initial-access-phishing
SkillSecurityThis skill adds phishing and social engineering testing techniques to an AI for use in authorized security engagements. It covers credential spraying, adversary-in-the-middle (AiTM) phishing, device code phishing, OAuth consent phishing, payloads, and voice phishing (vishing), so a team can check how well its people and controls hold up. It should only be used against systems and people you have permission to test.
Available today. Use it from your connected AI after setup.
No other account needed.
Add the skill, confirm you have written authorization for the target scope, then ask the AI to run a specific technique, such as a phishing simulation for a named test group.
Then ask your AI: use the initial-access-phishing skill
What your AI can do with it
- Run credential spraying tests against accounts in an authorized scope
- Set up adversary-in-the-middle phishing pages to test credential and session protections
- Stage device code phishing scenarios to see whether staff recognize them
- Create OAuth consent phishing simulations to test approval prompts
- Prepare phishing payloads for authorized test campaigns
- Conduct voice phishing (vishing) tests with participants' consent
What this skill tells your AI
The instructions your AI receives, as published by langbyyi/cyberstrikeai-src in skills/initial-access-phishing/SKILL.md and read by ahel’s review.
初始访问 / 钓鱼 / 社工
=== 初始访问/钓鱼/社工(外部进内部第一跳,打点前的打点) ===
凭据喷洒: 弱密码(Season+Year!/公司名123)喷全体账号(每账号1-2次避锁定) | 来源:泄露库/OSINT邮箱格式(f.last@)/默认凭据
AiTM钓鱼(绕MFA): evilginx3/Modlishka反代真站→中间人偷session cookie+token(绕MFA) | phishlet配域名+证书
设备码钓鱼(Azure/M365): device code flow→诱导受害者输码→拿access/refresh token(无需密码/MFA) | TokenTactics/AADInternals
钓鱼载荷: gophish发信+落地页 | 载荷 lnk/iso/宏/HTA/OneNote | 绕网关:密码zip/云盘链接/HTML走私
OAuth同意钓鱼(illicit consent): 恶意App请求过度scope(Mail.Read/offline_access)→受害者同意→长期访问令牌
社工前戏: OSINT组织架构/供应商/口令习惯(LinkedIn/招聘/GitHub) | pretext借口(IT支持/供应商/HR) | vishing(deepfake声音)
→ 初始access落地即转 `redteam-opsec`(别一进门就被EDR抓), 拿到的能力进 `capability-primitive-search` 凑链
Signals
- GitHub stars
- 115
- Forks
- 4
- Last commit
- Sep 2026
ahel recommends instead
Advanced
- Catalog kind
- skill
- Gateway key
initial-access-phishing-langbyyi- Source
- github.com/langbyyi/cyberstrikeai-src