skills.rest
dazeb
dazebCOMMUNITY
Explore all skills by this author →
Website𝕏@dennysentinelGitHub

proxmox-pentesting

Test Proxmox VE 8.x/9.x hypervisors for guest escape and supply chain vulnerabilities.

Updated May 23, 2026
Search Tags:#penetration testing#proxmox#supply chain attack#virtualization security#guest escape#api exploitation#lxc breakout
One-click install
npx skills add https://github.com/dazeb/ai-supply-chain-lab --skill proxmox-pentesting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: proxmox-pentesting
Source: https://github.com/dazeb/ai-supply-chain-lab/tree/main/skills/proxmox-pentesting
Command: npx skills add https://github.com/dazeb/ai-supply-chain-lab --skill proxmox-pentesting

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ssh, curl, jq, nmap, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Security teams and penetration testers often lack a structured, comprehensive guide to testing Proxmox VE virtualization hosts, leading to missed attack surfaces like guest escapes, API misconfigurations, and supply chain attack paths that can compromise entire isolated networks.

Core Features & Use Cases

  • Full Attack Surface Coverage: Includes guidance for testing Proxmox web UI, REST API, KVM/QEMU VMs, LXC containers, network pivoting, and post-exploitation activities.
  • Pre-Built Tools & References: Comes with a one-shot enumeration script, CVE reference matrices for Proxmox 8.x/9.x, and lab-specific configuration details for realistic testing scenarios.
  • Use Case: A red teamer can use this skill to pivot from a compromised web server into an isolated Proxmox-managed network, extract CI/CD deploy keys, poison internal dependencies, and trace a full supply chain attack path to production systems.

Quick Start

Use the proxmox-pentesting skill to perform a full security assessment of a target Proxmox VE host, including reconnaissance, vulnerability identification, guest escape testing, and lateral movement validation.

Frequently Asked Questions about proxmox-pentesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a Proxmox VE hypervisor for guest escape vulnerabilities?▼

To test a Proxmox VE hypervisor for guest escape vulnerabilities, you perform reconnaissance on the web UI and REST API, identify misconfigurations, and apply guest breakout techniques against KVM/QEMU and LXC environments.

What is a Proxmox supply chain attack path in a red team engagement?▼

A Proxmox supply chain attack path involves pivoting from a compromised host into an isolated Proxmox-managed network, extracting CI/CD deploy keys, and poisoning internal dependencies to trace compromise paths to production systems.

Can I use nmap and curl for Proxmox API exploitation?▼

Yes, you can use nmap and curl for Proxmox API exploitation by running pre-built enumeration scripts to identify exposed endpoints and test REST API misconfigurations on Proxmox 8.x and 9.x deployments.

What's the best way to validate lateral movement in Proxmox LXC environments?▼

The best way to validate lateral movement in Proxmox LXC environments is to use pre-built attack chain guidance to test LXC breakout techniques and verify network pivoting capabilities from a compromised container.

Are there CVE reference matrices for Proxmox 8.x and 9.x security audits?▼

Yes, there are CVE reference matrices for Proxmox 8.x and 9.x security audits that map known vulnerabilities to specific attack chains, covering everything from API exploitation to post-exploitation activities.

Related Skills

Explore More Software Engineering Skills→
basher83basher83
1

ansible-proxmox

Automate Proxmox VE VM, cluster, and storage management with Ansible.

Community
Advanced
Oscar-Ivan-SalasOscar-Ivan-Salas

vulnerability-scanner

Identify and prioritize security vulnerabilities in software projects.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced
gitgoodordietryinggitgoodordietrying
1

security-audit

Audit codebases and infrastructure for dependency vulnerabilities, secrets, and misconfigurations.

Community
Advanced