shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

[static-analysis] Mine the cloned repo's OWN git history for past security/fix commits and map them to recurring hot files, then fold in dependency-CVE (osv-scanner) and history-secret (gitleaks) signals. Reach for it in pre-recon to seed 'what's been exploited before' — code patched for a vuln once is the highest-yield place to re-examine.

Full interactive setup guide for Shor (the web-security scanning platform). Invoke when a user wants to pentest a target: guides scan-type selection, repo analysis, compute recommendation, pre-flight, deployment, auth wiring, and Shor project + scan creation. Also covers deploying the Shor platform itself on GCP when it is not yet running. Handles black-box and white-box modes.

[exploit] Generate a current 6-digit TOTP (RFC 6238) from a provided MFA secret, to complete logins for in-scope test accounts that have 2FA enabled. Reach for it during authenticated-session setup, not as an attack.

[exploit] Automated OS command-injection detection and exploitation against a live endpoint. Reach for it after a manual probe suggests user input reaches a shell, to confirm execution with a harmless command.

[exploit] Automated SQL injection detection and exploitation against a live endpoint. Reach for it after manual curl confirmation to fingerprint the DB, enumerate schema, and extract a minimal proof sample.

[exploit] Detect and exploit Server-Side Template Injection across many engines (Jinja2, Twig, Freemarker, etc.). Reach for it when input is reflected into a template and a polyglot probe hints at evaluation.

[exploit] Automate SSRF exploitation from a captured request + the injectable parameter — internal probing, cloud-metadata reads, port scan modules. Reach for it once an SSRF sink is identified to reach a minimal-impact PoC.

[exploit] Context-aware XSS suite with payload generation, WAF detection, and fuzzing. Reach for it as a secondary XSS tool when dalfox is inconclusive or you need crafted, context-specific payloads/WAF bypass.

[exploit] Network login brute-forcer for protocol services (SSH, FTP, RDP, SMTP, DB, and HTTP form/basic). Reach for it to test credential strength on an authenticated, in-scope login when ffuf isn't the right fit.

[exploit] Broken-access-control recipe (IDOR/BOLA/BFLA, the OWASP #1 with no headless CLI) — build a role x endpoint matrix, A/B-replay requests across identities, and enumerate object IDs. Reach for it for every authorization test.

[recon/exploit] Headless browser automation — drive auth flows, render JS apps, and CONFIRM client-side bugs (XSS execution, DOM sinks) in a real DOM. Reach for it whenever proof requires JavaScript to actually run.

[exploit] Detect and exploit NoSQL injection (primarily MongoDB-style operator injection) on a live endpoint. Reach for it when the backend is a NoSQL store and login/query params may accept operator payloads.

[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

[exploit] Fast parameter-analysis XSS scanner with DOM/reflection verification (Go). Reach for it as the primary XSS tool to confirm reflected/DOM XSS on parameterized URLs and emit a working PoC payload.

[recon/exploit] Fast HTTP fuzzer — content/dir discovery, parameter & value fuzzing, and login/credential brute via the FUZZ keyword. Reach for it for forced browsing and (with the authz recipe) ID enumeration.

[recon] Crawl a live web app to enumerate URLs, endpoints, JS-referenced paths, and forms. Reach for it to build the in-app URL/endpoint inventory that feeds param discovery, fuzzing, and DAST.

[recon] HTTP parameter discovery — find hidden/unlinked query, body, JSON, and header params an endpoint silently accepts. Reach for it before injection/XSS testing to expand the input surface of an endpoint.

[recon] Fast DNS resolver/toolkit — bulk-resolve hostnames, query record types, and run DNS brute force. Reach for it to filter a candidate subdomain list down to live, resolving hosts.

[recon] getallurls — pull known historical URLs for a domain from Wayback, Common Crawl, OTX, URLScan (passive). Reach for it to recover old/forgotten endpoints and parameterized URLs without touching the target.

[recon] Mine parameterized URLs for a domain from web archives and normalize them into FUZZ-ready templates (passive). Reach for it to bulk-harvest historical param names/URLs as fuzzing seeds.

[recon] Passive subdomain enumeration for a root domain via public sources (no direct traffic to the target). Reach for it first to expand the host attack surface before live probing.

[recon] Fetch every URL the Wayback Machine recorded for a domain (passive). Reach for it alongside gau to recover historical endpoints and parameterized URLs without sending traffic to the target.

[recon] Probe a list of hosts/URLs for live HTTP(S) services and fingerprint them (status, title, tech, TLS). Reach for it to turn raw subdomains/ports into a confirmed live-web attack surface.

[recon/exploit] Fast reflected-XSS triage — reports which parameters reflect XSS-significant characters (<>"'`) unescaped. Reach for it to cheaply shortlist promising params before deep dalfox/xsstrike runs.

[recon] Deep port/service/version scanning and scripted enumeration of in-scope hosts. Reach for it after naabu to accurately fingerprint services, versions, and run safe NSE checks.

[recon/exploit] Template-driven vulnerability & misconfig scanner over live URLs (CVEs, exposures, default creds, takeovers). Reach for it for fast, broad, signature-based coverage once you have a live-host list.

[recon] Fingerprint whether a target sits behind a WAF/CDN and which product it is. Reach for it before active testing so you know to expect/throttle around filtering and plan bypasses.

[static-analysis] Scan lockfiles/SBOM/dependencies against the OSV database for known-vulnerable package versions. Reach for it in vuln-analysis to surface CVEs in third-party deps with fixed-version guidance.