skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

zimbra-attack

Scan Zimbra Collaboration Suite instances for vulnerabilities and exposed endpoints.

3|1|Updated Jul 2, 2026
Search Tags:#cve#pentest#ssrf#recon#zimbra#soap
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill zimbra-attack-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zimbra-attack
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/zimbra-attack
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill zimbra-attack-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill addresses the difficulty of manually auditing Zimbra Collaboration Suite instances for common vulnerabilities, misconfigurations, and exposed administrative interfaces.

Core Features & Use Cases

  • Vulnerability Scanning: Detects exposure to CVE-2022-37042 via UploadServlet path traversal and internal SSRF risks.
  • User Enumeration: Identifies valid user accounts through SOAP API authentication responses.
  • Use Case: Security researchers can use this to quickly fingerprint Zimbra versions and identify critical attack vectors like exposed admin consoles or unauthenticated SOAP endpoints during a penetration test.

Quick Start

Use the zimbra-attack skill to perform a full security audit on the target domain example.com.

Frequently Asked Questions about zimbra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Zimbra Collaboration Suite for CVE-2022-37042 and SSRF vulnerabilities?▼

The skill detects CVE-2022-37042 exposure via UploadServlet path traversal and probes internal SSRF risks by targeting exposed SOAP API endpoints and administrative consoles.

Can I enumerate valid Zimbra user accounts through the SOAP API?▼

Yes, you can enumerate valid Zimbra user accounts by analyzing SOAP API authentication responses to identify which credentials are accepted or rejected by the server.

What tools do I need to perform automated Zimbra security reconnaissance?▼

You need curl, nmap, python3, masscan, subfinder, httpx, and nuclei installed to execute automated fingerprinting and exploitation probes against Zimbra instances.

What is the best way to fingerprint Zimbra versions and find exposed admin consoles?▼

The best way to fingerprint Zimbra versions and find exposed admin consoles is by running automated security assessment probes that target SOAP API endpoints and administrative interfaces.

Does Zimbra penetration testing work with nuclei and httpx for vulnerability detection?▼

Zimbra penetration testing works with nuclei and httpx to detect known CVEs, fingerprint server versions, and identify unauthenticated SOAP endpoints during security audits.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

deep-invade

Automate offensive security assessments by chaining SSRF probing, credential mining, and vulnerability discovery.

Community
Advanced
uphiagouphiago
1.1k

zimbra-attack

Test Zimbra Collaboration Suite security vulnerabilities via SOAP enumeration and CVE-2022-37042 checks.

Community
Intermediate
jayjpatel9717jayjpatel9717

Recon & Attack Surface Mapping

Map attack surfaces via DNS enumeration, port scanning, and vulnerability assessment.

Community
Advanced
automateyournetworkautomateyournetwork
627

nmap-service-detection

Detect services, fingerprint operating systems, and run NSE vulnerability scripts with nmap.

Community
Intermediate