メニュー
[recon] Fetch every URL the Wayback Machine recorded for a domain (passive). Reach for it alongside gau to recover historical endpoints and parameterized URLs without sending traffic to the target.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | waybackurls |
| description | [recon] Fetch every URL the Wayback Machine recorded for a domain (passive). Reach for it alongside gau to recover historical endpoints and parameterized URLs without sending traffic to the target. |
waybackurls (tomnomnom, Go). Pulls all URLs the Internet Archive's Wayback
Machine has for a host. Single-source and minimal by design; run it together with
gau (which adds Common Crawl/OTX/URLScan) for fuller coverage.
waybackurls <domain> or domains on stdin (no resolution, no probing).--dates prefix each URL with its archive timestamp.--no-subs restrict to the exact host (default includes subdomains).sort -u, grep, unfurl.# Wayback URLs for the host, keep parameterized ones, de-dup
waybackurls target.example.com | grep '?' | sort -u > wayback-params.txt
# Combine with gau for broader history:
# cat wayback-params.txt gau-params.txt | sort -u > all-historical.txt