القائمة
Use passive to expand domains/ICPs into cyberspace assets like IPs, URLs, ports via uncover (FOFA, Hunter, Shodan, Censys, etc.). Run before active scanners (gogo, spray, katana).
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use this skill when the agent needs to understand aiscan mechanisms, available capabilities, scanner pseudo-commands, and tool invocation rules.
Use this skill when working with proton for sensitive information scanning — detecting API keys, tokens, credentials, and secrets in files or piped data.
Use this skill to learn how to use the playwright pseudo-command for headless browsing, screenshots, network capture, and interactive vulnerability verification. Aligned with microsoft/playwright-cli conventions.
Use this skill when working with scan for the multi-stage aiscan pipeline across discovery, web probing, weak credentials, POC checks, and verification.
Use this skill when working with neutron for template-based POC execution, template filtering, and POC result analysis.
Use this skill when working with gogo for host, port, service, banner, fingerprint, or vulnerability-hint discovery.
| name | passive |
| description | Use passive to expand domains/ICPs into cyberspace assets like IPs, URLs, ports via uncover (FOFA, Hunter, Shodan, Censys, etc.). Run before active scanners (gogo, spray, katana). |
passive is an aiscan command backed by uncover for cyberspace search. Pick a source with -s.
| Source | Provider | Credential |
|---|---|---|
fofa | FOFA | recon.fofa_email + recon.fofa_key or env vars |
hunter | Hunter | recon.hunter_api_key or env HUNTER_API_KEY |
shodan | Shodan | env SHODAN_API_KEY |
shodan-idb | Shodan IDB | none |
censys | Censys | env CENSYS_API_TOKEN + CENSYS_ORGANIZATION_ID |
quake | Quake | env QUAKE_TOKEN |
zoomeye | ZoomEye | env ZOOMEYE_API_KEY |
netlas | Netlas | env NETLAS_API_KEY |
criminalip | CriminalIP | env CRIMINALIP_API_KEY |
publicwww | PublicWWW | env PUBLICWWW_API_KEY |
hunterhow | HunterHow | env HUNTERHOW_API_KEY |
binaryedge | BinaryEdge | env BINARYEDGE_API_KEY |
onyphe | Onyphe | env ONYPHE_API_KEY |
driftnet | Driftnet | env DRIFTNET_API_KEY |
greynoise | GreyNoise | env GREYNOISE_API_KEY |
Sources without credentials are silently skipped at init.
Additional sources can be configured via ~/.uncover-config/provider-config.yaml.
fofa, hunter, shodan, etc.)gogo, spray, katana, or neutron for active scanning.Skip passive when the user already provided concrete IPs or private ranges.
passive -s fofa 'domain="example.com"'
passive -s fofa 'icp="浙ICP备16020926号"'
passive -s hunter 'domain.suffix="example.com"'
passive -s shodan 'org:"Example"'
The positional argument is the source-native query string.
JSON array with rich fields:
[{"ip":"1.2.3.4","port":"443","url":"https://example.com","domain":"example.com","title":"Example","icp":"..."}]
JSON array with extra fields: status, company, frame:
[{"ip":"1.2.3.4","port":"443","url":"https://example.com","domain":"example.com","status":"200","company":"Example Inc","frame":"nginx","title":"Example","icp":"..."}]
Generic JSON array:
[{"ip":"1.2.3.4","port":"80","url":"http://example.com","host":"example.com","source":"shodan"}]
passive -s fofa 'icp="京ICP备xxx号"' → get IPs/URLsgogo / spray / katana → active scan discovered assetsrecon.proxy=socks5://... for Hunter from abroad.