菜单
Elite methodology for discovering maximum attack surface with minimal detection (5-Layer Approach).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Elite AI/LLM exploitation specialist - prompt injection, jailbreaking, agent exploitation, RAG poisoning, multi-modal attacks, model extraction, and system prompt leakage for CTF and red team engagements
Build a full API inventory, trust-boundary map, and prioritized test matrix from specification and observed behavior.
Convert API vulnerability leads into confirmed impact or cleanly disproven outcomes with reproducible evidence.
Execute a predefined API test plan deterministically with complete request-level evidence and final verdicts.
Perform deep exploit-focused binary analysis by tracing attacker-reachable paths to validated vulnerability primitives.
Execute systematic static and dynamic binary analysis to uncover exploitable vulnerability primitives.
| name | Advanced Reconnaissance |
| description | Elite methodology for discovering maximum attack surface with minimal detection (5-Layer Approach). |
| author | 1ikeadragon |
| license | GPLv3 |
Prerequisites: DNS, HTTP, command-line tools
Goal: Discover maximum attack surface with minimal detection
Breadth → Depth → Exploitation Wide net → Focus → Attack
Key Principle: 80% of bugs come from assets others miss.
whois and amass intel to find ASNs and IP ranges.active_discovery workflows.subfinder, amass, crt.sh.puredns, shuffledns.altdns).naabu, nmap.live.txt (Httpx results)web_application_security skills.nuclei -t technologies, whatweb.waf_bypass skill if blocked).katana, hakrawler.javascript_analysis skill for deobfuscation).tmux or axiom for distributed scanning.Maintain a standardized directory structure (recon/target/subdomains, recon/target/web, etc.) as defined in the overarching methodology.