원클릭으로 Manus에서 모든 스킬 실행

webcopilot

스타0

포크0

업데이트2026년 4월 10일 10:44

Automated web security reconnaissance and vulnerability scanning using WebCopilot. Enumerates subdomains, crawls endpoints, filters vulnerability parameters (XSS, SQLi, SSRF, LFI, RCE, Open Redirect), and scans with nuclei/dalfox/sqlmap.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

stevengonsalvez

stevengonsalvez/nanoclaw-standalone

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

WebCopilot — Automated Web Recon & Vuln Scanner

What It Does

WebCopilot chains 20+ security tools into a single automated pipeline:

Subdomain enumeration — assetfinder, subfinder, amass, findomain, crt.sh
Active subdomain brute — gobuster with SecLists DNS wordlists
Live host filtering — dnsx + httpx (titles, screenshots)
Subdomain takeover check — subjack
Endpoint crawling — gau, waybackurls, waymore
Parameter filtering — gf patterns for XSS, SQLi, SSRF, LFI, RCE, Open Redirect
Vulnerability scanning — dalfox (XSS), nuclei (CVEs), sqlmap (SQLi), crlfuzz (CRLF)

Prerequisites

All tools are installed at ~/go/bin/ and system PATH. Verify with:

webcopilot -v

Tool Locations

Go tools: ~/go/bin/ (subfinder, nuclei, httpx, dalfox, amass, etc.)
Python tools: sqlmap, waymore (pip3)
gf patterns: ~/.gf/*.json (14 patterns)
Wordlists: ~/wordlists/SecLists/Discovery/DNS/
WebCopilot script: ~/go/bin/webcopilot

Usage

Quick subdomain enum only (default)

webcopilot -d target.com

Full scan (subdomain enum + vuln scanning)

webcopilot -d target.com -a

Full scan with output dir and blind XSS server

webcopilot -d target.com -a -o target-results -t 200 -b your-bxss-server.oast.fun

Scan with pre-collected subdomains (skip enum)

webcopilot -d target.com -f subdomains.txt -a

Exclude out-of-scope domains

webcopilot -d target.com -a -x exclude.txt

Flags

Flag	Description	Default
`-d`	Target domain	Required
`-o`	Output directory	`webcopilot-<domain>`
`-t`	Number of threads	100
`-b`	Blind XSS server URL	None
`-x`	File with excluded domains	None
`-f`	File with subdomains (skips enum)	None
`-a`	Run ALL scans (not just enum)	Off
`-v`	Show version	—

⚠️ Important Notes

Requires root for some network operations — use sudo when needed
Time consuming — full -a scan can take hours on large targets
Legal: Only scan domains you own or have explicit authorization for
BXSS: Use https://app.interactsh.com/ for blind XSS callback server
Output: All results saved to the output directory with per-tool subdirs

Individual Tool Usage

You can also use the installed tools individually:

# Quick subdomain enum
subfinder -d target.com -silent | sort -u

# Nuclei template scan
nuclei -u https://target.com -t cves/

# XSS scan with dalfox
echo "https://target.com/page?q=test" | dalfox pipe

# HTTP probing
cat subdomains.txt | httpx -silent -title -status-code

이 저장소의 다른 Skills

같은 저장소

argus

stevengonsalvez/nanoclaw-standalone

Argus — all-in-one information gathering & reconnaissance toolkit. 135 modules covering network infrastructure, web app analysis, and security/threat intelligence. Use for domain recon, subdomain enum, SSL analysis, tech stack detection, vulnerability scanning, and OSINT.

2026-04-100

bitwarden

stevengonsalvez/nanoclaw-standalone

Manage secrets via Bitwarden CLI (bw). Use when pulling secrets into a shell session, creating/updating Secure Notes from .env files, listing vault items, or setting up Bitwarden on a new machine. Secrets live in Bitwarden, get loaded into memory on demand, and die with the shell session — no files on disk.

2026-04-100

brainstorm

stevengonsalvez/nanoclaw-standalone

Develop a thorough, step-by-step specification for a given idea

2026-04-100

build-tracker

stevengonsalvez/nanoclaw-standalone

Set up a recurring build tracker cron job for any GitHub repo. Runs a zero-LLM shell script to detect stale PRs, stale assigned issues, and phase progress, then posts to a Discord channel only when there's something actionable. Use when asked to "track this build every N hours", "prod agents on a project", "set up a build monitor", "watch this repo for stale work", or similar. The tracker is cheap to run — script does all the work, the agent only speaks when findings exist.

2026-04-100

cloud-coding-agent

stevengonsalvez/nanoclaw-standalone

Run long-running coding tasks in cloud environments (Claude Code or Codex), with session teleporting and automatic PR creation.

2026-04-100

coding-agent

stevengonsalvez/nanoclaw-standalone

Delegate coding tasks to subagents or run Claude Code/Codex in tmux sessions. Use the Task tool for focused multi-step coding work. Use tmux for long-running interactive sessions, parallel worktree-based fixes, and PR reviews. NOT for simple single-file edits — do those directly.

2026-04-100

name	webcopilot
description	Automated web security reconnaissance and vulnerability scanning using WebCopilot. Enumerates subdomains, crawls endpoints, filters vulnerability parameters (XSS, SQLi, SSRF, LFI, RCE, Open Redirect), and scans with nuclei/dalfox/sqlmap.
user-invocable	true
version	2.0.0

WebCopilot — Automated Web Recon & Vuln Scanner

What It Does

WebCopilot chains 20+ security tools into a single automated pipeline:

Subdomain enumeration — assetfinder, subfinder, amass, findomain, crt.sh
Active subdomain brute — gobuster with SecLists DNS wordlists
Live host filtering — dnsx + httpx (titles, screenshots)
Subdomain takeover check — subjack
Endpoint crawling — gau, waybackurls, waymore
Parameter filtering — gf patterns for XSS, SQLi, SSRF, LFI, RCE, Open Redirect
Vulnerability scanning — dalfox (XSS), nuclei (CVEs), sqlmap (SQLi), crlfuzz (CRLF)

Prerequisites

All tools are installed at ~/go/bin/ and system PATH. Verify with:

webcopilot -v

Tool Locations

Go tools: ~/go/bin/ (subfinder, nuclei, httpx, dalfox, amass, etc.)
Python tools: sqlmap, waymore (pip3)
gf patterns: ~/.gf/*.json (14 patterns)
Wordlists: ~/wordlists/SecLists/Discovery/DNS/
WebCopilot script: ~/go/bin/webcopilot

Usage

Quick subdomain enum only (default)

webcopilot -d target.com

Full scan (subdomain enum + vuln scanning)

webcopilot -d target.com -a

Full scan with output dir and blind XSS server

webcopilot -d target.com -a -o target-results -t 200 -b your-bxss-server.oast.fun

Scan with pre-collected subdomains (skip enum)

webcopilot -d target.com -f subdomains.txt -a

Exclude out-of-scope domains

webcopilot -d target.com -a -x exclude.txt

Flags

Flag	Description	Default
`-d`	Target domain	Required
`-o`	Output directory	`webcopilot-<domain>`
`-t`	Number of threads	100
`-b`	Blind XSS server URL	None
`-x`	File with excluded domains	None
`-f`	File with subdomains (skips enum)	None
`-a`	Run ALL scans (not just enum)	Off
`-v`	Show version	—

⚠️ Important Notes

Requires root for some network operations — use sudo when needed
Time consuming — full -a scan can take hours on large targets
Legal: Only scan domains you own or have explicit authorization for
BXSS: Use https://app.interactsh.com/ for blind XSS callback server
Output: All results saved to the output directory with per-tool subdirs

Individual Tool Usage

You can also use the installed tools individually:

# Quick subdomain enum
subfinder -d target.com -silent | sort -u

# Nuclei template scan
nuclei -u https://target.com -t cves/

# XSS scan with dalfox
echo "https://target.com/page?q=test" | dalfox pipe

# HTTP probing
cat subdomains.txt | httpx -silent -title -status-code