메뉴
Use passive to expand domains/ICPs into cyberspace assets like IPs, URLs, ports via uncover (FOFA, Hunter, Shodan, Censys, etc.). Run before active scanners (gogo, spray, katana).
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use this skill when the agent needs to understand aiscan mechanisms, available capabilities, scanner pseudo-commands, and tool invocation rules.
Use this skill when working with proton for sensitive information scanning — detecting API keys, tokens, credentials, and secrets in files or piped data.
Use this skill to learn how to use the playwright pseudo-command for headless browsing, screenshots, network capture, and interactive vulnerability verification. Aligned with microsoft/playwright-cli conventions.
Use this skill when working with scan for the multi-stage aiscan pipeline across discovery, web probing, weak credentials, POC checks, and verification.
Use this skill when working with neutron for template-based POC execution, template filtering, and POC result analysis.
Use this skill when working with gogo for host, port, service, banner, fingerprint, or vulnerability-hint discovery.
| name | passive |
| description | Use passive to expand domains/ICPs into cyberspace assets like IPs, URLs, ports via uncover (FOFA, Hunter, Shodan, Censys, etc.). Run before active scanners (gogo, spray, katana). |
passive is an aiscan command backed by uncover for cyberspace search. Pick a source with -s.
| Source | Provider | Credential |
|---|---|---|
fofa | FOFA | recon.fofa_email + recon.fofa_key or env vars |
hunter | Hunter | recon.hunter_api_key or env HUNTER_API_KEY |
shodan | Shodan | env SHODAN_API_KEY |
shodan-idb | Shodan IDB | none |
censys | Censys | env CENSYS_API_TOKEN + CENSYS_ORGANIZATION_ID |
quake | Quake | env QUAKE_TOKEN |
zoomeye | ZoomEye | env ZOOMEYE_API_KEY |
netlas | Netlas | env NETLAS_API_KEY |
criminalip | CriminalIP | env CRIMINALIP_API_KEY |
publicwww | PublicWWW | env PUBLICWWW_API_KEY |
hunterhow | HunterHow | env HUNTERHOW_API_KEY |
binaryedge | BinaryEdge | env BINARYEDGE_API_KEY |
onyphe | Onyphe | env ONYPHE_API_KEY |
driftnet | Driftnet | env DRIFTNET_API_KEY |
greynoise | GreyNoise | env GREYNOISE_API_KEY |
Sources without credentials are silently skipped at init.
Additional sources can be configured via ~/.uncover-config/provider-config.yaml.
fofa, hunter, shodan, etc.)gogo, spray, katana, or neutron for active scanning.Skip passive when the user already provided concrete IPs or private ranges.
passive -s fofa 'domain="example.com"'
passive -s fofa 'icp="浙ICP备16020926号"'
passive -s hunter 'domain.suffix="example.com"'
passive -s shodan 'org:"Example"'
The positional argument is the source-native query string.
JSON array with rich fields:
[{"ip":"1.2.3.4","port":"443","url":"https://example.com","domain":"example.com","title":"Example","icp":"..."}]
JSON array with extra fields: status, company, frame:
[{"ip":"1.2.3.4","port":"443","url":"https://example.com","domain":"example.com","status":"200","company":"Example Inc","frame":"nginx","title":"Example","icp":"..."}]
Generic JSON array:
[{"ip":"1.2.3.4","port":"80","url":"http://example.com","host":"example.com","source":"shodan"}]
passive -s fofa 'icp="京ICP备xxx号"' → get IPs/URLsgogo / spray / katana → active scan discovered assetsrecon.proxy=socks5://... for Hunter from abroad.