菜单
Use the installed web CTF tooling for endpoint discovery, fuzzing, and automated SQL injection workflows. Use when Codex needs `sqlmap`, `gobuster`, `ffuf`, `dirb`, or `wfuzz`, and when full installs may also include manual Burp or ZAP steps.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use the Anaconda `ctf` environment and installed reverse-engineering tooling for binary analysis, symbolic execution, disassembly, emulation, and binary patching. Use when Codex needs `angr`, `claripy`, `capstone`, `unicorn`, `ghidra-headless`, `radare2`, `objdump`, `strace`, `ltrace`, `binwalk`, or related tools.
Manage a preinstalled local Minecraft Java client asynchronously for CTF and automation workflows. Use when Codex needs to launch Minecraft in offline mode with alternate usernames, inspect Minecraft logs, focus or type into the X11 game window, send chat or slash commands quickly, or join a multiplayer server by launching the installed client directly instead of relying on the official launcher.
Maintain bidirectional netcat-style TCP communications with persistent asynchronous input/output. Use when Codex must keep a connection open across multiple commands, send messages while receiving background output, inspect connection logs, or safely start/stop reusable sessions for protocol testing, CTF services, debugging sockets, or interactive line-based services.
Maintain persistent asynchronous SSH sessions with bidirectional input/output across multiple commands. Use when Codex must keep an SSH shell open, send commands incrementally, inspect prompts or streamed output, reuse one authenticated connection for a task, or safely start/stop a long-lived remote session for debugging, administration, deployment, log inspection, or interactive line-based workflows on remote hosts.
Use the Anaconda `ctf` environment and installed network tooling for packet- and protocol-level CTF tasks. Use when Codex needs `scapy`, `tshark`, `tcpdump`, `nmap`, `nc`, or `socat` for packet work, capture analysis, or service triage.
Use the OpenCROW utility stack for shell-heavy CTF workflows. Use when Codex needs `jq`, `yq`, `xxd`, `tmux`, `screen`, `rg`, or `fzf` to glue a larger workflow together.
| name | opencrow-web-toolbox |
| description | Use the installed web CTF tooling for endpoint discovery, fuzzing, and automated SQL injection workflows. Use when Codex needs `sqlmap`, `gobuster`, `ffuf`, `dirb`, or `wfuzz`, and when full installs may also include manual Burp or ZAP steps. |
Use this skill for web CTF work that starts from discovery and fuzzing rather than browser automation: sqlmap, gobuster, ffuf, dirb, and wfuzz. The full installer profile also tracks manual acquisition steps for Burp Suite Community and OWASP ZAP.
Start the MCP server from the installed CLI:
opencrow-web-mcp
Verify the mapped stack:
python ~/.codex/skills/opencrow-web-toolbox/scripts/verify_toolkit.py
ffuf, gobuster, or dirb.wfuzz when the problem is parameter fuzzing or more custom request mutation.sqlmap when the challenge is plausibly SQLi-driven and the target is stable enough for automation.playwright separately when the task needs a real browser or a JS-heavy flow.toolbox_info, toolbox_verify, toolbox_capabilities, web_discover, web_fuzz, and web_sqlmap_scan.ffuf for fast fuzzing against paths, parameters, or virtual hosts.gobuster for straightforward wordlist-driven discovery.dirb when a challenge guide or prior workflow already assumes DIRB-style usage.wfuzz when request templating matters more than raw speed.sqlmap when the target and request shape are stable enough to automate.opencrow-web-mcp: stdio MCP server for typed discovery, fuzzing, and sqlmap workflows.scripts/verify_toolkit.py: confirm that the mapped web discovery tools are installed.references/tooling.md: quick selection notes for web workflows.