix with scope notes (pre-auth path traversal, file read, auth bypass, and selected pre-auth RCE where applicable) and non-disruptive test guidance.
  • SAML/AAA misconfiguration checks: Encourages validating SAML SP metadata and AAA backend identification to guide subsequent strategy without assuming patch status from version strings.
  • Operational guardrails: Emphasizes rate limiting, detection-first for disruptive tests, and avoiding out-of-scope lateral movement or client-side bug classes.

Quick Start

Use the enterprise-vpn-attack skill to triage a suspected SSL VPN endpoint at https://target by running the non-disruptive fingerprint and then selecting the highest-probability CVE tests from the matrix.

Frequently Asked Questions about enterprise-vpn-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint an SSL VPN appliance from a login portal?▼

You map pre-auth CVEs by first identifying the SSL VPN vendor through observable login pages and cookies, then consulting a structured CVE scope matrix. This Skill provides a 2018–2026 vulnerability matrix with guided test methods for perimeter appliances.

Can I test Citrix ADC or Ivanti Connect Secure for pre-auth vulnerabilities safely?▼

Yes, you can test Citrix ADC or Ivanti Connect Secure safely by applying non-disruptive test guidance and operational guardrails. This Skill emphasizes rate limiting and detection-first testing to avoid disruptive exploitation without explicit approval.

What SSL VPN vendors are covered by enterprise VPN attack surface mapping?▼

Enterprise VPN attack surface mapping covers Cisco ASA, Fortinet FortiGate, Citrix ADC, Palo Alto GlobalProtect, Ivani Connect Secure, Pulse Secure, SonicWall, and F5 Big-IP. The Skill identifies these vendors using endpoint and cookie patterns.

How do I check SAML misconfigurations on a remote-access appliance?▼

Checking SAML misconfigurations requires validating SAML SP metadata and identifying AAA backend configurations to guide testing strategy. This Skill encourages validating SAML metadata without assuming patch status from version strings.

Are there limitations when testing SSL VPNs for auth-bypass vulnerabilities?▼

Limitations when testing SSL VPNs for auth-bypass include avoiding out-of-scope lateral movement, client-side bug classes, and disruptive pre-auth RCE without explicit Rules of Engagement. The Skill enforces safety constraints to prevent unauthorized exploitation.

Related Skills

Explore More Legal & Compliance Skills→
pdparchitectpdparchitect
13

enterprise-vpn-attack

Fingerprint enterprise SSL VPN appliances and test for known CVEs.

Community
Advanced
transilienceaitransilienceai
462

cve-testing

Coordinate CVE vulnerability testing across identified technology stacks and APIs.

Official
Basic
xalgordxalgord
846

saml

Analyze SAML authentication flows and detect protocol-level vulnerabilities.

Community
Advanced
sseshachalasseshachala

enterprise-vpn-attack

Identify exposed enterprise SSL VPN appliances and map them to vendor CVEs.

Community
Advanced