원클릭으로 Manus에서 모든 스킬 실행

recon-osint

스타3

포크1

업데이트2026년 6월 25일 18:14

Passive and active reconnaissance, open-source intelligence gathering, subdomain enumeration, DNS analysis, and attack surface mapping for penetration testing engagements. Use this skill whenever the user mentions recon, reconnaissance, OSINT, subdomain enumeration, attack surface mapping, target profiling, DNS enumeration, email harvesting, domain intelligence, footprinting, information gathering, or "what can we find about this target". Also trigger for: theHarvester, subfinder, amass, spiderfoot, whois lookup, Shodan recon, passive recon, active recon, external recon, scope discovery, asset discovery, technology fingerprinting, whatweb, or any request to enumerate or profile a target before vulnerability scanning begins. This is the first phase of any pentest engagement — always trigger it when a new target or engagement scope is introduced.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

az0307

az0307/Aurora-AI-Agency

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

관련 직업SOC

SOC 직업 분류 기준

정보 보안 분석가컴퓨터 및 수학직·SOC 15-1212

SKILL.md

readonly

이 저장소의 다른 Skills

같은 저장소

active-directory

az0307/Aurora-AI-Agency

Active Directory and Windows domain attack techniques including domain enumeration, Kerberos attacks, credential relay, lateral movement, and domain privilege escalation for internal penetration testing engagements. Use this skill whenever the user mentions Active Directory, AD attacks, domain enumeration, BloodHound, Kerberoasting, AS-REP roasting, pass the hash, pass the ticket, overpass the hash, golden ticket, silver ticket, DCSync, DCShadow, NTDS.dit extraction, LDAP enumeration, domain controller, Group Policy abuse, ACL abuse, delegation abuse, constrained delegation, unconstrained delegation, resource-based constrained delegation, ADCS attacks, certificate abuse, LAPS, gMSA, domain trust attacks, forest trust, or any Windows domain-focused penetration testing activity. Also trigger for: impacket, crackmapexec, evil-winrm, bloodhound-python, kerbrute, responder, ntlmrelayx, petitpotam, certipy, rubeus, mimikatz, powerview, sharphound, enum4linux, smbclient, rpcclient, "enumerate the domain", "dump doma

2026-06-253

audit-logger

az0307/Aurora-AI-Agency

Security engagement audit logging, evidence chain management, and compliance trail for penetration testing. Use this skill whenever the user mentions audit log, audit trail, engagement logging, evidence collection, chain of custody, compliance logging, pentest logging, tool execution logging, JSONL log, activity log, forensic evidence, engagement timeline, or any request to log, track, or document security testing activities. Also trigger for: "log this action", "create audit trail", "evidence chain", "what did we do", "engagement timeline", "export activity log", or when any other security skill needs to record its actions for compliance. This skill is called BY other skills — it is the universal logging layer.

2026-06-253

credential-attack

az0307/Aurora-AI-Agency

Password cracking, credential brute force, hash analysis, and authentication testing for penetration testing engagements. Use this skill whenever the user mentions password cracking, hash cracking, brute force attack, credential spraying, password spray, dictionary attack, hashcat, john the ripper, hydra, medusa, credential stuffing, NTLM hash, NTHash, NetNTLMv2, Kerberos ticket cracking, AS-REP roasting, Kerberoasting, hash identification, rainbow tables, wordlist generation, custom wordlists, CeWL, crunch, cupp, password policy analysis, or any request to crack, guess, or test credentials. Also trigger for: "crack these hashes", "brute force this login", "test default credentials", "generate a wordlist", "what hash type is this", "password audit", or any credential-related testing activity. Expert tools: hashcat (GPU), john (CPU), hydra (online brute force), crackmapexec (network cred testing), medusa (parallel brute force).

2026-06-253

ctf-walkthrough

az0307/Aurora-AI-Agency

Generate structured CTF walkthrough writeups from engagement data, findings, and attack paths. Use this skill whenever the user mentions CTF writeup, walkthrough, write-up, CTF solution, box writeup, challenge writeup, HackTheBox writeup, TryHackMe writeup, "write up this box", "document how I solved", "create a walkthrough for", or any request to document a CTF/lab solution in educational format. Also trigger for: "writeup for HTB", "THM walkthrough", "document the attack path", "how did we solve this", or when red-team-report is called with engagement type CTF. Produces clean Markdown writeups with technique explanations, command output, and learning notes — suitable for blog posts or portfolio.

2026-06-253

exploit-dev

az0307/Aurora-AI-Agency

Exploit research, proof-of-concept development, controlled exploitation, and initial access verification for penetration testing engagements. Use this skill whenever the user mentions exploit development, PoC creation, Metasploit module execution, searchsploit, payload generation, msfvenom, exploit testing, vulnerability exploitation, initial access, shell access, reverse shell, bind shell, exploit chain, privilege escalation exploits, buffer overflow, web shell upload, or "can we exploit this finding". Also trigger for: ExploitDB search, Metasploit framework usage, custom exploit writing, payload encoding, exploit adaptation, weaponization, or any request to move from identified vulnerability to confirmed access. This is phase three of a pentest — trigger after vuln-analysis confirms exploitable findings, or standalone when the operator has a specific CVE. CRITICAL: All exploitation requires human approval before execution. The AI prepares commands and payloads but the operator confirms each run.

2026-06-253

network-forensics

az0307/Aurora-AI-Agency

Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).

2026-06-253

name	recon-osint
description	Passive and active reconnaissance, open-source intelligence gathering, subdomain enumeration, DNS analysis, and attack surface mapping for penetration testing engagements. Use this skill whenever the user mentions recon, reconnaissance, OSINT, subdomain enumeration, attack surface mapping, target profiling, DNS enumeration, email harvesting, domain intelligence, footprinting, information gathering, or "what can we find about this target". Also trigger for: theHarvester, subfinder, amass, spiderfoot, whois lookup, Shodan recon, passive recon, active recon, external recon, scope discovery, asset discovery, technology fingerprinting, whatweb, or any request to enumerate or profile a target before vulnerability scanning begins. This is the first phase of any pentest engagement — always trigger it when a new target or engagement scope is introduced.
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander","shodan","hexstrike"],"skills":["ai-agent-orchestration","vuln-analysis"]}

ReconOSINT Skill

Overview

Performs passive and active reconnaissance against authorized targets to build a complete picture of the attack surface. Produces structured intelligence including subdomains, open ports, running services, technology stacks, email addresses, and OSINT findings. Output feeds directly into the VulnAnalysis skill.

Prerequisites

Scope authorization confirmed — never run without explicit written scope
Target must be an IP, domain, or CIDR range within authorized scope
Shodan API key configured (free tier works for CVE/IP lookup)
Kali tools installed: subfinder, amass, theHarvester, whatweb, nmap, whois, dig

Core Instructions

Step 1 — Validate Scope

Before ANY tool execution, confirm:

Target is within the authorized scope boundaries
Engagement type is defined (external/internal/web app/red team/CTF)
Rules of engagement have been acknowledged by the operator

If scope is not confirmed, STOP and ask the operator. Do not proceed.

Step 2 — Passive Reconnaissance (no direct target contact)

Run these in parallel where possible:

# DNS and domain intel
whois {target_domain}
dig {target_domain} ANY +noall +answer
dig {target_domain} -t MX +short
dig {target_domain} -t TXT +short
dig {target_domain} -t NS +short

# Subdomain enumeration (passive)
subfinder -d {target_domain} -silent -o /tmp/pentest/{target}/subdomains_passive.txt

# Email and metadata harvesting
theHarvester -d {target_domain} -b all -f /tmp/pentest/{target}/harvest.json

# Shodan (via MCP or CLI)
# MCP: shodan.search_host({target_ip}) or shodan.search_query("hostname:{target_domain}")
# CLI: shodan host {target_ip}

Step 3 — Active Reconnaissance (direct target contact — scope required)

Only proceed if engagement type permits active scanning:

# Technology fingerprinting
whatweb {target_url} --log-json=/tmp/pentest/{target}/whatweb.json

# Port scanning (top 1000 first, expand if needed)
nmap -sV -sC --top-ports 1000 -oA /tmp/pentest/{target}/nmap_initial {target}

# Full port scan if initial reveals interesting services
nmap -sV -p- -T4 -oA /tmp/pentest/{target}/nmap_full {target}

# Active subdomain enumeration
amass enum -d {target_domain} -o /tmp/pentest/{target}/subdomains_active.txt

# Combine and deduplicate subdomains
sort -u /tmp/pentest/{target}/subdomains_passive.txt \
       /tmp/pentest/{target}/subdomains_active.txt \
       > /tmp/pentest/{target}/subdomains_all.txt

Step 4 — OSINT Deep Dive (optional, for red team engagements)

# SpiderFoot automated OSINT (long-running)
spiderfoot -s {target_domain} -t EMAILADDR,DOMAIN_NAME,IP_ADDRESS -q

# Google dorking targets (manual — provide dork list to operator)
# site:{target_domain} filetype:pdf
# site:{target_domain} inurl:admin
# site:{target_domain} intitle:"index of"

Step 5 — Consolidate and Structure Output

Parse all tool outputs into the standard recon output format (see below). Highlight:

Highest-value subdomains (admin panels, APIs, staging environments)
Exposed services on non-standard ports
Technology stack with known CVE associations
Email addresses for potential social engineering vectors
Any default credentials or information disclosure findings

HexStrike MCP Integration

If HexStrike is available on localhost:8888:

Tool: recon_target
Args: { "target": "{domain_or_ip}", "mode": "passive" | "active" }
Returns: { subdomains[], open_ports[], technologies[], emails[], whois: {} }

If Shodan MCP is available:

Tool: shodan.search_host / shodan.get_host_info
Args: { "ip": "{target_ip}" }
Returns: { ports[], vulns[], services[], location: {} }

Output Format

{
  "target": "example.com",
  "engagement_id": "ENG-2026-001",
  "recon_type": "passive+active",
  "timestamp": "2026-03-17T10:00:00Z",
  "subdomains": ["admin.example.com", "api.example.com", "staging.example.com"],
  "dns_records": {
    "A": ["93.184.216.34"],
    "MX": ["mail.example.com"],
    "NS": ["ns1.example.com"],
    "TXT": ["v=spf1 include:_spf.google.com ~all"]
  },
  "open_ports": [
    {"port": 80, "service": "http", "version": "nginx 1.24.0"},
    {"port": 443, "service": "https", "version": "nginx 1.24.0"},
    {"port": 22, "service": "ssh", "version": "OpenSSH 8.9"}
  ],
  "technologies": ["nginx", "PHP 8.1", "WordPress 6.4", "MySQL"],
  "emails": ["admin@example.com", "dev@example.com"],
  "findings": [
    {
      "severity": "info",
      "title": "WordPress detected",
      "detail": "WordPress 6.4 on /blog/ — check for plugin vulnerabilities",
      "next_step": "vuln-analysis"
    }
  ],
  "files": {
    "nmap_output": "/tmp/pentest/example.com/nmap_initial.xml",
    "subdomains": "/tmp/pentest/example.com/subdomains_all.txt",
    "harvest": "/tmp/pentest/example.com/harvest.json"
  }
}

Handoff to Next Skill

When recon is complete, pass the structured output to vuln-analysis:

{
  "skill": "VulnAnalysis",
  "params": {
    "targets": ["subdomains_all.txt entries + open ports"],
    "technologies": ["from recon output"],
    "recon_data": "{path_to_recon_json}"
  }
}

Output Checklist

Scope validated before any tool execution
Passive recon completed (whois, DNS, subfinder, theHarvester)
Active recon completed if authorized (nmap, whatweb, amass)
All outputs saved to /tmp/pentest/{target}/ directory
Structured JSON output produced
High-value findings highlighted with severity
Handoff data prepared for vuln-analysis skill