Pentest Exploit Chain

Multi-step exploit zinciri analizi — low/medium severity bulgulari critical chain'e baglama, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.

aibot88 Updated Sep 9, 2026 3 repo stars

Install

Press C to copy

$ npx skillmds@latest add aibot88/pentest-exploit-chain

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/aibot88/pentest-exploit-chain.svg)](https://skillmd.com/skills/aibot88/pentest-exploit-chain)

Trust & safety

2 of 3 audits passed

Last audited Sep 24, 2026 · commit c480e36

Permissions this skill uses

Reads secrets
The instructions read tokens, keys, or other credentials.

License: MIT
Works with: Claude Code Claude.ai OpenAI Codex +

File contents

pentest-exploit-chain

Tek tek dusuk-orta severity bulgulari tam compromise zincire birlestirme. Engagement zekasinin en yuksek katma degeri — yalnizca insan analizi.

Triggers

"bulgular chain edilebilir mi"
"kill chain ciz"
"low + medium = critical"
"attack path simulation"
"stealth + impact score"

Lockheed Cyber Kill Chain (7 step)

1. Reconnaissance       — OSINT, port scan
2. Weaponization        — exploit + payload combine
3. Delivery             — phishing, drive-by, USB
4. Exploitation         — vulnerability trigger
5. Installation         — persistent foothold
6. Command & Control    — beacon
7. Actions on Objectives — data exfil, destruction, ransom

MITRE ATT&CK Tactic Chain

TA0043 Reconnaissance
  -> TA0001 Initial Access
    -> TA0002 Execution
      -> TA0003 Persistence
        -> TA0004 Privilege Escalation
          -> TA0005 Defense Evasion
            -> TA0006 Credential Access
              -> TA0007 Discovery
                -> TA0008 Lateral Movement
                  -> TA0009 Collection
                    -> TA0011 Command and Control
                      -> TA0010 Exfiltration
                        -> TA0040 Impact

Chain Analizi Methodology

1. Tum bulgulari listele (low + medium + high)
2. Her bulguya: input gereksinim, output yetki/erisim
3. Esle: bulgu A'nin output'u, bulgu B'nin input'u
4. Adimlar yolu ciz (DAG)
5. En kisa yol -> max impact
6. Her adim icin stealth puani (1-5)
7. Toplam stealth + impact -> chain rank

Stealth Scoring (1-5)

Score	Tip	Detection Likelihood
1	Loud	EDR/SIEM otomatik blok/alert
2	Noisy	SOC analist 5dk inceleyince yakalanir
3	Moderate	Default rule yetersiz, hunt query gerek
4	Quiet	Sadece sofistike hunt + threat intel
5	Stealth	Tespit edilmez (zero-day, signed bin)

Impact Scoring (1-5)

Score	Tip	Etki
1	Recon	Bilgi alma (data ifsa yok)
2	Limited	Tek hesap compromise
3	Local	Tek sistem compromise
4	Lateral	Cok sistem / DB erisim
5	Catastrophic	DA, ransomware, mass exfil

Chain Example

# Chain — "User to Domain Admin"
Total: 6 step, Stealth: 18/30, Impact: 5/5 (DA)

## Step 1: Phishing (Initial Access)
- Bulgu: User awareness training eksik (engagement OSINT)
- Action: Spear phish IT employee
- Stealth: 3 (email gateway yakalayabilir, %20)
- Impact: 2 (single user cred)
- Output: domain\jdoe / Spring2026!

## Step 2: Initial Foothold (Execution)
- Bulgu: VPN portal MFA eksik
- Action: VPN login -> domain join sirasinda
- Stealth: 4 (MFA log siginal kuvvetli ama eksik)
- Impact: 2
- Output: Internal network access

## Step 3: Recon (Discovery)
- Bulgu: SMB anonymous null session AD'de
- Action: enum4linux + RPC
- Stealth: 2 (event 4624 type 3 fires)
- Impact: 2
- Output: Domain user list + group list

## Step 4: Cred Access (Credential Access)
- Bulgu: Kerberoastable service account weak password
- Action: GetUserSPNs.py + hashcat 4 hr crack
- Stealth: 3 (event 4769 with 0x17 encryption)
- Impact: 3
- Output: svc-mssql / Mssql2024

## Step 5: Privesc (Privilege Escalation)
- Bulgu: svc-mssql member of "DB Admins"
- Action: Already privileged service acct
- Stealth: 5 (no abnormal event)
- Impact: 4
- Output: Local admin on DB-PROD

## Step 6: DA (Privilege Escalation)
- Bulgu: DB-PROD has unconstrained delegation
- Action: TGT capture via printer bug
- Stealth: 3 (anomalous service ticket request)
- Impact: 5
- Output: Domain Admin TGT

Compensating Controls

Her chain step'i icin iki tarafli kontrol yaz:

step: 4 - Kerberoast
attack:
  technique: T1558.003
  noise: Event 4769 with encryption 0x17 (RC4)
controls:
  preventive:
    - Service account: long random password (30+ char)
    - Use AES-256 only (set msDS-SupportedEncryptionTypes)
    - Microsoft Managed Service Accounts (gMSA)
  detective:
    - Sigma rule: kerberoast_rc4_encryption.yml
    - Alert threshold: > 5 TGS-REQ in 1 hr from single user
  responsive:
    - Auto-disable account on alert
    - 24/7 SOC triage SLA

Output Sablonu

## Exploit Chain Report — <engagement>

### Top 3 Chains (ranked by Impact / Stealth)

| # | Title | Steps | Stealth | Impact | Time |
|---|-------|-------|---------|--------|------|
| 1 | User -> DA via Kerberoast | 6 | 18 | 5 | 6 hours |
| 2 | Web SSRF -> Cloud Metadata -> RDS | 4 | 12 | 5 | 3 hours |
| 3 | Phish -> Lateral -> Ransom Sim | 5 | 10 | 5 | 8 hours |

### Recommended Defense Priority
1. Add Kerberoast detection (Sigma rule attached)
2. MFA on VPN (chain step 2 break)
3. Service account password complexity (chain step 4 break)
4. Disable unconstrained delegation (chain step 6 break)

Out-of-Scope

Live chain execution (sadece advisory + writeup)
0-day discovery (n-day exploit kullanilir)

---name: pentest-exploit-chaindescription: Multi-step exploit zinciri analizi — low/medium severity bulgulari critical chain'e baglama, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.license: MIT--- # pentest-exploit-chain Tek tek dusuk-orta severity bulgulari **tam compromise zincire** birlestirme. Engagement zekasinin en yuksek katma degeri — yalnizca insan analizi. ## Triggers - "bulgular chain edilebilir mi" - "kill chain ciz" - "low + medium = critical" - "attack path simulation" - "stealth + impact score" ## Lockheed Cyber Kill Chain (7 step) ``` 1. Reconnaissance — OSINT, port scan 2. Weaponization — exploit + payload combine 3. Delivery — phishing, drive-by, USB 4. Exploitation — vulnerability trigger 5. Installation — persistent foothold 6. Command & Control — beacon 7. Actions on Objectives — data exfil, destruction, ransom ``` ## MITRE ATT&CK Tactic Chain ``` TA0043 Reconnaissance -> TA0001 Initial Access -> TA0002 Execution -> TA0003 Persistence -> TA0004 Privilege Escalation -> TA0005 Defense Evasion -> TA0006 Credential Access -> TA0007 Discovery -> TA0008 Lateral Movement -> TA0009 Collection -> TA0011 Command and Control -> TA0010 Exfiltration -> TA0040 Impact ``` ## Chain Analizi Methodology ``` 1. Tum bulgulari listele (low + medium + high) 2. Her bulguya: input gereksinim, output yetki/erisim 3. Esle: bulgu A'nin output'u, bulgu B'nin input'u 4. Adimlar yolu ciz (DAG) 5. En kisa yol -> max impact 6. Her adim icin stealth puani (1-5) 7. Toplam stealth + impact -> chain rank ``` ## Stealth Scoring (1-5) | Score | Tip | Detection Likelihood | |-------|-----|---------------------| | 1 | Loud | EDR/SIEM otomatik blok/alert | | 2 | Noisy | SOC analist 5dk inceleyince yakalanir | | 3 | Moderate | Default rule yetersiz, hunt query gerek | | 4 | Quiet | Sadece sofistike hunt + threat intel | | 5 | Stealth | Tespit edilmez (zero-day, signed bin) | ## Impact Scoring (1-5) | Score | Tip | Etki | |-------|-----|------| | 1 | Recon | Bilgi alma (data ifsa yok) | | 2 | Limited | Tek hesap compromise | | 3 | Local | Tek sistem compromise | | 4 | Lateral | Cok sistem / DB erisim | | 5 | Catastrophic | DA, ransomware, mass exfil | ## Chain Example ```markdown # Chain — "User to Domain Admin" Total: 6 step, Stealth: 18/30, Impact: 5/5 (DA) ## Step 1: Phishing (Initial Access) - Bulgu: User awareness training eksik (engagement OSINT) - Action: Spear phish IT employee - Stealth: 3 (email gateway yakalayabilir, %20) - Impact: 2 (single user cred) - Output: domain\jdoe / Spring2026! ## Step 2: Initial Foothold (Execution) - Bulgu: VPN portal MFA eksik - Action: VPN login -> domain join sirasinda - Stealth: 4 (MFA log siginal kuvvetli ama eksik) - Impact: 2 - Output: Internal network access ## Step 3: Recon (Discovery) - Bulgu: SMB anonymous null session AD'de - Action: enum4linux + RPC - Stealth: 2 (event 4624 type 3 fires) - Impact: 2 - Output: Domain user list + group list ## Step 4: Cred Access (Credential Access) - Bulgu: Kerberoastable service account weak password - Action: GetUserSPNs.py + hashcat 4 hr crack - Stealth: 3 (event 4769 with 0x17 encryption) - Impact: 3 - Output: svc-mssql / Mssql2024 ## Step 5: Privesc (Privilege Escalation) - Bulgu: svc-mssql member of "DB Admins" - Action: Already privileged service acct - Stealth: 5 (no abnormal event) - Impact: 4 - Output: Local admin on DB-PROD ## Step 6: DA (Privilege Escalation) - Bulgu: DB-PROD has unconstrained delegation - Action: TGT capture via printer bug - Stealth: 3 (anomalous service ticket request) - Impact: 5 - Output: Domain Admin TGT ``` ## Compensating Controls Her chain step'i icin **iki tarafli** kontrol yaz: ```yaml step: 4 - Kerberoast attack: technique: T1558.003 noise: Event 4769 with encryption 0x17 (RC4) controls: preventive: - Service account: long random password (30+ char) - Use AES-256 only (set msDS-SupportedEncryptionTypes) - Microsoft Managed Service Accounts (gMSA) detective: - Sigma rule: kerberoast_rc4_encryption.yml - Alert threshold: > 5 TGS-REQ in 1 hr from single user responsive: - Auto-disable account on alert - 24/7 SOC triage SLA ``` ## Output Sablonu ```markdown ## Exploit Chain Report — <engagement> ### Top 3 Chains (ranked by Impact / Stealth) | # | Title | Steps | Stealth | Impact | Time | |---|-------|-------|---------|--------|------| | 1 | User -> DA via Kerberoast | 6 | 18 | 5 | 6 hours | | 2 | Web SSRF -> Cloud Metadata -> RDS | 4 | 12 | 5 | 3 hours | | 3 | Phish -> Lateral -> Ransom Sim | 5 | 10 | 5 | 8 hours | ### Recommended Defense Priority 1. Add Kerberoast detection (Sigma rule attached) 2. MFA on VPN (chain step 2 break) 3. Service account password complexity (chain step 4 break) 4. Disable unconstrained delegation (chain step 6 break) ``` ## Out-of-Scope - Live chain execution (sadece advisory + writeup) - 0-day discovery (n-day exploit kullanilir)

aibot88/sec_skill_store/tree/main/skills/claudskills/pentest-exploit-chain commit c480e363fc

Frequently asked questions

npx skillmds@latest add aibot88/pentest-exploit-chain