Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-10Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
SKILL.md wird angezeigt
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
| name | wstg-info-10 |
| description | Map Application Architecture |
| category | information-gathering |
| owasp_id | WSTG-INFO-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-10
Map Application Architecture
Mapping application architecture involves identifying all components that make up the application infrastructure, including web servers, application servers, databases, load balancers, CDNs, firewalls, and security devices. Understanding the architecture helps penetration testers identify scope boundaries, potential attack vectors, and provide meaningful security recommendations. This reconnaissance phase reveals how different components interact and where security controls are implemented.
# HTTP headers analysis
curl -sI https://target.com | grep -i server
# Detailed fingerprinting
nmap -sV -p 80,443 target.com
# WhatWeb
whatweb https://target.com
| Pattern | Platform |
|---|---|
| *.azurewebsites.net | Azure App Service |
| *.herokuapp.com | Heroku |
| *.appspot.com | Google App Engine |
| *.elasticbeanstalk.com | AWS Elastic Beanstalk |
| *.cloudfunctions.net | Google Cloud Functions |
# Check DNS for cloud indicators
dig target.com
dig target.com CNAME
# Analyze response headers
curl -sI https://target.com | grep -iE 'x-azure|x-amz|x-goog|x-heroku'
| Header | Platform |
|---|---|
| X-Amz-Cf-Id | AWS CloudFront |
| X-Amz-Request-Id | AWS API Gateway |
| X-Amz-Invocation-Type | AWS Lambda |
| X-Ms-Request-Id | Azure Functions |
| Server: Kestrel | Azure/.NET |
| X-Cloud-Trace-Context | Google Cloud |
# Port scanning for databases
nmap -sV -p 3306,5432,1433,1521,27017,6379,9200 target.com
# Database ports
# 3306 - MySQL
# 5432 - PostgreSQL
# 1433 - MSSQL
# 1521 - Oracle
# 27017 - MongoDB
# 6379 - Redis
# 9200 - Elasticsearch
| Error Pattern | Database |
|---|---|
| "MySQL server" | MySQL |
| "PostgreSQL" | PostgreSQL |
| "ORA-" | Oracle |
| "Microsoft SQL Server" | MSSQL |
| "MongoDB" | MongoDB |
# Trigger errors to identify database
curl -s "https://target.com/api?id='"
curl -s "https://target.com/api?id=1 OR 1=1"
# Multiple requests to detect variations
for i in {1..10}; do
echo "=== Request $i ==="
curl -sI https://target.com | grep -iE 'server|date|x-|set-cookie'
sleep 1
done
# Look for load balancer cookies
curl -sI https://target.com | grep -i 'set-cookie'
| Indicator | Load Balancer |
|---|---|
| BIGipServer cookie | F5 BIG-IP |
| AWSALB/AWSALBCORS cookie | AWS ALB |
| X-Amz-Cf-Id header | AWS CloudFront |
| X-Cache header | Various |
| Via header | Proxy/LB |
| Inconsistent Server headers | Multiple backends |
| Varying response times | Distribution |
# WHOIS lookup on resolved IP
dig +short target.com | xargs whois | grep -i 'org-name\|netname'
# Check known CDN ranges
curl -sI https://target.com | grep -iE 'cf-ray|x-cdn|x-cache|x-amz-cf|akamai|fastly|cloudflare'
| Header/Pattern | CDN |
|---|---|
| CF-Ray | Cloudflare |
| X-Amz-Cf-Id | AWS CloudFront |
| X-Akamai-* | Akamai |
| X-Fastly-* | Fastly |
| X-CDN | Generic CDN |
| Server: cloudflare | Cloudflare |
# Look for proxy indicators
curl -sI https://target.com | grep -iE 'via|x-forwarded|x-real-ip|x-proxy'
# Check for header mismatches
# e.g., nginx Server header but ASP.NET errors
Via header presentX-Forwarded-For header accepted# Test with common attack patterns
curl -s "https://target.com/?id=<script>alert(1)</script>"
curl -s "https://target.com/?id=' OR 1=1--"
curl -s "https://target.com/?id=../../../etc/passwd"
# Check response for WAF signatures
curl -sI "https://target.com/?id=<script>" | grep -iE 'waf|firewall|blocked|forbidden'
| Response/Header | WAF |
|---|---|
| "Blocked by Cloudflare" | Cloudflare |
| "ModSecurity" | ModSecurity |
| "Request blocked" | Various |
| "AWS WAF" | AWS WAF |
| X-Sucuri-ID | Sucuri |
| X-CDN: Imperva | Imperva |
# Check for authentication headers
curl -sI https://target.com/admin | grep -i 'www-authenticate'
# Look for SSO indicators
curl -s https://target.com/login | grep -iE 'saml|oauth|openid|sso|adfs'
# Check for MFA indicators
curl -s https://target.com/login | grep -iE 'mfa|2fa|authenticator|otp'
| Pattern | Mechanism |
|---|---|
| WWW-Authenticate: Basic | HTTP Basic Auth |
| WWW-Authenticate: NTLM | NTLM/AD |
| WWW-Authenticate: Negotiate | Kerberos |
| /adfs/ in URL | ADFS |
| accounts.google.com redirect | Google OAuth |
| login.microsoftonline.com | Azure AD |
# Look for API gateway patterns
curl -s https://target.com/api/ | head -20
# Check for service mesh headers
curl -sI https://target.com | grep -iE 'x-envoy|x-istio|x-b3'
# Different error formats suggest different services
curl -s "https://target.com/api/users/invalid"
curl -s "https://target.com/api/orders/invalid"
Create a visual representation:
[Internet]
|
[Cloudflare CDN/WAF]
|
[AWS ALB]
/ \
[nginx] [nginx]
| |
[Node.js API] [Node.js API]
| |
[Redis Cache] |
\ /
[PostgreSQL]
|
[S3 Storage]
| Tool | Description | Usage |
|---|---|---|
| Nmap | Port/service scanner | nmap -sV -p- target.com |
| Masscan | Fast port scanner | masscan -p1-65535 target.com |
| Shodan | Internet-wide scanning | shodan host target_ip |
| Tool | Description | Usage |
|---|---|---|
| WhatWeb | Technology detection | whatweb target.com |
| Wappalyzer | Stack identification | Browser extension |
| httpx | HTTP probing | httpx -tech-detect |
| Tool | Description | Usage |
|---|---|---|
| dig | DNS lookup | dig target.com ANY |
| whois | Registration info | whois target.com |
| traceroute | Network path | traceroute target.com |
| Tool | Description | Usage |
|---|---|---|
| wafw00f | WAF fingerprinting | wafw00f https://target.com |
| nmap http-waf-detect | WAF detection | nmap --script http-waf-detect |
#!/bin/bash
TARGET=$1
echo "=== ARCHITECTURE MAPPING ==="
echo "Target: $TARGET"
echo ""
# DNS Resolution
echo "[+] DNS Information..."
echo "A Records:"
dig +short $TARGET
echo ""
echo "CNAME Records:"
dig +short $TARGET CNAME
echo ""
echo "MX Records:"
dig +short $TARGET MX
echo ""
echo "NS Records:"
dig +short $TARGET NS
echo ""
# WHOIS (IP)
echo "[+] IP WHOIS..."
IP=$(dig +short $TARGET | head -1)
whois $IP | grep -iE 'org-name|netname|country|descr' | head -10
echo ""
# HTTP Headers
echo "[+] HTTP Headers..."
curl -sI "https://$TARGET" | grep -iE 'server|x-powered|x-cache|cf-ray|via|x-amz|set-cookie'
echo ""
# WAF Detection
echo "[+] WAF Detection..."
wafw00f "https://$TARGET" 2>/dev/null
echo ""
# Port Scan (common ports)
echo "[+] Port Scan..."
nmap -sV -p 80,443,8080,8443,3306,5432,1433,27017,6379 $TARGET
echo ""
# Technology Detection
echo "[+] Technology Stack..."
whatweb -q "https://$TARGET"
echo ""
# Load Balancer Detection
echo "[+] Load Balancer Check..."
for i in 1 2 3; do
echo "Request $i:"
curl -sI "https://$TARGET" | grep -i 'server\|date' | head -2
sleep 1
done
echo ""
echo "[+] Mapping Complete"
# Install
pip install wafw00f
# Basic detection
wafw00f https://target.com
# List all detectable WAFs
wafw00f -l
# Verbose output
wafw00f -v https://target.com
# Service detection
nmap -sV -sC target.com
# HTTP enumeration
nmap --script http-enum,http-headers,http-methods target.com
# SSL/TLS analysis
nmap --script ssl-enum-ciphers -p 443 target.com
# Database detection
nmap -sV -p 3306,5432,1433,1521,27017 target.com
# nginx - Hide server version
server_tokens off;
# Hide backend details
proxy_hide_header X-Powered-By;
proxy_hide_header Server;
[Internet]
|
[DMZ - Web Servers]
|
[Internal - Application Servers]
|
[Restricted - Database Servers]
Maintain accurate architecture documentation:
This is a reconnaissance activity, not a direct vulnerability.
Base Score: 5.3 (Medium) - for information disclosure
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Finding | Severity | Impact |
|---|---|---|
| Architecture visible | Info | Reconnaissance data |
| Database ports exposed | High | Direct attack vector |
| No WAF detected | Medium | Reduced protection |
| Admin interfaces exposed | High | Attack target |
| Internal IPs disclosed | Medium | Network mapping |
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information | Architecture disclosure |
| CWE-16 | Configuration | Network misconfig |
| CWE-693 | Protection Mechanism Failure | Missing security layers |
[ ] DNS records analyzed
[ ] WHOIS information gathered
[ ] Web server identified
[ ] Application server identified
[ ] Database type determined
[ ] Load balancer detected
[ ] CDN identified
[ ] Reverse proxy detected
[ ] WAF detection performed
[ ] Cloud platform identified
[ ] PaaS/Serverless indicators checked
[ ] Authentication mechanism identified
[ ] Network path traced
[ ] Security components mapped
[ ] Architecture diagram created
[ ] Scope boundaries documented