blacklanternsecurity
@blacklanternsecurity Organization
Public Skills
orchestrator
by blacklanternsecurity
USE THIS SKILL when the user provides a target or list of targets (IPs, hostnames, URLs, subnets) and asks to attack, pentest, hack, scan, assess, or test them. ALSO USE THIS SKILL when the user references an existing engagement — resuming, continuing, picking up, checking status, or asking about next steps. Trigger phrases: "attack X", "pentest X", "hack X", "scan X", "start testing X", "pop X", "CTF target X", "engage X", "these targets", "resume engagement", "pick it up", "continue testing", "next steps", "where were we", "resuming", "advise next steps", "what should we do next", "engagement status". This is the entry point for all multi-phase penetration tests — handles recon, attack surface mapping, vulnerability chaining, and routes to technique skills for exploitation. Do NOT use when the user names a specific single technique (e.g., "run kerberoasting against X").
<skill-name>
by blacklanternsecurity
<What this skill does in 2-3 sentences. Focus on technique scope and when to use it. No trigger phrases, negative conditions, or OPSEC details here.>
network-recon
by blacklanternsecurity
Network reconnaissance, host discovery, port scanning, and service enumeration.
windows-discovery
by blacklanternsecurity
Windows local privilege escalation enumeration and attack surface mapping.
linux-discovery
by blacklanternsecurity
Linux local privilege escalation enumeration and attack surface mapping.
ad-discovery
by blacklanternsecurity
Enumerates Active Directory domains and maps attack surface for penetration testing.
deserialization-php
by blacklanternsecurity
Exploit PHP deserialization vulnerabilities during authorized penetration testing.
file-upload-bypass
by blacklanternsecurity
Guide file upload restriction bypass during authorized penetration testing.
acl-abuse
by blacklanternsecurity
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials (msDS-KeyCredentialLink → PKINIT), and AdminSDHolder persistence.
password-spraying
by blacklanternsecurity
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the orchestrator passes target services and spray intensity tier.
jwt-attacks
by blacklanternsecurity
Exploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.
trust-attacks
by blacklanternsecurity
Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest root via golden/diamond ticket with extra SIDs), inter-realm TGT forging using trust keys, cross-forest trust abuse (SID filtering bypass, RBCD, Kerberoasting via trust account), and PAM trust exploitation (shadow principals in bastion forests).
linux-cron-service-abuse
by blacklanternsecurity
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
av-edr-evasion
by blacklanternsecurity
Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was quarantined, blocked, or detected by endpoint protection.
adcs-persistence
by blacklanternsecurity
Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden Certificate (forge with stolen CA key), certificate theft (DPAPI/CAPI/CNG), and account persistence via certificate mapping.
pivoting-tunneling
by blacklanternsecurity
Network pivoting, port forwarding, and tunneling through compromised hosts to reach internal networks.
credential-dumping
by blacklanternsecurity
Extracts credentials from Active Directory: DCSync replication, NTDS.dit database extraction, SAM hive dump, Azure AD Connect (ADSync) credential extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS root key + GoldenGMSA), dMSA exploitation (BadSuccessor CVE-2025-21293), and DSRM credentials.
sccm-exploitation
by blacklanternsecurity
Enumerates and exploits Microsoft SCCM/MECM (System Center Configuration Manager / Microsoft Endpoint Configuration Manager) infrastructure for credential harvesting, lateral movement, and domain escalation. Covers SCCM enumeration (sccmhunter, SharpSCCM), Network Access Account (NAA) credential extraction (policy request, WMI DPAPI, WMI repository), management point NTLM relay to MSSQL (TAKEOVER1), client push relay (ELEVATE2), PXE boot media credential harvesting (CRED1), SCCM database credential extraction, application deployment for lateral movement, and SCCM share looting.
linux-sudo-suid-capabilities
by blacklanternsecurity
Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities for privilege escalation.
windows-credential-harvesting
by blacklanternsecurity
Harvest stored credentials from a Windows system for privilege escalation or lateral movement.
gpo-abuse
by blacklanternsecurity
Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and registry modifications (SharpGPOAbuse, PowerGPOAbuse, pyGPOAbuse, GroupPolicyBackdoor), SYSVOL/NETLOGON logon script poisoning, and GPP password extraction.
credential-cracking
by blacklanternsecurity
Offline credential and file cracking with hashcat and john. Use when any skill recovers hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted files (ZIP, Office, PDF, KeePass, SSH key, 7z, RAR). Trigger phrases: "crack this hash", "brute force the password", "offline crack", "john", "hashcat", "zip2john", "password-protected file". Do NOT use for online password attacks (spraying, brute force against services) — use password-spraying instead.
2fa-bypass
by blacklanternsecurity
Bypass two-factor authentication (2FA/MFA) during authorized penetration testing.
pass-the-hash
by blacklanternsecurity
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.