소스 정보
- 저장소
- CyberStrikeus/CyberStrike
- 최근 소스 활동
- 2026년 4월 28일 23:54
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,653
- 포크
- 254
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-01명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-info-01 |
| description | Conduct Search Engine Discovery Reconnaissance for Information Leakage |
| category | information-gathering |
| owasp_id | WSTG-INFO-01 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["wstg-info-06","wstg-conf-01"] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-01
Conduct Search Engine Discovery Reconnaissance for Information Leakage
This test aims to identify sensitive information about the target organization that has been unintentionally exposed on the internet through search engines and cache services. When search engines index web pages, they may also index sensitive configuration files, internal documentation, user information, and other confidential data. This test gathers OSINT (Open Source Intelligence) from an attacker's perspective to uncover potential security risks.
Each search engine uses different indexing algorithms. Use multiple engines for comprehensive results:
| Search Engine | URL | Characteristics |
|---|---|---|
| google.com | Most comprehensive index | |
| Bing | bing.com | Microsoft ecosystem integration |
| DuckDuckGo | duckduckgo.com | Privacy-focused, aggregated results |
| Yandex | yandex.com | Russia-based, different perspective |
| Baidu | baidu.com | China-based |
site:target.com # Results only from target domain
site:target.com filetype:pdf # PDF files
site:target.com filetype:xlsx # Excel files
site:target.com filetype:docx # Word documents
site:target.com filetype:sql # SQL files
site:target.com filetype:log # Log files
site:target.com filetype:bak # Backup files
site:target.com filetype:conf # Config files
site:target.com filetype:env # Environment files
# Credential Leak Search
site:target.com intext:"password"
site:target.com intext:"username" intext:"password"
site:target.com intext:"api_key" OR intext:"apikey"
site:target.com intext:"secret_key" OR intext:"secretkey"
site:target.com filetype:env DB_PASSWORD
site:target.com intext:"BEGIN RSA PRIVATE KEY"
# Database and Backup
site:target.com filetype:sql "INSERT INTO"
site:target.com filetype:bak
site:target.com inurl:backup
site:target.com intitle:"index of" "backup"
# Error Messages and Debug
site:target.com intext:"error" intext:"warning"
site:target.com intext:"stack trace"
site:target.com intext:"SQL syntax"
site:target.com intext:"mysql_fetch"
site:target.com intext:"ORA-" (Oracle errors)
site:target.com intext:"pg_" intext:"error" (PostgreSQL)
# Admin and Config Panels
site:target.com inurl:admin
site:target.com inurl:login
site:target.com inurl:config
site:target.com intitle:"admin" OR intitle:"administrator"
site:target.com inurl:wp-admin (WordPress)
site:target.com inurl:phpmyadmin
# Development/Staging Environments
site:dev.target.com
site:test.target.com
site:staging.target.com
site:uat.target.com
site:preprod.target.com
# Subdomain Discovery
site:*.target.com
# Directory Listing
site:target.com intitle:"index of"
site:target.com intitle:"directory listing"
# Shodan Queries
hostname:target.com
org:"Target Organization"
ssl.cert.subject.cn:target.com
http.title:"Target Application"
# GitHub search
"target.com" password
"target.com" api_key
"target.com" secret
org:targetorg password
org:targetorg api_key
filename:.env "target"
filename:config.php "target.com"
| Tool | Description | Installation/Usage |
|---|---|---|
| theHarvester | Email, subdomain, host discovery | theHarvester -d target.com -b all |
| Recon-ng | Web reconnaissance framework | recon-ng |
| Maltego | OSINT and link analysis | GUI tool |
| SpiderFoot | Automated OSINT | spiderfoot -s target.com |
| Photon | Web crawler | python3 photon.py -u https://target.com |
| Google Dorking Tools | Automated dork queries | Pagodo, GooFuzz |
| Amass | Subdomain enumeration | amass enum -d target.com |
| Subfinder | Subdomain discovery | subfinder -d target.com |
| Service | URL | Purpose |
|---|---|---|
| Wayback Machine | web.archive.org | Historical data |
| Shodan | shodan.io | IoT/device search |
| Censys | censys.io | Internet-wide scanning |
| VirusTotal | virustotal.com | Domain intelligence |
| SecurityTrails | securitytrails.com | DNS history |
| DNSDumpster | dnsdumpster.com | DNS recon |
| crt.sh | crt.sh | Certificate transparency |
# Gather information from all sources
theHarvester -d target.com -b all
# Specific sources
theHarvester -d target.com -b google,bing,linkedin,twitter
# Save results to file
theHarvester -d target.com -b all -f output.html
# Passive enumeration
amass enum -passive -d target.com
# Active enumeration
amass enum -active -d target.com
# With brute force
amass enum -brute -d target.com -w wordlist.txt
# Save results
amass enum -d target.com -o results.txt
# Basic usage
subfinder -d target.com
# Verbose output
subfinder -d target.com -v
# Output to file
subfinder -d target.com -o subdomains.txt
# Recursive search
subfinder -d target.com -recursive
# Sensitive file types
site:target.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini
# Database files
site:target.com ext:sql | ext:dbf | ext:mdb
# Log files
site:target.com ext:log
# Backup files
site:target.com ext:bkf | ext:bkp | ext:bak | ext:old | ext:backup
# Password-containing files
site:target.com intext:password | intext:passwd filetype:txt | filetype:log | filetype:cfg
# phpinfo()
site:target.com ext:php intitle:phpinfo "published by the PHP Group"
# Authenticate with API key
shodan init YOUR_API_KEY
# Host search
shodan host target_ip
# Search
shodan search hostname:target.com
# Specific port
shodan search hostname:target.com port:22
# Fetch subdomains with curl
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
Sensitive Information Publication Policy
robots.txt Configuration
User-agent: *
Disallow: /admin/
Disallow: /config/
Disallow: /backup/
Disallow: /private/
Disallow: /*.sql$
Disallow: /*.bak$
Note: robots.txt does not provide security, it only guides well-behaved bots
Meta Tag Usage
<meta name="robots" content="noindex, nofollow" />
Authentication Controls
Search Engine Removal Tools
Regular Audits
Employee Training
Base Score: 5.3 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Accessible via internet |
| Attack Complexity | Low | No special skills required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No user interaction required |
| Scope | Unchanged | Impact scope unchanged |
| Confidentiality | Low | Limited information disclosure |
| Integrity | None | No integrity impact |
| Availability | None | No availability impact |
Note: CVSS score may vary based on the sensitivity of discovered information. Credential leaks can significantly increase the score (High/Critical).
| Discovered Information | Severity | Example |
|---|---|---|
| General info, public data | Info | Company address, general contact |
| Internal configuration | Low | Subdomain list |
| Potential attack vector | Medium | Admin panel URL, technology stack |
| Credential information | High | API key, password |
| Critical system access | Critical | Private key, admin credentials |
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Disclosure of sensitive information to unauthorized parties |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Adding sensitive info to externally accessible files |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | Disclosure of personal information to unauthorized parties |
| CWE-312 | Cleartext Storage of Sensitive Information | Storing sensitive information without encryption |
| CWE-615 | Inclusion of Sensitive Information in Source Code Comments | Sensitive information in source code comments |
[ ] Google dorking queries executed
[ ] Bing search queries executed
[ ] DuckDuckGo search queries executed
[ ] Shodan scan performed
[ ] Wayback Machine historical analysis completed
[ ] theHarvester OSINT gathered
[ ] Subdomain enumeration performed (Amass/Subfinder)
[ ] Certificate transparency check completed (crt.sh)
[ ] GitHub/GitLab code search performed
[ ] Pastebin/leak site check completed
[ ] Discovered sensitive information documented
[ ] Risk assessment completed
[ ] Remediation recommendations prepared