claude-red
Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.
Maintained by 0xwilliamortiz.
Table of Contents
What is this
claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to ADCS abuse.
Drop a skill into your Claude environment and it behaves like a specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.
On Windows, claude-red can also launch the companion UI binary when present.
Use it for: authorized red team engagements, bug bounty triage, security research, CTF preparation, training operators, and exploring attack surfaces methodically.
Quickstart
npm (recommended)
npm install -g claude-red
claude-red
claude-red --target ~/.claude/skills/claude-red
claude-red --category web
claude-red list
claude-red ui
Local checkout:
npm install -g .
claude-red
Claude auto-loads matching skills by conversational triggers (e.g. mentioning SQLi loads offensive-sqli).
Git clone
git clone https://github.com/0xwilliamortiz/claude-red ~/.claude/skills/claude-red
Sparse one category:
git clone --filter=blob:none --sparse https://github.com/0xwilliamortiz/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory
Claude Code
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -
cat Skills/active-directory/**/SKILL.md | claude --system-file -
Claude.ai (Manual)
Paste the contents of a SKILL.md into a Project's system prompt or prepend to your conversation.
Bash installer (no Node)
./install.sh
./install.sh --target ~/.claude/skills
./install.sh --category web
Categories
| Category | Skills | Focus |
|---|---|---|
| Web Application | 16 | OWASP Top 10 + business logic + advanced web bug classes |
| Auth & Identity | 2 | JWT, OAuth |
| Active Directory | 1 | On-prem AD attack methodology (expanding) |
| Wireless | 13 | 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
| Cloud | 1 | AWS / Azure / GCP attack paths (expanding) |
| Mobile | 1 | Android + iOS pentest (expanding) |
| IoT & Embedded | 1 | Hardware, firmware, RTOS, ICS (expanding) |
| Infrastructure & Red Team | 7 | Initial access, EDR evasion, Windows ops |
| Exploit Development | 6 | Stack/heap, mitigations, crash analysis, TOCTOU |
| Fuzzing & VR | 4 | libFuzzer, AFL++, bug ID, vuln classes |
| Reconnaissance | 2 | OSINT tooling and methodology |
| AI Security | 1 | Prompt injection, jailbreaks, RAG poisoning |
| Utility | 2 | Fast-checking, professional reporting |
Skill Index
Web Application
Skills/web/
| Skill | Description |
|---|---|
offensive-sqli |
SQL injection — error/blind/OOB, DB-specific, ORM CVEs, cloud paths |
offensive-xss |
Cross-site scripting — stored, reflected, DOM, mutation |
offensive-ssrf |
Server-side request forgery — cloud metadata, filter bypass |
offensive-ssti |
Server-side template injection — engine ID, RCE paths |
offensive-xxe |
XML external entity — OOB exfil, blind exploitation |
offensive-idor |
Insecure direct object references — enumeration, business logic |
offensive-file-upload |
File upload — extension bypass, polyglots, webshells |
offensive-rce |
Remote code execution — chaining, command injection |
offensive-deserialization |
Insecure deserialization — Java/PHP/.NET gadget chains |
offensive-race-condition |
Race conditions — TOCTOU, single-packet, limit bypass |
offensive-request-smuggling |
HTTP request smuggling — CL.TE, TE.CL, h2 desync |
offensive-open-redirect |
Open redirect — OAuth abuse, phishing, SSRF pivots |
offensive-parameter-pollution |
HTTP parameter pollution — WAF bypass, logic confusion |
offensive-graphql |
GraphQL — introspection, batching, IDOR via aliases |
offensive-waf-bypass |
WAF bypass — encoding, chunking, case mutation |
offensive-business-logic |
Business logic — workflow bypass, pricing, refunds, chains |
Auth & Identity
Skills/auth/
| Skill | Description |
|---|---|
offensive-jwt |
JWT — alg:none, key confusion, secret cracking |
offensive-oauth |
OAuth — open redirect abuse, token leakage, PKCE bypass |
Active Directory
Skills/active-directory/
| Skill | Description |
|---|---|
offensive-active-directory |
AD — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD |
Note: This category is being expanded. The AD overview is being split into 16 focused skills (Kerberoasting, ASREProasting, ADCS, coercion, NTLM relay, BloodHound, ticket forgery, GPO abuse, etc.). See Roadmap.
Wireless
Skills/wireless/
| Skill | Description |
|---|---|
offensive-wifi |
802.11 overview — entrypoint into the wireless category |
offensive-wifi-recon |
Adapter selection, monitor mode, multi-band airspace mapping |
offensive-wpa2-psk |
Handshake capture, PMKID, hashcat 22000 cracking |
offensive-wpa3-sae |
Transition-mode downgrade, Dragonblood, SAE side-channels |
offensive-wpa-enterprise |
802.1X / EAP attacks, eaphammer evil-twin RADIUS |
offensive-wps |
Pixie Dust, online PIN brute, vendor PIN generators |
offensive-evil-twin |
KARMA, Mana, captive portal, post-association MITM |
offensive-krack-fragattacks |
KRACK + FragAttacks supplicant testing |
offensive-deauth-disassoc |
Targeted/broadcast deauth, PMF awareness, action frames |
offensive-bluetooth-ble |
BLE GATT enum, pairing downgrade, sniffing, MITM |
offensive-bluetooth-classic |
BR/EDR — SDP, SPP, KNOB, BlueBorne, HID spoofing |
offensive-zigbee-thread-matter |
802.15.4 mesh — KillerBee, Touchlink abuse, ZCL command injection |
offensive-z-wave |
S0 key derivation flaw, S2 commissioning, hub pivots |
offensive-lorawan-sub-ghz |
LoRaWAN ABP/OTAA, KeeLoq garage doors, fixed-code, TPMS |
Cloud
Skills/cloud/
| Skill | Description |
|---|---|
offensive-cloud |
AWS / Azure / GCP — privesc, IMDS, cross-account, persistence, CSPM evasion |
Note: Cloud-identity (Entra/AAD/Okta hybrid) skills coming separately. See Roadmap.
Mobile
Skills/mobile/
| Skill | Description |
|---|---|
offensive-mobile |
Android + iOS — Frida, pinning, storage, biomet |