القائمة
[recon] Fast DNS resolver/toolkit — bulk-resolve hostnames, query record types, and run DNS brute force. Reach for it to filter a candidate subdomain list down to live, resolving hosts.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | dnsx |
| description | [recon] Fast DNS resolver/toolkit — bulk-resolve hostnames, query record types, and run DNS brute force. Reach for it to filter a candidate subdomain list down to live, resolving hosts. |
ProjectDiscovery's dnsx (pure-Go). Resolves large host lists and queries
record types at speed. Sits between subfinder (discover) and httpx (probe).
-l <file> / stdin — host list.-a -aaaa -cname -mx -ns -txt -ptr record types; -resp show the answer.-silent domains only; -json structured output.-d <domain> -w <wordlist> DNS brute force (active).-rl <n> rate limit; -t <n> concurrency; -r <resolvers.txt> custom resolvers.# Resolve candidates, keep only live hosts with their A records, as JSON
dnsx -l candidates.txt -a -cname -resp -json -rl 100 -o resolved.jsonl
-w) generates many
queries — keep -rl sane and run it only against in-scope apexes.