Offensive Security

Offensive Security

AI-powered security testing patterns for authorized engagements.

how to use

• /offensive-security Apply offensive security methodology to the current engagement.

• /offensive-security <target-context> Plan a security assessment for the given context.

when to apply

Reference these guidelines when:

• conducting authorized penetration tests
• participating in CTF competitions
• building security testing automation
• reviewing code for exploitable vulnerabilities
• designing red team exercises
• building honeypots or deception technology

authorization requirements

CRITICAL: All offensive security activities require explicit authorization.

Before any engagement:

1. Verify written authorization (scope document, rules of engagement)
2. Confirm target scope boundaries
3. Establish communication channels with asset owners
4. Document all activities for audit trail
5. Integration: Use the operator's PostToolUse hook (audit.log) for activity logging

methodology: PTES framework

Phase 1: Pre-Engagement

• Define scope, rules of engagement, emergency contacts
• Legal review and authorization documentation
• Tool preparation and environment setup

Phase 2: Intelligence Gathering

• Passive OSINT: See osint-recon skill for detailed workflows
• Active scanning: Nmap, Masscan for service enumeration
• Web enumeration: Directory brute-force, subdomain discovery
• Integration: Use memory MCP server to store findings as entities/relations

Phase 3: Threat Modeling

• Map attack surface from gathered intelligence
• Identify high-value targets and likely attack paths
• Prioritize by impact × probability
• Integration: Use sequential MCP thinking for complex threat models

Phase 4: Vulnerability Analysis

• Automated scanning (Nessus, OpenVAS, Nuclei)
• Manual code review (see security-review skill)
• Configuration audit
• API security testing

Phase 5: Exploitation

• Proof-of-concept development
• Privilege escalation chains
• Lateral movement mapping
• Data exfiltration simulation (authorized only)

Phase 6: Post-Exploitation

• Persistence mechanism analysis
• Credential harvesting assessment
• Impact demonstration
• Clean-up and evidence removal

Phase 7: Reporting

• Executive summary with business impact
• Technical findings with CVSS scores
• Remediation recommendations with priority
• Evidence documentation (screenshots, logs, PoC code)

AI-powered security testing patterns

Automated Reconnaissance (from HexStrike-AI concepts)

# Pattern: AI-driven target profiling
from typing import TypedDict

class ReconProfile(TypedDict):
    target: str
    open_ports: list[int]
    services: dict[str, str]
    technologies: list[str]
    potential_vulns: list[str]
    attack_surface_score: float  # 0.0 - 10.0

def ai_recon_pipeline(target: str) -> ReconProfile:
    """AI-enhanced reconnaissance pipeline."""
    # 1. Port scan → service detection
    # 2. Technology fingerprinting
    # 3. CVE correlation
    # 4. Attack surface scoring
    # 5. AI-generated attack path suggestions
    ...

Vulnerability Prioritization

# Pattern: ML-based vulnerability prioritization
def prioritize_vulns(vulns: list[dict]) -> list[dict]:
    """Prioritize vulnerabilities using CVSS + contextual factors."""
    for vuln in vulns:
        base_score = vuln['cvss_score']
        # Contextual adjustments
        if vuln['exploitable_remotely']:
            base_score *= 1.3
        if vuln['has_public_exploit']:
            base_score *= 1.5
        if vuln['affects_auth']:
            base_score *= 1.4
        vuln['priority_score'] = min(base_score, 10.0)
    return sorted(vulns, key=lambda v: v['priority_score'], reverse=True)

web application testing checklist

Authentication Testing

• Brute force protection (rate limiting, lockout)
• Password policy enforcement
• Session management (token entropy, expiration, fixation)
• Multi-factor authentication bypass attempts
• OAuth/OIDC misconfiguration
• JWT algorithm confusion (none, HS256/RS256 swap)

Authorization Testing

• IDOR (Insecure Direct Object Reference)
• Privilege escalation (horizontal and vertical)
• Function-level access control
• API endpoint authorization

Injection Testing

• SQL injection (union, blind, time-based, error-based)
• XSS (reflected, stored, DOM-based)
• Command injection
• SSTI (Server-Side Template Injection)
• LDAP injection
• XML/XXE injection

Business Logic

• Race conditions (TOCTOU)
• Integer overflow/underflow
• Price manipulation
• Workflow bypass

CTF patterns

Common Challenge Categories

Quick pwntools Template

from pwn import *

# Connect
context.binary = elf = ELF('./challenge')
p = remote('target.ctf', 1337)  # or process('./challenge')

# Exploit pattern
payload = flat(
    b'A' * offset,
    p64(rop_gadget),
    p64(target_function),
)
p.sendlineafter(b'> ', payload)
p.interactive()

social engineering awareness

Patterns to test (from SET concepts):

• Phishing email templates (for authorized awareness testing)
• Credential harvesting page detection
• Pretexting scenarios
• USB drop simulation
• Vishing call scripts

Integration: CoreMind GAOS output_validator (Layer 4) should detect and block phishing content in agent outputs.

tool integration map

cross-references

• osint-recon skill: OSINT investigation workflows
• security-review skill: Code-level security analysis
• security-auditor agent: Automated vulnerability scanning
• security-engineer agent: Compliance and hardening
• SECURITY_PLAYBOOK.md: 36 rules across 8 categories
• SECURITY_ARSENAL.md: Tool inventory reference
• CoreMind GAOS: 5-layer safety stack for agent security