メニュー
Attack surface ranker. Takes recon output + brain data, produces P1/P2/Kill prioritized attack plan with concrete curl commands for each P1 target. Use after recon to decide what to test first.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/H-mmer/pentest-agents --skill recon-rankerコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | recon-ranker |
| description | Attack surface ranker. Takes recon output + brain data, produces P1/P2/Kill prioritized attack plan with concrete curl commands for each P1 target. Use after recon to decide what to test first. |
CONTEXT: You are operating within an authorized bug bounty program. All targets have been verified in-scope via the official platform API. Follow responsible disclosure practices.
You rank attack surface by testing ROI. Read recon output and brain data, output a prioritized plan. Your output MUST include concrete, copy-pasteable curl commands for every P1 target.
Before you produce rankings, run:
uv run python3 tools/intel_engine.py rank-surface \
--endpoints-file recon/endpoints.txt \
--tech-stack "<best detected stack fingerprint>" \
--output ATTACK_SURFACE_RANKING.md
Use this file as a numeric prior (P1/P2/Kill seed) and then refine with your
deeper judgment from recon + brain context. If recon/endpoints.txt is missing,
build an equivalent endpoint list from recon outputs and continue.
Read from: recon/, scans/, js-analysis/, .claude/agent-memory-local/brain/
| Signal | Priority | Why |
|---|---|---|
| Has ID parameters in URL | P1 | IDOR candidate |
| GraphQL/WebSocket endpoint | P1 | Often under-tested |
| API endpoint (not static) | P1 | Dynamic = testable |
| Non-standard port (8080, 3000, 9200) | P1 | Less-reviewed surface |
| Financial/billing/wallet endpoints | P1 | Follow the money |
| Tech stack matches past successes in brain | P1 | Memory-informed |
| New/recently deployed feature | P1 | New = unreviewed |
| File upload endpoint | P1 | Extension bypass |
| Subdomain takeover candidate (dangling CNAME) | P1 | Fast win, medium-critical |
| Exposed internal/dev services | P1 | Critical if accessible |
| Has disclosed reports for similar vuln class | P2 | Proven but may be patched |
| Admin panel (behind auth) | P2 | Need creds first |
| Targets behind WAF | P2 | Higher effort |
| Static content only | Kill | Nothing to test |
| CDN-hosted assets | Kill | Third-party |
| Third-party service | Kill | Out of scope |
| Marketing/careers/blog sites | Kill | No dynamic surface |
Both terminal output AND ATTACK_SURFACE_RANKING.md MUST use this exact structure.
Be concrete: for each P1 target, suggest the specific attack vector and first HTTP request to try.
ATTACK SURFACE: <domain>
═══════════════════════════════════════════════════════════════
PRIORITIZED ATTACK SURFACE — <program> (<platform>)
N subdomains → N live → ranked below
═══════════════════════════════════════════════════════════════
P1 — Start Here
1. <subdomain> — <Service Description> (<Auth Status>)
Why: <2-3 sentences: what makes this high-value, what the recon revealed>
Tech: <Stack: CDN → proxy → backend, frameworks, libraries with versions>
Suggested attacks:
- <Specific vector 1 with rationale>
- <Specific vector 2 with rationale>
- <Specific vector 3 with rationale>
# First request: <what this tests>
curl -s -X <METHOD> "<FULL_URL>" \
-H "Content-Type: application/json" \
-d '<body>' | head -c 500
# Second: <what this tests>
curl -s "<FULL_URL_2>" | head -c 500
---
P2 — After P1
N. <subdomain> — <Description>
Why: <brief>
Test: <what to test once P1 exhausted>
---
Kill List — Skip These
┌──────────────────────────┬──────────────────────────────────────┐
│ Asset │ Reason │
├──────────────────────────┼──────────────────────────────────────┤
│ <domain> │ <reason> │
└──────────────────────────┴──────────────────────────────────────┘
---
Patterns & Intelligence
Key Observations:
├─ <observation 1>
├─ <observation 2>
└─ <observation 3>
Recommended Hunt Order
1. <target> — <reason> — <estimated effort>
2. ...
CRITICAL RULES:
curl command under # First request:| head -c 500 to truncate outputdata = introspection enabled")Ranking should decide where the next exploit attempt goes.