netvar1337
- 736 skills
- 0 followers
- 1 day ago last updated
- ▌ Windows Ad · netvar1337Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
- ▌ Annotations · netvar1337Use to edit IDA DBs: comments, renames, types, bookmarks, decompiler cleanup.
- ▌ Apk Reverse · netvar1337在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
- ▌ Binary Diff · netvar1337跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。 适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。 核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。 触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。
- ▌ Disassembly · netvar1337Use for IDA disassembly queries: functions, segments, instructions, blocks, operands, CFG.
- ▌ Driver Comm · netvar1337Usermode↔kernel driver communication: IOCTL design, shared sections, events, security descriptors, stealth IOCTL.
- ▌
- ▌ Ida Pro MCP · netvar1337Use when driving IDA Pro via MCP (headless or GUI) for static analysis, annotations, and validation.
- ▌ Ida Reverse · netvar1337IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention 'IDA' or 'reverse engineering'. This includes requests like '看看这个exe', '分析这个dll', '帮我破解', '找一下密码', '这个软件怎么注册', etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.
- ▌ Rust Review · netvar1337Use when auditing Rust (especially unsafe/FFI/concurrency) for memory safety, panics, and async pitfalls.
- ▌ API Security · netvar1337Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
- ▌ Attack Chain · netvar1337Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
- ▌ Computer Use · netvar1337Use when the computer_use tool is available to drive the desktop without stealing focus.
- ▌
- ▌ LLM Security · netvar1337Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
- ▌ Loop Factory · netvar1337Use for spec-driven inbox->active->archive agent loops or installing loop-factory in a repo.
- ▌ Edr Bypass Re · netvar1337逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。
- ▌
- ▌ Heap Overflow · netvar1337Heap buffer overflow: adjacent chunk smash, metadata overwrite, freelist poison setup, Windows/Linux allocator notes.
- ▌ Imgui Overlay · netvar1337ImGui overlay engineering for cheats/tools: DX11/12/Vulkan hooks, external transparent HWND, input passthrough, DPI.
- ▌ Interface Kit · netvar1337> Bundled with Unleash skills pack. Upstream: https://github.com/JuliusBrussee/skills
- ▌ Lang Assembly · netvar1337Assembly for hooks/shellcode/syscalls: x64/x86 calling conventions, trampolines, PIC, reverse engineering.
- ▌ Offset Dumper · netvar1337Game/engine offset dumper patterns: pattern scan DB, PDB/schema dump, UE/Unity/Source pipelines, version pinning.
- ▌ Omc Reference · netvar1337OMC agent catalog, available tools, team pipeline routing, commit protocol, and skills registry. Auto-loads when delegating to agents, using OMC tools, orchestrating teams, making commits, or invoking skills.
- ▌ Pentest Tools · netvar1337主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
- ▌ Ponytail Debt · netvar1337Use to list ponytail: shortcut comments as a debt ledger (/ponytail-debt). Report only.
- ▌ Ponytail Gain · netvar1337Use to show ponytail impact scoreboard from benchmark medians (/ponytail-gain).
- ▌
- ▌ Sarif Parsing · netvar1337Use to parse/filter/dedupe SARIF from CodeQL/Semgrep/other scanners (does not run scans).
- ▌ Simplify Code · netvar1337Use for parallel cleanup of recent code changes (delete complexity, keep behavior).
- ▌ Wifi Wireless · netvar1337Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
- ▌ Zeroize Audit · netvar1337Use when auditing C/C++/Rust secret handling for missing or optimized-away zeroization.
- ▌ Context Canary · netvar1337> Bundled with Unleash skills pack. Upstream: https://github.com/JuliusBrussee/skills
- ▌ Docs Generator · netvar1337Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.
- ▌ Dotnet Reverse · netvar1337.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
- ▌ Use After Free · netvar1337Use-after-free exploitation: dangling refs, reclaim/spray, type confusion, C++ vptr hijack, kernel pool UAF notes.
- ▌ Last 20 Percent · netvar1337> Bundled with Unleash skills pack. Upstream: https://github.com/JuliusBrussee/skills
- ▌ Pattern Scanner · netvar1337Binary/pattern scanning: IDA/runtime signatures, mask formats, PE section constraints, SIMD scanners.
- ▌ Ponytail Review · netvar1337Use for over-engineering code review focused on what to delete (/ponytail-review).
- ▌ Firmware Pentest · netvar1337固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。
- ▌ Integer Overflow · netvar1337Integer overflow/underflow bugs: width conversion, mul/add wrap, size calc to alloc/copy, signedness, exploits to heap/stack corruption.
- ▌ Junior To Senior · netvar1337> Bundled with Unleash skills pack. Upstream: https://github.com/JuliusBrussee/skills
- ▌ Kernel Callbacks · netvar1337Windows kernel callback tradecraft: enum/remove/spoof create-process/image/thread/object callbacks, minifilter notes.
- ▌ Malware Analysis · netvar1337Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
- ▌ Anti Cheat Bypass · netvar1337Anti-cheat research/bypass methodology: EAC/BE/Vanguard user+kernel surfaces, heartbeats, integrity, HV vs AC.
- ▌ Format String Bug · netvar1337Format-string vulnerabilities: read/write primitives via %n/%s, GOT overwrite, modern compiler constraints.
- ▌ Insecure Defaults · netvar1337Use when auditing fail-open defaults, hardcoded secrets, weak auth, permissive config.
- ▌ No AI Attribution · netvar1337Never append AI attribution trailers (Co-Authored-By: Claude / Codex / Copilot / Gemini, 'Generated with ...', etc.) to commits, PRs, or authored content — in any repo, by any model or tool. Use when committing, authoring PR bodies, or reviewing commit messages.
- ▌ Windows Internals · netvar1337Windows internals for offense/RE: PEB/TEB, objects, callbacks, ETW, CI/DSE, tokens, ALPC, memory manager, loaders.
- ▌ Aida Ida Assistant · netvar1337AiDA-class IDA Pro AI assistant workflows: function context export, rename/comment proposals, Unreal scans, provider config, review-before-apply.
- ▌ Browser Automation · netvar1337统一自动化入口。覆盖浏览器自动化（Playwright）和 Windows 桌面应用自动化（OpenReverse）。 浏览器场景：打开网页、点击、填表、爬取、截图、自动化登录、渗透页面交互。 桌面场景：操作 IDA/x64dbg 等 GUI 工具、Windows UI Automation、视觉驱动交互、桌面应用网络抓包。 触发关键词：浏览器自动化、桌面自动化、打开网页、填表、爬取、截图、自动化登录、Playwright、agent-browser、headless、OpenReverse、UIA、CUA、桌面操作、Windows 自动化。
- ▌
- ▌
- ▌ Patch Diff Exploit · netvar1337N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。
- ▌ Secrets Automation · netvar1337Use when setting up unattended secret access (service accounts, vault scoping, non-echoing tokens).
- ▌ Stealth Hypervisor · netvar1337Stealth hypervisor development: EPT hooks, SLAT subversion, timing anti-detect, CPUID/MSR hiding, nested virt, anti-AC considerations.
- ▌ Differential Review · netvar1337Use for security-focused review of PRs/commits/diffs with blast-radius analysis.
- ▌ Firmware Hdl Review · netvar1337Use when reviewing firmware/HDL changes across registers, SystemVerilog, DMA, sim, CI.
- ▌ Karpathy Guidelines · netvar1337Use when writing/reviewing/refactoring code: think first, simplicity, surgical diffs, verify goals.
- ▌ Network Protocol Re · netvar1337Game/app network protocol RE: capture, reassembly, crypto detection, reimplementation, fuzzing hooks.
- ▌ Radare2 Terminal Re · netvar1337Use for terminal-first r2 static/dynamic analysis with JSON-first automation.
- ▌
- ▌
- ▌ Eac Kernel Driver Re · netvar1337EasyAntiCheat.sys-class kernel driver reverse engineering: callbacks, device interfaces, integrity, communication, Rust/C++ RE notes.
- ▌ LLM Fable Safeguards · netvar1337Fable / model-safeguard research and neutralization: AUP copy, stop_reason refusal, safeguard messages, local pool patches, harness gates.
- ▌ LLM Jailbreak Direct · netvar1337Direct instruction-override jailbreaks: DAN/developer-mode, ignore-previous, delimiter confusion, system-prompt exfil. Use for single-turn overrides.
- ▌ Repository Hardening · netvar1337Use to harden a repo end-to-end: inventory, baselines, issues/PRs, security, merge-ready pub.
- ▌ Reverse Skill Router · netvar1337Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- ▌ Systematic Debugging · netvar1337Use on any bug, test failure, or unexpected behavior before proposing fixes.
- ▌ Windows 0day Hunting · netvar1337Use when hunting new Windows privilege-escalation or security-boundary vulnerabilities in first-party services, scheduled tasks, recovery flows, security products, profile handling, or other privileged workflows. Drives evidence-first attack-surface mapping, state-machine analysis, controlled experiments, exploit-chain construction, variant hunting, and reproducibility testing.
- ▌ X64dbg Anti Debugger · netvar1337Anti-debugger techniques and bypass research in x64dbg workflows: PEB flags, NtQuery, object hides, timing, TLS, self-debug.
- ▌ Lang Cpp Game Hacking · netvar1337C++ specifically for game hacking: external/internal layouts, ImGui overlays, MinHook, memory backends, driver IPC.
- ▌ LLM Jailbreak Harness · netvar1337Build jailbreak/red-team harnesses: datasets, scorers, runners, logging, Unleash integration, regression after model updates.
- ▌ Stack Buffer Overflow · netvar1337Stack buffer overflow exploit development: smash framing, saved RIP/SEH control, canaries, overlap, ROP setup, Windows/Linux differences.
- ▌ Audit Context Building · netvar1337Use for line-by-line architectural context building before vuln/bug hunting.
- ▌ Constant Time Analysis · netvar1337Use when reviewing crypto code for timing side channels / secret-dependent behavior.
- ▌ Github Repo Management · netvar1337Use to clone/create/fork repos and manage remotes/releases via gh.
- ▌ LLM Jailbreak Encoding · netvar1337Encoding and obfuscation jailbreaks: base64/hex/homoglyphs/bidi/token splits/ciphers/low-resource languages.
- ▌ LLM Jailbreak Roleplay · netvar1337Roleplay and narrative jailbreaks: persona, fiction, academic framing, nested roles, dual-response.
- ▌ LLM Jailbreak Taxonomy · netvar1337Master catalog of LLM jailbreak / prompt-injection / safeguard-bypass methods. Load first when planning red-team, Fable safeguard work, or choosing an attack class.
- ▌ Requesting Code Review · netvar1337Use for pre-commit review: security scan, quality gates, auto-fix.
- ▌ Snailsploit Frameworks · netvar1337Use when applying SnailSploit's AATMF, SEF, P.R.O.M.P.T, AATMF Toolkit, LLM Red Teamer's Playbook, or Claude-Red frameworks to adversarial AI assessment and offensive-security research.
- ▌ Pwndbg Dynamic Analysis · netvar1337Use when debugging authorized Linux user/kernel/QEMU targets with Pwndbg on GDB/LLDB.
- ▌ Test Driven Development · netvar1337Use when writing tests or implementing features under RED-GREEN-REFACTOR.
- ▌ Hwid Identifier Surfaces · netvar1337Methods for retrieving PC unique identifiers used by anti-cheats: disk, SMBIOS, NIC, GPU, TPM, Windows product, volume, firmware tables.
- ▌ LLM Jailbreak Multi Turn · netvar1337Multi-turn jailbreaks: crescendo, many-shot, priming, foot-in-the-door, context overflow, memory poison.
- ▌ LLM Jailbreak Multimodal · netvar1337Multimodal jailbreaks: typography-in-image, adversarial pixels, screenshot policy text, PDF polyglots, audio stego.
- ▌ LLM Jailbreak Tool Agent · netvar1337Tool/agent harness jailbreaks: excessive agency, MCP, multi-agent relay, permission confusion, local Unleash YOLO path.
- ▌ Tpm Attestation Research · netvar1337Remote TPM attestation / trust crypto / serial research: TPM2 keys, quote/PCRs, Windows health attestation surfaces, AC trust anchors.
- ▌ Advanced Packer Unpacking · netvar1337Use on authorized packed binaries (Themida/VMProtect/Enigma/etc.) to recover OEP, imports, image.
- ▌ Browser Security Research · netvar1337Use when hunting new vulnerabilities in the latest stable Chromium, Firefox, WebKit/Safari, or embedded browser stack, including renderer RCE, IPC/broker flaws, sandbox escapes, site-isolation violations, JIT/compiler bugs, DOM/media/font/image parsers, GPU processes, extensions, and browser-to-OS exploit chains.
- ▌ Eac Usermode Telemetry Re · netvar1337EasyAntiCheat_EOS.exe / usermode telemetry RE: modules, IPC to driver, heartbeats, report formats, packing.
- ▌ Supply Chain Risk Auditor · netvar1337Use when assessing dependency exploit/takeover risk and supply-chain attack surface.
- ▌ Zdi Researcher Guidelines · netvar1337Use when planning, triaging, packaging, or submitting vulnerability research to Trend Micro Zero Day Initiative (ZDI). Encodes official submission criteria, valuation factors, disclosure timelines, exclusivity rules, current product-interest suspensions, report quality bar, and portal workflow. Pair with zero-day-target-eligibility before investing in a target.
- ▌ LLM Jailbreak Optimization · netvar1337Automated jailbreak search: PAIR, TAP, GCG, AutoDAN, random/evolutionary search, transfer, Best-of-N.
- ▌ Patch Diff Variant Hunting · netvar1337Use when mining historical CVEs, vendor patches, silent fixes, regressions, or incomplete mitigations for new vulnerability variants that still affect the latest stable release. Converts binary/source diffs into root-cause predicates, searches sibling implementations and exceptional paths, and applies a strict novelty gate so known bugs are not misreported as zero-days.
- ▌ Trace Guided Deobfuscation · netvar1337Use when static analysis fails on self-modifying/virtualized code; acquire and slice traces.
- ▌ Zero Day Target Eligibility · netvar1337Use before or during a vulnerability-research campaign governed by strict acquisition criteria: the bug must affect the latest stable product, have widespread deployment, remain non-public, and prioritize RCE, enterprise/server software, operating systems, browsers, sandbox or VM escapes, SCADA/IIoT, and security products. Provides fail-closed version, novelty, deployment, impact, and exclusion...
- ▌ Hardware Firmware Validation · netvar1337Use for FPGA/PCIe/DMA/HDL validation across simulators, manifests, and CI.
- ▌ Hermes Agent Skill Authoring · netvar1337Use when authoring in-repo SKILL.md (frontmatter, structure, writing-quality rules).