القائمة
[recon] Passive subdomain enumeration for a root domain via public sources (no direct traffic to the target). Reach for it first to expand the host attack surface before live probing.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | subfinder |
| description | [recon] Passive subdomain enumeration for a root domain via public sources (no direct traffic to the target). Reach for it first to expand the host attack surface before live probing. |
ProjectDiscovery's subfinder (pure-Go). Aggregates subdomains from passive
sources (certificate transparency, passive DNS, search APIs). Passive by design:
it queries third-party data sources, not the target itself.
-d <domain> target apex (repeatable) or -dL <file> list of domains.-all use all sources (slower, broader); default is the fast curated set.-recursive recurse into discovered subdomains.-silent only print domains (clean for piping).-oJ -o out.json JSON output; -rl <n> rate limit to source APIs.-nW show only resolvable hosts (when combined with resolution).# Enumerate in-scope apex, pipe straight into resolve+probe
subfinder -d target.example.com -all -silent \
| dnsx -silent -a -resp \
| httpx -silent -sc -title