enterprise-vpn-attack
对常见厂商和常见 WebVPN 痕迹做归纳，便于快速识别易受攻击设备。
包含具体设备漏洞与利用路径，存在被滥用的风险，请在授权环境下使用。
面向企业 SSL VPN/远程访问设备的指纹、CVE 矩阵与利用思路汇总。
汇总企业级 SSL VPN 和远程接入设备的指纹、2018–2026 年 CVE 矩阵和利用思路，覆盖 Cisco ASA/AnyConnect、FortiGate、NetScaler、GlobalProtect、Pulse、F5 等厂商。外部侦察到 VPN 登录页、特定路径或端口暴露时用来判定版本、默认凭据、后台 AAA、以及可能的 pre-auth RCE/SSRF/路径遍历利用点。特点是把授权测试经验和近年 CVE 景观整合成可操作的攻击面矩阵，便于优先级判断。
▸ 展开 SKILL.md 英文原文
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/enterprise-vpn-attack/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/enterprise-vpn-attack/SKILL.md"## When to use this skill Trigger when recon surfaces: - `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect - `intranet.*` / `vpn.*` / `connect.*` / `webvpn.*` / `wc.*` / `remote.*` subdomains - Port 443 returning login pages with `Server: Apache` or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti" - TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports) - HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5) DO NOT use for: - Internal lateral-movement post-foothold (out of scope per user's boundary) - VPN client-si