Windows Discovery
Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.
Windows Discovery enumerates Windows systems for local privilege escalation vectors and attack surface mapping.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-04-01
Windows Discovery enumerates Windows systems for local privilege escalation vectors and attack surface mapping. Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.
Use it when
- Yes.
- Windows Discovery identifies active Windows systems for security assessment by enumerating system configuration, user context, services.
Install
blacklanternsecurity/red-run/windows-discovery · repository language: Python
generated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does Windows Discovery do?
Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.
Can Windows Discovery enumerate windows hosts on a network?
Yes. Windows Discovery is designed to discover and enumerate Windows hosts on a network as a primary function. It identifies active Windows systems and collects detailed configuration data to support security assessment and infrastructure mapping workflows.
How does Windows Discovery identify active Windows systems?
Windows Discovery identifies active Windows systems for security assessment by enumerating system configuration, user context, services, and misconfigurations. It gathers OS details and token privileges to detect which systems are present and active on the network.
What license does Windows Discovery use?
Windows Discovery is released under the GPL-3.0 license, which permits use, modification, and distribution under the terms of the GNU General Public License version 3.
Does Windows Discovery map Windows infrastructure?
Yes. Windows Discovery maps Windows infrastructure and assets by systematically enumerating hosts, their configurations, user contexts, and group memberships. This enables comprehensive asset discovery and infrastructure visibility for security and operational purposes.
What information does Windows Discovery collect?
Windows Discovery collects baseline OS details, token privileges, group memberships, system configuration data, user context information, services, and misconfigurations. It reports these findings to identify privilege escalation vectors and security assessment opportunities.
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Discover and enumerate Windows hosts on a network”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
Locate and extract credentials cached on Windows systems through registry queries, file searches, shadow copies, and DPAPI decryption. Covers browser passwords, saved sessions, unattend files, and vault entries accessible without domain access.
Launch Windows Terminal instances with chosen shell profiles, working directories, and pane layouts through command-line control. Arrange multiple terminals side-by-side or stacked, run commands on startup, and organize development workflows across tabs.
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
Exploitation guides you through the full attack chain: finding public exploits via Exploit-DB, executing Metasploit modules against identified vulnerabilities, and crafting standalone payloads with msfvenom. Use it to move from vulnerability discovery to shell establishment during authorized security assessments.
Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
More skills security (MIT) · active-directory-attacks (MIT) · Windows Kernel Exploits (GPL-3.0) · Linux Discovery (GPL-3.0)