메뉴
External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan. Outputs to Attack-surface.md and scope/. Queries wiki before each phase. Use when starting recon on any target.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/Encod3d-Sec/TORCH --skill wiki-recon명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
CTF challenge router - fingerprint a challenge (file type / prompt / artifacts) into its category (pwn, rev, crypto, forensics, stego, web, osint, hash) and route to the matching wiki page, tools, and first moves. Wiki-first.
Adaptive, targeted web fuzzing - deterministic wordlist selection (wl-pick.sh) plus judgment. Picks the right SecLists list per surface (content/vhost/api/params/artifacts) smallest-first, calibrates filters against soft-404s, recurses, escalates T0 harness -> T1 seclists -> T2 cewl -> T3 app-specific on signal, pivots to hidden-param fuzzing, and detects/handles WAF/Cloudflare/throttle (backoff, origin-bypass, or hard STOP on the DoS tell). Engagement-type aware (ctf loud, pt calibrated, bb stealth). Use for "fuzz", "content discovery", "directory brute", "vhost fuzz", "find hidden params", "which wordlist", "gobuster/ffuf/feroxbuster/cewl/arjun".
Auth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output.
SOC 직업 분류 기준
| name | wiki-recon |
| description | External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan. Outputs to Attack-surface.md and scope/. Queries wiki before each phase. Use when starting recon on any target. |
qmd_query "recon subdomain enumeration" via wiki-search MCP -> read matching pages.
qmd_query "OSINT external attack surface" -> apply known techniques.
If no matching page: proceed. Do not block on missing wiki coverage. Dorks to find exposed/vulnerable assets: wiki/cheatsheets/recon-dorks.md; attack paths once in: wiki/cheatsheets/attack-chains.md.
Tool-first: subfinder/assetfinder for subdomains, httpx for live-host probing, katana/gau for URLs, ffuf for content discovery, nuclei for templated checks. The crt.sh curl below is the one hand request kept (a passive source with no tool wrapper); everywhere else lean on the tool, not a curl loop.
TARGET="target.com"
RECON_DIR="poc/recon/$TARGET"
mkdir -p $RECON_DIR
# Passive sources
curl -s "https://crt.sh/?q=%.${TARGET}&output=json" \
| jq -r | sed | -u > /subs.txt
subfinder -d -silent | -a /subs.txt
assetfinder --subs-only | -a /subs.txt
-u /subs.txt -o /subs.txt
cat $RECON_DIR/subs.txt | dnsx -silent | \
httpx -silent -status-code -title -tech-detect | tee $RECON_DIR/live.txt
On any TLS host from Stage 2, dump the cert SANs early; a hidden vhost none of the above discovers can be listed only in the Subject Alternative Name, see [[cdn-waf-bypass]].
cat $RECON_DIR/live.txt | awk '{print $1}' | \
katana -d 3 -jc -kf all -silent | tee $RECON_DIR/urls.txt
echo $TARGET | waybackurls | tee -a $RECON_DIR/urls.txt
gau $TARGET --subs | tee -a $RECON_DIR/urls.txt
sort -u $RECON_DIR/urls.txt -o $RECON_DIR/urls.txt
nuclei -l $RECON_DIR/live.txt -t ~/nuclei-templates/ \
-severity critical,high,medium -o $RECON_DIR/nuclei.txt
# Content discovery on live hosts: OUR high-signal list first (non-obvious routes the crawl missed)
ffuf -c -u https://HOST/FUZZ -w scripts/wordlists/harness-paths.txt -e .php,.py -mc 200,301,302,401,403 -ac
# High-value URL patterns
cat $RECON_DIR/urls.txt | grep -E "\?.*=" | grep -E "url=|redirect=|src=|dest=|fetch=" > $RECON_DIR/ssrf_candidates.txt
cat $RECON_DIR/urls.txt | grep -E "\?.*=" | grep -E "id=|user_id=|order_id=|doc_id=" > $RECON_DIR/idor_candidates.txt
cat $RECON_DIR/urls.txt | grep -E "graphql|/gql|/graph" > $RECON_DIR/graphql_candidates.txt
cat $RECON_DIR/urls.txt | grep -E "upload|import|parse|convert|preview|render" > $RECON_DIR/upload_candidates.txt
# JS secret scanning
cat $RECON_DIR/urls.txt | grep "\.js$" | \
xargs -I {} curl -sk {} | grep -E "(api_key|apikey|secret|token|password|credential).*['\"][A-Za-z0-9+/]{20,}" \
> $RECON_DIR/js_secrets.txt
READ each app .js / inline <script> / button onclick / href END-TO-END, do not stop at the grep.
The secret-scan above only surfaces hardcoded keys; the initial attack vector (an AJAX handler POSTing to
an undocumented endpoint, a commented route, a hidden param) hides in code the grep filters out. Open every
first-party bundle and read it top to bottom, grep only to LOCATE inside a large file, then read the block.
A page that looks like a static template is often a dynamic app whose whole endpoint map lives in one JS file.
Run each scan in its own tmux tab on the VM (root, persistent), one tab per target: bash scripts/vm-scan.sh <eng> <target> '<scan>' (multi-web target -> <target>-web-<ip-or-domain>). Capture a live/finished tab with Skill(screenshot) --tmux <eng>:<tab> (use the @NN id or sanitized tab name it prints). Capture standalone tool output (nmap service surface, ffuf/feroxbuster hits, nuclei findings) as terminal-card PNGs via Skill(screenshot) --term for the Attack-surface evidence.
For each discovered live host, add a row to the target's Attack-surface.md:
| sub.target.com | 1.2.3.4 | [status] | - | [finding or notes] |
Add newly discovered hosts to scope/ IP/domain lists.
Record recon progress in targets/<eng>/Approach.md Phase 1 items.
If nuclei finds CRITICAL or HIGH severity issues: create a FIND-XXX entry immediately.
Distill to wiki (when confirmed): if a novel subdomain takeover or recon-bypass technique is found, stage a GENERIC wiki candidate now (no client host): python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/osint/web-attack-surface.md. Promote later via scripts/wiki-promote.py.