소스 정보
- 저장소
- uphiago/recon-skills
- 최근 소스 활동
- 2026년 7월 25일 13:09
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,158
- 포크
- 205
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SOC 직업 분류 기준
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/uphiago/recon-skills --skill pentest-playbook명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
| name | pentest-playbook |
| description | 7-phase pentest pipeline from passive recon to exploitation. |
| version | 1.1.0 |
| license | MIT |
| tags | ["meta","playbook","pentest","methodology","workflow"] |
| revision_date | "2026-07-25T00:00:00.000Z" |
| platforms | ["linux"] |
| compatibility | Requires curl, nmap, python3 |
| disable-model-invocation | true |
| category | meta |
| related_skills | ["recon-playbook","port-mass-scan","cache-attack","firebase-supabase-attack","api-noauth-hunt"] |
7-phase master pentest pipeline covering the full lifecycle from passive reconnaissance to exploitation and reporting. Distilled from 100+ targets across government, healthtech, fintech, e-commerce, ISP, and SMB sectors. This is the "meta-playbook" — it tells you what to do at each stage of an engagement and which skills to load for each phase.
| Phase | Name | Focus | Key Skills | Duration |
|---|---|---|---|---|
| 1 | Passive Recon | OSINT, subdomains, leaks, tech stack | subdomain-enumeration, offensive-osint | 30-60 min |
| 2 | Active Recon | Port scans, live hosts, tech detection | port-mass-scan, port-service-discovery, web2-recon | 30-60 min |
| 3 | Web Enumeration | Sensitive files, .env, CORS, JS secrets | web-enumeration, cors-credential-wordpress, js-secrets-extraction | 20-40 min |
| 4 | Framework Exploit | WordPress, Laravel, Spring, .NET | hunt-wordpress, hunt-laravel, hunt-springboot, hunt-aspnet | 30-60 min |
| 5 | Cloud & Infrastructure | Firebase, Supabase, S3, Cloud Functions | hunt-firebase, hunt-supabase, cloud-iam-deep | 30-60 min |
| 6 | Deep Exploitation | SQLi, SSRF, RCE, ATO, chains | hunt-sqli, hunt-ssrf, cross-attack-chains | 1-4 hours |
| 7 | Report & Remediation | Documentation, PoC, CVSS scoring | report-writing, triage-validation, evidence-hygiene | 1-3 hours |
# 1. Subdomain enumeration
subfinder -d $TARGET -silent | tee subs.txt
curl --max-time 30 --connect-timeout 10 -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r >> subs.txt
curl --max-time 30 --connect-timeout 10 -sI | grep -iE
# 1. Port scan (top 1000 ports)
rustscan -a $TARGET --ulimit 5000 -g | tee ports.txt
# 2. HTTP probe on alive hosts
cat subs.txt | httpx -silent -status-code -title -tech-detect | tee live.txt
# 3. CORS quick test
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
Run the full web-enumeration skill — 200+ sensitive file paths, .env extraction, path traversal bypass, vHost enum.
Load the relevant hunt-* skill based on detected framework:
hunt-wordpress + wp-mass-reconhunt-laravelhunt-springboothunt-aspnethunt-firebase (API key → Firestore → Storage)hunt-supabase (anon key → RLS bypass)cloud-iam-deep (SA key → GCP token → IAM policy)docker-privesc (if container access)Chain findings using cross-attack-chains skill. The 5 confirmed chains (A-E) turn individual Medium/High findings into Critical impact.
Use report-writing skill for bug bounty or redteam-report-template for client deliverables. Apply triage-validation 7-question gate before submitting.
When brute force / direct attacks aren't producing results, DO NOT persist — pivot to lateral discovery. This is the single most important judgment call in a pentest.
| Signal | Current Vector | Pivot To |
|---|---|---|
| 100+ passwords tested, zero hits | Brute force (login) | SSRF, CORS, subdomain enum, API discovery, source leak, open registration, Firebase/Supabase |
| All common creds fail on MySQL/SSH | Database/SSH brute | API discovery (port scan for HTTP services), JS bundle secrets, Firebase config, CORS exfil |
| WAF/403 on every payload | Web exploitation | CDN bypass (origin IP discovery), subdomain enum (staging/dev may lack WAF), API on non-standard ports, HTTP method/header tampering |
| rate limit / captcha / lockout | Auth brute | SameSite bypass, OAuth misconfig, MFA fatigue, password-reset poisoning, SSO token reuse |
| 401/403 on all API endpoints | API exploitation | OPTIONS preflight, method tampering (GET→POST, PUT→PATCH), content-type switching (JSON→XML→form), header injection (X-Forwarded-User, X-Original-URL), JWT alg=none |
| SPA returns same HTML for all paths | Path enumeration | Check API on other ports (8080, 8443, 3000, 5000, 8084), JS bundle route extraction, source maps, Firebase/Supabase, CORS exfil |
| No vulns found on main app | App exploitation | Sister apps (same IP/cert/headers → same code), subdomains, staging/dev instances, mobile APKs, CMS admin panels, forum/community software |
When a vector isn't paying off, systematically check these BEFORE declaring the target clean:
Before spending more than 5 minutes on any SINGLE attack vector:
If none worked in 3 distinct attempts, the vector is low-probability. Document what was tried and move on. Do NOT cycle back to the same vector with more of the same — find a qualitatively different angle.
"Let me just try 100 more passwords..."
"Maybe I need a bigger wordlist..."
"Let me try one more round..."
🚫 STOP. If the first 100 targeted passwords didn't work, the next 10,000 won't either (for real-world passwords). Instead: