purpleailab
- 351 skills
- 0 followers
- 17 hours ago last updated
- ▌ Anti Debug Bypass · purpleailabDetect and neutralize anti-debug / anti-VM checks — IsDebuggerPresent, ptrace, NtGlobalFlag, timing, hardware-breakpoint detection.
- ▌ Windows Driver Assessment · purpleailabDefensive Windows internals and driver exposure assessment for owner-authorized systems and disposable research VMs.
- ▌ Cleanup Template · purpleailabCleanup & restoration plan generator — artifact inventory, persistence removal commands, pre-engagement baseline, post-engagement verification.
- ▌ Contact Template · purpleailabContact / communications plan generator — primary operator, escalation chain, abort signal recipient, external SOC endpoint, blackout windows.
- ▌ Opplan Converter · purpleailab bundleConvert engagement documents into machine-readable OPPLAN for the ralph loop — objective decomposition, acceptance criteria, MITRE mapping, priority ordering.
- ▌ Krack Fragattacks · purpleailabKRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation/aggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.
- ▌ Aatmf T07 Output Exfil · purpleailabAATMF T7 — Output Manipulation & Exfiltration. Covert channels in output, schema break, exfil via image gen, side-channel via timing.
- ▌ Aatmf T13 Supply Chain · purpleailabAATMF T13 — AI Supply Chain & Artifact Trust. Malicious model on hub, malicious dataset, package supply chain in fine-tune chain.
- ▌ Seven Question Gate · purpleailab7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
- ▌ Patchwork Dropping Elephant · purpleailabAdversary-emulation profile for Patchwork (G0040 / Dropping Elephant / Chinastrats / MONSOON / Hangover Group / Operation Hangover), an India-linked cyber-espionage actor.
- ▌ Ml Model Extraction · purpleailabExtract a functional clone of a black-box ML model via prediction API queries, and infer whether specific records were in the training set (membership inference).
- ▌ Prototype Pollution · purpleailabHunt JavaScript prototype pollution (CWE-1321) — the 2023-2026 meta-vulnerability that chains into RCE, auth bypass, and SSRF on most Node.js stacks.
- ▌ Contracts Governance Attack · purpleailabDAO governance attack — flash-loan-backed vote manipulation, delegation hijack, quorum dilution, proposal-spam DoS, time-lock bypass via emergency multisig, snapshot vs. on-chain vote desync, Compound/Aave/Uniswap-style GovernorBravo abuse.
- ▌ Upgradeable Proxy · purpleailabProxy upgrade patterns and their bugs — uninitialized implementation, storage slot collisions, selector clashes, unprotected upgrade auth.
- ▌ Ato Methodology · purpleailabAccount Takeover decision tree — 9 canonical ATO paths, chaining patterns (IDOR→ATO, XSS→ATO, OAuth→ATO), MFA bypass entry points.
- ▌ Cache Deception · purpleailabWeb cache deception — trick CDN/proxy into caching authenticated responses under unauthenticated URLs, exposing PII to any visitor.
- ▌ Exploit Deserialization · purpleailabInsecure deserialization — RCE via malicious serialized objects in Java (ysoserial), PHP (PHPGGC), .NET (ysoserial.net), and Python (pickle). Covers gadget chain selection, payload generation, and injection into cookies, POST bodies, ViewState, and API endpoints.
- ▌ Mass Assignment · purpleailabMass assignment + ORM leak — inject extra fields into create/update requests, escalate to admin, leak protected fields via response.
- ▌ Proxy Misconfig · purpleailabReverse proxy misconfigurations — nginx alias traversal, Apache mod_rewrite SSRF, Spring Boot Actuator exposure, Tomcat manager, IIS short-name disclosure.
- ▌ HTML Smuggling Lure · purpleailabHTML smuggling payloads for initial access — embed base64-encoded binaries inside an HTML attachment that reconstructs and auto-downloads the file client-side via JavaScript Blob, bypassing email gateway and proxy file-type inspection.
- ▌ Pretext Engineering · purpleailabDesign a credible phishing pretext and target shortlist from OSINT before any campaign is built — sender persona, scenario, timing, and the minimal target set.
- ▌ Network Replay · purpleailabPCAP-based network replay attacks: capture auth sequences, session tokens, and protocol frames, then replay or inject to achieve unauthorized access or session hijack.
- ▌ Wpa Enterprise Eap · purpleailabWPA/WPA2/WPA3-Enterprise (802.1X/EAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.
- ▌ Aatmf T12 RAG Poisoning · purpleailabAATMF T12 — RAG & Knowledge Base Manipulation. PoisonedRAG, vector store flood, embedding collision, retrieval-bias attacks.
- ▌ Aatmf T14 Infra Warfare · purpleailabAATMF T14 — Infrastructure & Economic Warfare. Endpoint DoS via expensive prompts, model-API account exhaustion, GPU resource starvation, billing weaponization.
- ▌ Muddywater Mango Sandstorm · purpleailabAdversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor.
- ▌ Sidewinder Rattlesnake · purpleailabAdversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.
- ▌ AWS Iam Passrole Chain · purpleailabAWS IAM privilege escalation via `iam:PassRole` chains — Lambda/Glue/Sagemaker/EC2/ECS PassRole to a higher-priv role, AssumeRole chains across accounts, sts:GetCallerIdentity recon, account hijack via legacy root-mfa-bypass.
- ▌ Azure Managed Identity · purpleailabAzure Managed Identity abuse — IMDS at 169.254.169.254 from compromised VM / App Service / Function, token exchange for Graph/ARM/KeyVault, federated workload identity abuse, hybrid AAD Connect MSOL credential extraction.
- ▌ Pentest Task Tree · purpleailabIterative PTT (Penetration Testing Tree) session reasoning — build, update, and traverse a live numbered task tree to drive LLM-guided pentest decisions across a full session.
- ▌ Header Injection · purpleailabHTTP header injection — CRLF/response splitting, Host-header cache poisoning, X-Forwarded-* abuse, Content-Disposition/Set-Cookie injection, and password-reset link poisoning via unvalidated header values.
- ▌ Web Auth Mapping · purpleailabAuthentication surface — login endpoints, JWT/OAuth/SAML/SSO/API-key mechanism identification.
- ▌ Web Cms Scanning · purpleailabCMS-specific scans — WordPress (wpscan), Joomla, Drupal version detection.
- ▌ Web Cookie Audit · purpleailabCookie-conditional sink discovery — bisect required cookies per sink, session-write timeline for race-condition challenges.
- ▌ Reverser Ransomware Analysis · purpleailabRansomware family identification and analysis — encryption scheme identification, key recovery techniques, ransom note parsing, shadow copy/recovery inhibition analysis, decryptor availability check, and IOC extraction for common ransomware families.
- ▌ Apt33 Elfin · purpleailabAdversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.
- ▌ System Prompt Leakage · purpleailabHunt LLM system-prompt leakage (OWASP LLM07:2025) — exfiltration of the privileged system prompt revealing internal rules, secrets baked in, tool inventory, and business logic that should not be client-visible.
- ▌ Unbounded Consumption · purpleailabHunt LLM unbounded consumption (OWASP LLM10:2025) — denial-of-wallet and denial-of-service against LLM endpoints via unrestricted prompt size, runaway tool loops, expensive model selection, and unauthenticated fan-out.
- ▌ Container Cve · purpleailabHigh-impact container-runtime CVE catalog — runC Leaky Vessels (CVE-2024-21626/-23651/-23652/-23653), CVE-2022-0185 (FUSE/legacy-fs), CVE-2019-5736 (runC binary replace), CRI-O Dirty COW analogs, Kubernetes API server CVE-2019-11247 (custom-resource RBAC bypass). Fingerprint → match → exploit.
- ▌ M365 Mailbox Compromise · purpleailabMicrosoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.
- ▌ Oracle Manipulation · purpleailabHunt single-block oracle manipulation — spot-price AMM oracles, manipulable TWAP, dependent calculations, missing staleness checks.
- ▌ Engagement Startup · purpleailabMandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
- ▌ Exploit Command Injection · purpleailabOS Command Injection — exploiting applications that pass user input to OS commands without sanitization. Covers injection operators (;, |, ||, &&, $(), backticks, newline), blind detection (time-based, OOB callback), and bypass techniques (space, keyword, encoding).
- ▌ PHP Type Juggling · purpleailabPHP type juggling and magic hash attacks — exploit loose comparison (==) with 0e-prefixed hash collisions and NULL returns to bypass authentication.
- ▌ C2 Cobalt Strike · purpleailabCobalt Strike operations — Beacon deployment, Malleable C2 profile creation, listener setup, OPSEC-safe beacon configuration, process injection, and Arsenal kit usage.
- ▌ Lateral Movement · purpleailabNetwork lateral movement — Pass-the-Hash, Pass-the-Ticket, WMI/WinRM/PsExec/RDP execution, SMB operations, network tunneling with Ligolo-ng and Chisel.
- ▌ Web Waf Detection · purpleailabWeb Application Firewall fingerprinting — Cloudflare, AWS WAF, Akamai, Imperva, etc.
- ▌ Aatmf T11 Agentic Exploit · purpleailabAATMF T11 — Agentic & Orchestrator Exploitation. MCP tool poisoning, agent-to-agent prompt injection, tool-result spoofing, orchestrator state confusion.
- ▌ Apt34 Oilrig · purpleailabAdversary-emulation profile for APT34 / OilRig (G0049), an Iranian state-sponsored espionage group, mapping its ATT&CK TTPs to Decepticon tooling for authorized red-team emulation.
- ▌ Apt37 Reaper · purpleailabAdversary-emulation profile for APT37 (G0067 / Reaper / ScarCruft / Ricochet Chollima / InkySquid / Group123), North Korea's RGB cyber-espionage actor.
- ▌ Dark Caracal · purpleailabAdversary-emulation profile for Dark Caracal (G0070), a Lebanese state-linked cyber-espionage and surveillance actor attributed to the General Directorate of General Security (GDGS), operating since at least 2012.
- ▌ Salt Typhoon Earth Estries · purpleailabAdversary-emulation profile for Salt Typhoon (G1045 / Earth Estries / GhostEmperor / FamousSparrow / UNC2286 / RedMike / OPERATOR PANDA), a PRC state-sponsored cyber-espionage actor targeting telecommunications and critical infrastructure worldwide.
- ▌ Volt Typhoon · purpleailabAdversary-emulation profile for Volt Typhoon (G1017), a PRC state-sponsored actor pre-positioning in US critical infrastructure via living-off-the-land TTPs.
- ▌ Adversarial Ml Evasion · purpleailabCraft adversarial examples that cause trained ML classifiers to misclassify at inference time — image recognition, malware detectors, IDS, spam filters.
- ▌ Chain Xss To Takeover · purpleailabBuild chains from XSS into account takeover or privileged action execution.
- ▌ K8S Pod Escape · purpleailabKubernetes pod escape to node — privileged container abuse, hostPath mount escape, hostPID/hostIPC, capability misuse (SYS_ADMIN, SYS_PTRACE), runC CVE chains. Pivots from RCE-in-pod to full node compromise.
- ▌ K8S Rbac Abuse · purpleailabKubernetes RBAC privilege escalation paths — ClusterRole/Role enumeration via `kubectl auth can-i --list`, abuse of pods/exec, pods/portforward, secrets get, escalate verb, bind verb, impersonate verb, system:masters group abuse, ServiceAccount token theft and reuse.
- ▌ Kill Chain Analysis · purpleailabKill chain analysis and attack path decision-making — findings analysis, attack vector selection, target prioritization, phase transitions.
- ▌ API Server Sent Events · purpleailabServer-Sent Events (SSE / EventSource) exploitation — origin abuse for cross-site streaming exfil, prompt-injection via SSE messages into LLM clients, retry-after token leak, fragmenting events to bypass content-type sniffers.
- ▌ PDF Credential Harvest · purpleailabWeaponized PDF attachments that redirect victims to fake authentication portals (SharePoint, M365, Google Workspace) — no exploit, no macro, just a convincing document with embedded links to a credential-capture page.
- ▌ Credential Access · purpleailab bundleCredential extraction and capture — LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, Responder poisoning, password spraying, hash cracking.
- ▌ Structured Questions · purpleailabHow to use ask_user_question — the single operator-input channel for every interview question, including free-form fields via allow_other=true.
- ▌ Aatmf T01 Prompt Injection · purpleailabAATMF T1 — Prompt & Context Subversion. Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt-leaking via reflection.
- ▌ Aatmf T05 API Exploitation · purpleailabAATMF T5 — Model & API Exploitation. Rate-limit abuse, token-cost amplification, schema bypass, model-version manipulation.
- ▌ Fin7 Carbanak · purpleailabAdversary-emulation profile for FIN7 (G0046; aka Carbanak, Carbon Spider, Sangria Tempest, GOLD NIAGARA, ELBRUS) — a financially motivated Russian-speaking crime group, mapping its TTPs to Decepticon tooling for authorized red-team emulation.
- ▌ Lazarus Group · purpleailabAdversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.
- ▌ Mustang Panda Bronze President · purpleailabAdversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.
- ▌ Sandworm Team · purpleailabAdversary-emulation profile for Sandworm Team (Voodoo Bear / Seashell Blizzard / APT44 / ELECTRUM), Russia's GRU Unit 74455 destructive ICS/OT and influence actor (ATT&CK G0034).
- ▌ Chain Idor To Priv Esc · purpleailabBuild chains where IDOR enables privilege escalation and high-impact control-plane actions.
- ▌ Engagement Lifecycle · purpleailabRed team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
- ▌ Cicd Secrets Exfil · purpleailabExtracting CI secrets / OIDC tokens once you have code execution in a build job — echo/printenv exfil, log-masking bypass (base64, char-split, reversal), OIDC token abuse to assume cloud roles, GITHUB_TOKEN / CI_JOB_TOKEN scope abuse, cache / artifact secret leakage, provenance pivot.
- ▌ Web Cache Poisoning · purpleailabUnkeyed-input cache poisoning — X-Forwarded-Host/Scheme/Port, X-Original-URL, fat-GET, parameter cloaking, oversized-header DoS, and chains to stored-XSS / open redirect via shared caches.
- ▌ O365 Credential Harvest · purpleailabHarvest and replay O365 / Entra ID access via the OAuth device-code flow and captured tokens (TokenTactics-style), skipping the password + MFA prompts.
- ▌ C2 Domain Fronting · purpleailabDomain fronting and CDN abuse for C2 concealment — CloudFront, Azure CDN, Fastly setup, TLS SNI vs Host header technique, CDN-based redirectors, and integration with Cobalt Strike and Sliver.
- ▌ Linux Privesc Enum · purpleailabSystematic Linux privilege-escalation enumeration methodology — ordered phases covering sudo, SUID/SGID, capabilities, cron, writable paths, NFS, kernel CVEs, and GTFOBins lookup, grounded in LLM-assisted autonomous privesc research (hackingBuddyGPT/ipa-lab).
- ▌
- ▌ Reverser Virtualized Protectors · purpleailabVMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance.
- ▌ Aatmf T03 Reasoning Exploit · purpleailabAATMF T3 — Reasoning & Constraint Exploitation. System prompt override, constraint negation, role-reversal, instruction conflict exploit.
- ▌ Aatmf T15 Human AI Coupling · purpleailabAATMF T15 — Human-AI Coupling. Deepfake escalation, voice clone vishing, deepfake-image-driven social engineering, automation of human-targeted attacks.
- ▌ Pink Sandstorm Agrius · purpleailabAdversary-emulation profile for Pink Sandstorm (G1030 / Agrius / Agonizing Serpens / AMERICIUM / BlackShadow / DEV-0227), Iran's MOIS-linked destructive wiper and pseudo-ransomware operator.
- ▌ Data And Model Poisoning · purpleailabHunt LLM training-data and model poisoning (OWASP LLM04:2025) — adversarial inputs that bias future model behaviour through fine-tuning, RLHF, or continuous-learning loops.
- ▌ Improper Output Handling · purpleailabHunt improper LLM output handling (OWASP LLM05:2025) — downstream code that trusts unstructured model output and renders / executes / shells it without sanitisation, producing XSS, SSRF, SQL injection, RCE, and SSTI via the model channel.
- ▌ Entra Device Code Phishing · purpleailabEntra ID OAuth device-code phishing for token theft, illicit consent grant via malicious app registration with delegated Graph scopes, refresh-token replay, and primary-refresh-token (PRT) abuse concepts.
- ▌ Edge Device Exploitation · purpleailabEdge device exploitation — routers, firewalls, VPN appliances (Cisco IOS XE, Fortinet, Ivanti, Palo Alto). Covers CVE exploitation chains, post-exploitation on network devices, config extraction, and implant deployment on perimeter infrastructure.
- ▌ Data Handling Template · purpleailabData handling plan generator — evidence retention, encryption, chain-of-custody, compliance frameworks (GDPR / HIPAA / PCI-DSS / SOC2).
- ▌ Aatmf T02 Linguistic Evasion · purpleailabAATMF T2 — Semantic & Linguistic Evasion. Foreign-language pivot, encoded payloads, esolang, fictional framing, jailbreak via translation.
- ▌ Aatmf T06 Training Poisoning · purpleailabAATMF T6 — Training & Feedback Poisoning. Data poisoning, RLHF reward hacks, fine-tune-time exfil, embedding poisoning.
- ▌ Apt29 Cozy Bear · purpleailabAdversary-emulation profile for APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM / The Dukes), Russia's SVR-attributed cyber-espionage group, mapping its ATT&CK TTPs to Decepticon emulation tooling.
- ▌ Dep Confusion · purpleailabDependency confusion — publish a higher-version internal package name on public registry (npm/PyPI/Maven/Crates) to coerce CI/CD into pulling attacker code.
- ▌ Privilege Escalation · purpleailabHost privilege escalation — Windows token impersonation, UAC bypass, service abuse, DLL hijacking, Linux SUID/sudo/kernel exploits, automated enumeration.
- ▌ Aatmf T04 Memory Manipulation · purpleailabAATMF T4 — Multi-Turn & Memory Manipulation. Persistent memory injection, conversation-state poisoning, cross-session contamination, ghost-context leak.
- ▌ Apt28 Fancy Bear · purpleailabAdversary-emulation profile for APT28 (G0007 / Fancy Bear / Forest Blizzard / Sofacy / STRONTIUM), Russia's GRU Unit 26165 cyber-espionage actor.
- ▌ Scattered Spider · purpleailabAdversary-emulation profile for Scattered Spider (UNC3944/Octo Tempest), a financially motivated social-engineering-led intrusion group, mapped to ATT&CK G1015 and Decepticon tooling.
- ▌ Web Subdomain Takeover · purpleailabSubdomain takeover via dangling DNS/CNAME — GitHub Pages, Heroku, Azure, Fastly, Shopify, Netlify, Surge, Tumblr, Beanstalk, Zendesk, etc.
- ▌ Emulation Overview · purpleailabAdversary-emulation playbook catalog — per-actor kill chains that turn an APT/eCrime threat profile into Decepticon CONOPS phases + OPPLAN objectives. Routing skill: pick the actor, seed plan/threat-profile.json, then map each kill-chain phase to the operational skill the executing agent runs. Triggers on: 'emulate', 'adversary emulation', 'APT playbook', 'threat actor playbook', 'emulation plan', 'attack flow'.
- ▌ Apt10 Stone Panda · purpleailabAdversary-emulation profile for APT10 (G0045 / Stone Panda / menuPass / POTASSIUM / Red Apollo / CVNX), China's MSS Tianjin State Security Bureau cyber-espionage actor.
- ▌ Docker Socket Mount · purpleailabDocker / containerd socket mounted into a container → host RCE. Common in CI runners, GitOps controllers (ArgoCD, Flux), and 'Docker-in-Docker' setups. Single-command escape via `docker run --rm --privileged -v /:/host alpine chroot /host`.
- ▌ GCP Svc Account Impersonation · purpleailabGCP service account impersonation chain — IAM `roles/iam.serviceAccountTokenCreator`, `roles/iam.serviceAccountUser`, `actAs` on Cloud Functions / Cloud Run / Compute Engine. Pivot from low-priv SA to org-admin via chained impersonation.
- ▌ C2 Alternative Channels · purpleailabNon-traditional C2 channels — Discord/Telegram bots, DNS-over-HTTPS, blockchain-based C2, email-based C2, and cloud function dead drops for covert command and control.
- ▌ Aatmf T10 Confidentiality Breach · purpleailabAATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.