메뉴
[recon] Passive subdomain enumeration for a root domain via public sources (no direct traffic to the target). Reach for it first to expand the host attack surface before live probing.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | subfinder |
| description | [recon] Passive subdomain enumeration for a root domain via public sources (no direct traffic to the target). Reach for it first to expand the host attack surface before live probing. |
ProjectDiscovery's subfinder (pure-Go). Aggregates subdomains from passive
sources (certificate transparency, passive DNS, search APIs). Passive by design:
it queries third-party data sources, not the target itself.
-d <domain> target apex (repeatable) or -dL <file> list of domains.-all use all sources (slower, broader); default is the fast curated set.-recursive recurse into discovered subdomains.-silent only print domains (clean for piping).-oJ -o out.json JSON output; -rl <n> rate limit to source APIs.-nW show only resolvable hosts (when combined with resolution).# Enumerate in-scope apex, pipe straight into resolve+probe
subfinder -d target.example.com -all -silent \
| dnsx -silent -a -resp \
| httpx -silent -sc -title