메뉴
Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Binary analysis and reverse engineering workflow using checksec, strings, binwalk, radare2, ropgadget, and gdb for CTF and vulnerability research
Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images
Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell
Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools
Password hash identification, cracking, and credential brute-forcing using hashid, john, hashcat, hydra, medusa, and ophcrack
SMB and Windows network enumeration workflow using nmap, smbmap, enum4linux, netexec, and nbtscan for share discovery, user enumeration, and lateral movement
| name | web-recon |
| description | Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f |
Web reconnaissance workflow for NyxStrike. Use this skill when a user wants to find hidden directories, endpoints, virtual hosts, crawl a web application, or detect the tech stack and WAF.
Always check for a WAF first — it influences wordlist choice, rate, and evasion flags.
run_tool(tool="wafw00f", url="https://<target>")
If a WAF is detected, add evasion flags to subsequent tools (e.g. --random-agent, lower thread count).
Fingerprint live hosts, status codes, titles, and tech stack before brute-forcing.
run_tool(tool="httpx", target="<target>", probe=true, tech_detect=true, title=true, status_code=true)
Use the tech stack findings to choose targeted wordlists:
wp-content, wp-admin wordlists.php extensions.htaccess, server-statusFast sweep (ffuf) — preferred for vhost and parameter fuzzing as well:
run_tool(tool="ffuf", url="https://<target>/FUZZ",
wordlist="/usr/share/wordlists/dirb/common.txt",
match_codes="200,204,301,302,307,401,403")
Recursive discovery (feroxbuster) — use when you need deep recursive scanning:
run_tool(tool="feroxbuster", url="https://<target>",
wordlist="/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
threads=10)
Extension-aware scan (gobuster) — use when tech stack is known:
run_tool(tool="gobuster", url="https://<target>",
mode="dir",
wordlist="/usr/share/wordlists/dirb/common.txt",
additional_args="-x php,html,txt,bak")
Crawl the application for JS-embedded endpoints, forms, and parameters:
run_tool(tool="katana", url="https://<target>")
Feed discovered endpoints into vulnerability scanning (see web-vuln skill).
Use ffuf in vhost mode to discover hidden vhosts:
run_tool(tool="ffuf", url="https://<target>",
mode="vhost",
wordlist="/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt")
If WordPress is detected, run wpscan for plugin/theme vulns and user enumeration:
run_tool(tool="wpscan", url="https://<target>",
additional_args="--enumerate u,p,t --plugins-detection aggressive")
| Target type | Recommended wordlist |
|---|---|
| General dirs | /usr/share/wordlists/dirb/common.txt |
| Deep/thorough | /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt |
| Files | /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt |
| API endpoints | /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt |
| Backup files | /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt |
| Vhosts | /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt |
| Tool | Use case |
|---|---|
wafw00f | WAF detection |
httpx | HTTP probing, tech fingerprint |
ffuf | Fast fuzzing (dirs, vhosts, params) |
feroxbuster | Recursive content discovery |
gobuster | Extension-aware dir/file brute-force |
katana | Web crawling, JS endpoint extraction |
dirsearch | Alternative web path scanner |
wpscan | WordPress-specific enumeration |