Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

$pwd:

detecting-directory-listing

Name: Detecting Directory Listing
Author: jeremylongshore

// Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to. Use when: post-deploy verification on a static-asset host, security audit before SOC2, or following up on a finding from skill #6 (exposed-files) where a backup-file path returned 200 with HTML body instead of the expected file content (suggests autoindex serving a directory listing). Threshold: any directory-shaped path returns 200 with HTML body matching the framework-specific autoindex fingerprint (nginx fancyindex, Apache mod_autoindex Index of/, Caddy browse, Lighttpd mod_dirlisting, etc.). Trigger with: "directory listing check", "autoindex detection", "open directory scan".

Executar no Manus

$ git log --oneline --stat

stars:2.267

forks:315

updated:31 de maio de 2026 às 03:41

Explorador de arquivos

4 arquivos

SKILL.md

readonly

related-skills.json

mesmo repositório

detecting-command-injection-patterns.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with template literals, Ruby backticks / Kernel#system / Kernel#exec with interpolation, Go exec.Command with shell wrapping, PHP system / passthru / shell_exec / backticks with $-interpolation, Java Runtime.exec with concatenated args. Use when: pre-commit gate on code that calls out to shell utilities, audit of file-processing / archive-handling / image-conversion code, post-bug-report investigation for "we shell out to a tool." Threshold: any shell-invocation API called with a string that contains a variable interpolation, OR shell=True with anything other than a fixed literal. Trigger with: "scan command injection", "shell=True audit", "find exec calls", "check os.system".

2026-05-312.3k

detecting-eval-exec-usage.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when "we run user-supplied expressions." Threshold: any call to eval / exec / Function / similar where the argument is not a string literal. Trigger with: "scan eval", "find dynamic exec", "audit eval calls", "code injection patterns".

2026-05-312.3k

detecting-insecure-deserialization.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java ObjectInputStream.readObject, PHP unserialize, .NET BinaryFormatter / NetDataContractSerializer, Node.js node-serialize, JavaScript JSON.parse with reviver containing eval. Use when: pre-commit gate on services that accept binary blobs, audit of legacy job-queue code (workers deserializing tasks), post-bug-report when "we accept user-uploaded archives." Threshold: any call to a known-unsafe deserialization API on data that originates from user input, network, file upload, or untrusted storage. Trigger with: "scan deserialization", "pickle audit", "java readObject scan", "yaml.load check".

2026-05-312.3k

detecting-sql-injection-patterns.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements. Use when: pre-commit code review, post-feature SQL-touching release, inheriting a legacy codebase that predates ORMs, or post-bug-report investigation. Threshold: any source line where SQL keywords (SELECT / INSERT / UPDATE / DELETE / FROM / WHERE) appear in a string that's being built via concatenation, f-string, %-format, or .format() with variable input. Trigger with: "scan for sqli", "sql injection patterns", "check raw queries", "audit cursor.execute".

2026-05-312.3k

detecting-weak-cryptography.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token signing." Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: "scan weak crypto", "find MD5 usage", "check ECB mode", "audit ssl verify", "weak random".

2026-05-312.3k

scanning-for-hardcoded-secrets.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source-code tree for hardcoded credentials embedded in source files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens, Anthropic API keys, OpenAI keys, JWT signing secrets, generic base64-encoded passwords, RSA / SSH private keys, and high-entropy string literals that pattern-match common credential shapes. Use when: pre-commit gate before pushing a feature branch, audit before SOC2, post-incident scan after a leak, or inheriting a codebase you didn't write. Threshold: any source file contains a string that matches a canonical credential regex (AWS AKIA prefix, GitHub ghp_ prefix, etc.) OR a string with Shannon entropy above 4.5 in a field context (key=, token:, secret=). Trigger with: "scan secrets", "credential scan", "find hardcoded keys", "leak check".

2026-05-312.3k

package.json

"author": "jeremylongshore"

"repository": "jeremylongshore/claude-code-plugins-plus-skills"

Abrir repositório GitHub Ver repositórios do creator

$ install --global

$ download --local

Executar no Manus

$ useful --forSOC

Analistas de segurança da informaçãoInformática e Matemática15-1212L4

name	detecting-directory-listing
description	Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to. Use when: post-deploy verification on a static-asset host, security audit before SOC2, or following up on a finding from skill #6 (exposed-files) where a backup-file path returned 200 with HTML body instead of the expected file content (suggests autoindex serving a directory listing). Threshold: any directory-shaped path returns 200 with HTML body matching the framework-specific autoindex fingerprint (nginx fancyindex, Apache mod_autoindex Index of/, Caddy browse, Lighttpd mod_dirlisting, etc.). Trigger with: "directory listing check", "autoindex detection", "open directory scan".
allowed-tools	["Read","Bash(python3:)","Bash(curl:)"]
disallowed-tools	["Bash(rm:)","Edit(/etc/)"]
version	3.0.0-dev
author	Jeremy Longshore <jeremy@intentsolutions.io>
license	MIT
compatibility	Designed for Claude Code
tags	["security","information-disclosure","autoindex","pentest"]

Detecting Directory Listing

Overview

Web servers can be configured to auto-generate an HTML index page when a request hits a directory without a matching default file (no index.html / index.php / etc.). The auto-generated page lists every file in the directory. This is by design for static- file servers and FTP-style file-sharing setups; it's a misconfiguration on application servers where the file tree was never meant to be public.

The risk compounds in two ways:

File enumeration without prior knowledge. Attackers find files you didn't link to (backup files, log files, old uploads).
Chaining with exposed-files (#6). A /.git/ request that returns an autoindex listing reveals every object file under .git/objects/ and confirms the entire repo is reachable for GitDumper-style reconstruction.

This skill probes commonly-vulnerable directory paths and grades each based on the framework-specific autoindex fingerprint.

When the skill produces findings

Finding	Severity	Threshold	Affected control
Application-root directory listing	HIGH	`/` returns autoindex page	OWASP A05:2021
Backup / upload / log directory listing	HIGH	`/backup/`, `/uploads/`, `/logs/`, `/dump/` autoindex	CWE-548
Asset directory listing (`/assets/`, `/static/`)	MEDIUM	autoindex on asset dirs (enables file enumeration)	CWE-548
Config directory listing	CRITICAL	`/config/`, `/conf/`, `/.config/` autoindex	NIST 800-53 SC-28
VCS subdir listing (chains with skill #6)	CRITICAL	`/.git/`, `/.svn/`, `/.hg/` autoindex	NIST 800-53 SC-28
Generic root reachable via autoindex	MEDIUM	`/` or arbitrary path autoindex on app server	OWASP A05:2021

Prerequisites

Python 3.9+ with requests
Authorization for non-local targets

Instructions

Step 1 — Confirm Authorization

"Do you have authorization to perform directory-listing discovery on
 this target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-directory-listing/scripts/probe_directory_listing.py \
    https://target.example.com \
    --authorized

Options:

Usage: probe_directory_listing.py URL [OPTIONS]

Options:
  --authorized       Attest authorization (required for non-local)
  --output FILE      Write findings to FILE
  --format FMT       json | jsonl | markdown (default: markdown)
  --min-severity SEV (default: info)
  --timeout SECS     Per-probe timeout (default: 10)
  --paths-file FILE  Custom probe set (one path per line)

For each candidate directory path, the scanner appends a trailing slash and sends a GET. If the response is 200 and the HTML body matches one of the canonical autoindex fingerprints (Apache, nginx, Caddy, Lighttpd, IIS, Python http.server, Node serve, etc.), it's a finding.

Step 3 — Interpret findings

CRITICAL = config or VCS directory listing → direct credential or source-code exposure when combined with skill #6's secret-file probe. Ship same-hour fix.

HIGH = backup / upload / log / app-root listing → significant file enumeration. Often reveals backup files (.bak, .swp, .orig), log files with embedded credentials in URLs, and orphaned uploads from old releases. Ship within sprint.

MEDIUM = asset directory listing → file enumeration but bounded risk if asset content is genuinely public. Still better to disable than to leave on.

Step 4 — Cross-skill chaining

After this skill, suggest:

detecting-exposed-secrets-files (#6) — if any of the secret- file paths (.git/, .env) return an autoindex page instead of the expected file, that's the autoindex feature confirming repo exposure.
detecting-debug-endpoints (#7) — directory listings under framework paths (/static/, /public/) sometimes expose framework-debug artifacts.

Examples

Example 1 — Static-asset host audit

User: "We just spun up a new S3 + CloudFront. Verify autoindex isn't on by accident."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-directory-listing/scripts/probe_directory_listing.py \
    https://cdn.example.com --authorized --min-severity medium

S3 buckets configured with ListBucket permissions return XML directory listings; the scanner detects those too.

Example 2 — Following up on .git exposure

User: "Skill #6 found .git/HEAD exposed. Check if the full directory is browseable."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-directory-listing/scripts/probe_directory_listing.py \
    https://app.example.com --authorized --paths-file <(echo .git/)

If the .git/ probe returns an autoindex listing instead of the 404 it should, the whole repository is reachable for reconstruction via GitDumper-style tools.

Example 3 — CI gate against autoindex regression

- name: Directory-listing gate
  run: |
    python3 plugins/security/penetration-tester/skills/detecting-directory-listing/scripts/probe_directory_listing.py \
        "${{ secrets.STAGING_URL }}" \
        --authorized --min-severity high

Exit 1 fails the deploy if any HIGH or CRITICAL autoindex finding lands. Catches the regression where a new vhost gets deployed without the deny-autoindex directive.

Output

JSON / JSONL / Markdown. Exit codes: 0 clean, 1 high/critical, 2 error.

Error Handling

Target returns SPA index for every URL → the scanner's fingerprint check distinguishes a real autoindex from an SPA catch-all. SPAs don't generate autoindex-shaped HTML.
WAF blocks the scanner → expected behavior on Cloudflare-fronted hosts. The fingerprint will be of the CDN's block page, not the origin.
Connection error → exit 2.

Resources

references/THEORY.md — Per-server autoindex behavior, fingerprint patterns, S3 / GCS / Azure Blob considerations
references/PLAYBOOK.md — Per-server config to disable autoindex (nginx autoindex off, Apache Options -Indexes, Caddy disabling browse, etc.) + cloud-storage equivalents
../analyzing-tls-config/references/AUTHORIZATION.md — Active-scan authorization pattern

detecting-directory-listing

Mais deste repositório

Detecting Directory Listing

Overview

When the skill produces findings

Prerequisites

Instructions

Step 1 — Confirm Authorization

Step 2 — Run the scanner

Step 3 — Interpret findings

Step 4 — Cross-skill chaining

Examples

Example 1 — Static-asset host audit

Example 2 — Following up on .git exposure

Example 3 — CI gate against autoindex regression

Output

Error Handling

Resources

Detecting Directory Listing

Overview

When the skill produces findings

Prerequisites

Instructions

Step 1 — Confirm Authorization

Step 2 — Run the scanner

Step 3 — Interpret findings

Step 4 — Cross-skill chaining

Examples

Example 1 — Static-asset host audit

Example 2 — Following up on .git exposure

Example 3 — CI gate against autoindex regression

Output

Error Handling

Resources

Mais deste repositório