How do I install the Attack Patterns skill?

Run npx skillmds@latest add j4flmao/attack-patterns in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Attack Patterns skill do?

Attack Patterns & MITRE ATT&CK It is listed under Security on SkillMD.

Is Attack Patterns safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Attack Patterns?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Attack Patterns free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Attack Patterns?

j4flmao (@j4flmao) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Attack Patterns by j4flmao — Agent Skill

Name: Attack Patterns
Author: j4flmao

File contents

Attack Patterns & MITRE ATT&CK

[!WARNING] DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY The attack patterns detailed here are for threat modeling, architectural hardening, and defensive engineering. They must not be deployed maliciously.

1. Skill Context

Focus: Deep dive into specific vulnerability classes (Web, Network) and mapping to MITRE ATT&CK. Triggers: explain ssrf, sql injection deep dive, deserialization chain, http request smuggling

2. Advanced Technical Patterns

The agent must explain the mechanical root cause of vulnerabilities.

Server-Side Request Forgery (SSRF)

Mechanics: The server parses a user-controlled URL and makes HTTP requests on the user's behalf.
Impact: Exploiting internal networks (e.g., http://127.0.0.1/admin), reading local files (file:///etc/passwd), or extracting Cloud Metadata (e.g., AWS IMDS http://169.254.169.254/latest/meta-data/iam/security-credentials/).
Mitigation: Network-level segmentation, strict URL validation/allowlisting, and requiring IMDSv2 (session tokens).

HTTP Request Smuggling (CL.TE / TE.CL)

Mechanics: Discrepancies in how front-end proxies and back-end servers parse Content-Length (CL) and Transfer-Encoding (TE) headers.
Exploitation: An attacker smuggles a hidden request inside the body of a legitimate request. The backend interprets it as the start of the next user's request, leading to cache poisoning or session hijacking.
Mitigation: Use HTTP/2 end-to-end, configure proxies to reject requests with ambiguous headers.

Insecure Deserialization

Mechanics: Untrusted data is used to instantiate objects. Attackers manipulate the serialized state to execute arbitrary code during the deserialization phase (e.g., Java's readObject() or PHP's __wakeup()).
Exploitation (Gadget Chains): Leveraging existing classes (gadgets) in the application's classpath (like Apache Commons Collections) to chain method calls into RCE (ysoserial).

3. Output Format

Provide the MITRE ATT&CK Technique ID (e.g., T1190 - Exploit Public-Facing Application).
Explain the vulnerability mechanics with a conceptual payload structure (no actionable exploits).
Provide the architectural fix and secure coding standards to eradicate the bug class.

---name: attack-patternsdescription: Attack Patterns & MITRE ATT&CK---# Attack Patterns & MITRE ATT&CK> [!WARNING]> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**> The attack patterns detailed here are for threat modeling, architectural hardening, and defensive engineering. They must not be deployed maliciously.## 1. Skill Context**Focus**: Deep dive into specific vulnerability classes (Web, Network) and mapping to MITRE ATT&CK.**Triggers**: explain ssrf, sql injection deep dive, deserialization chain, http request smuggling## 2. Advanced Technical PatternsThe agent must explain the mechanical root cause of vulnerabilities.### Server-Side Request Forgery (SSRF)- **Mechanics**: The server parses a user-controlled URL and makes HTTP requests on the user's behalf.- **Impact**: Exploiting internal networks (e.g., `http://127.0.0.1/admin`), reading local files (`file:///etc/passwd`), or extracting Cloud Metadata (e.g., AWS IMDS `http://169.254.169.254/latest/meta-data/iam/security-credentials/`).- **Mitigation**: Network-level segmentation, strict URL validation/allowlisting, and requiring IMDSv2 (session tokens).### HTTP Request Smuggling (CL.TE / TE.CL)- **Mechanics**: Discrepancies in how front-end proxies and back-end servers parse `Content-Length` (CL) and `Transfer-Encoding` (TE) headers.- **Exploitation**: An attacker smuggles a hidden request inside the body of a legitimate request. The backend interprets it as the start of the next user's request, leading to cache poisoning or session hijacking.- **Mitigation**: Use HTTP/2 end-to-end, configure proxies to reject requests with ambiguous headers.### Insecure Deserialization- **Mechanics**: Untrusted data is used to instantiate objects. Attackers manipulate the serialized state to execute arbitrary code during the deserialization phase (e.g., Java's `readObject()` or PHP's `__wakeup()`).- **Exploitation (Gadget Chains)**: Leveraging existing classes (gadgets) in the application's classpath (like Apache Commons Collections) to chain method calls into RCE (ysoserial).## 3. Output Format- Provide the MITRE ATT&CK Technique ID (e.g., T1190 - Exploit Public-Facing Application).- Explain the vulnerability mechanics with a conceptual payload structure (no actionable exploits).- Provide the architectural fix and secure coding standards to eradicate the bug class.

Frequently asked questions

Attack Patterns