Agent skill · security · aiskillstore
exploitation-knowledge
Comprehensive knowledge about vulnerability exploitation and initial access. Provides expertise on finding and adapting exploits, adapting proof-of-concepts, gaining shells, and capturing user flags. Covers reverse shells, file uploads, SQL injection, and RCE vulnerabilities.
Why this skill is useful
Adds detailed exploitation workflows and scripts for vulnerability exploitation that are not commonly known or documented.
What it needs
Requires curl, hydra, jq, metasploit, searchsploit, sqlmap installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Exploitation Knowledge Base Purpose This knowledge base provides comprehensive exploitation methodologies and techniques. It covers converting discovered vulnerabilities into actual access, finding and adapting exploits, working in non-interactive environments, establishing stable shells, and capturing the user flag. Core Topics Covered 1. Exploit Discovery: Finding relevant exploits for discovered services 2. Exploit Adaptation: Modifying exploits to work in the target environment 3. Initial Access: Gaining command execution or shell access 4. Shell Stabilization: Upgrading to stable, usable shells 5. User Flag Capture: Locating and reading user.txt Tools Available Exploit Databases searchsploit - Local exploit-db search msfconsole - Metasploit framework Manual search: ExploitDB, GitHub, security advisories Shell Tools Reverse shells: bash, python, php, nc Web shells: PHP, ASP, JSP rlwrap nc - Stabilize shells Web Exploitation sqlmap - SQL injection curl - Manual web testing File upload bypass techniques Command injection testing Credential Testing hydra - Service brute force (limited use) ssh/ftp/mysql - Test discovered credentials Exploitation Workflow Phase 1: Multi-Source Exploit Discovery Core Principle: Use multiple exploit sources in parallel - never rely on a single source. Layered Exploit Search: Critical Rules: 1. Try all layers - Don't stop at Layer 1 failure 2. Parallel search - If time allows, search multiple sources simultaneously 3. Cross-validate - If multiple exploits exist, try most reliable/recent first 4. Track sources - Record which source worked in successfulpaths Phase 2: Exploit Analysis Before running: 1. Read the exploit code - understand what it does 2. Check requirements - needed libraries, credentials 3. Identify target parameters - IP, port, payload location 4. Plan adaptation - what needs to be modified Phase 3: Exploit Adaptation Common modifications needed: A. Python Exploits B. Metasploit Exploits C. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/exploitation-knowledge