Skip to content
Get packs

Offensive TLS Attacks

Guides an agent through auditing TLS/SSL configs and known TLS attack techniques against targets.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a methodology for analysing how a server or mobile app uses TLS (the encryption behind HTTPS). Once installed, the agent knows the workflow for enumerating supported protocols and ciphers, checking for known weaknesses such as POODLE, DROWN, FREAK, BEAST and Heartbleed, testing certificate validation and pinning, and writing up findings. It also recommends standard scanners like testssl.sh, sslyze, sslscan and tlsx and shows example commands for them.

Great for

  • Security professionals running an authorised TLS assessment or penetration test
  • Students learning how classic TLS vulnerabilities work and how they are detected
  • Teams reviewing their own servers for deprecated protocols and weak ciphers

Skip it if

  • Testing systems you do not own or have written permission to test, since the skill is framed as offensive and probing third-party infrastructure may be illegal
  • Production scanning of large host lists without coordination, which can disrupt services and trigger alerts
  • Simple TLS hardening questions, where a standard configuration guide is faster and carries less risk

Try asking

  • “Audit our staging server at staging.example.com for deprecated protocols and weak ciphers using testssl.sh”
  • “Check whether our API accepts TLS 1.0 and list the findings with remediation priorities”
  • “Explain how the POODLE and DROWN attacks work and whether our servers are exposed”
  • “Plan a certificate pinning review for our Android app using Frida and Objection”
Step-by-step guide: how to use Offensive TLS AttacksInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-tls-attacks.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-tls-attacks.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-tls-attacks.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the agent at systems you own or are explicitly authorised to test, and state that scope in your request.
  • Ask for output in a specific format, such as JSON or a findings table with severity, to make results easier to review.
  • Treat the skill as a checklist; verify the agent's findings against the scanner output yourself before acting on them.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.