基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/AeonDave/malskill --skill subfinder命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Operate the MCPwn Kali/Debian MCP efficiently: manage sessions, discover catalog tools, choose synchronous, detached, or interactive execution, move files through workspace/CAS planes, establish tunnels and shells, and run GDB or Frida debugging in the MCPwn runtime or through explicit host/device transports. Use for MCPwn or Kali MCP work, pwn/CTF and dynamic-analysis sessions, remote targets, connectivity or file-transfer problems, and optional NeuroMatrix-backed emulation/debugging through MCPwn's emulation domain.
Operate the standalone, client-neutral NeuroMatrix emulation MCP: create isolated sessions, stage CAS artifacts, discover and run Unicorn/Qiling/QEMU/Renode tools, manage jobs and interactive processes, expose guest endpoints, and debug emulated targets with GDB. Use for reverse engineering, user-mode or full-system emulation, firmware/kernel/MCU analysis, guest-service rehosting, runtime-evidence collection, or as the optional emulation provider behind MCPwn or another orchestrator.
Create, implement, scaffold, migrate, or review Model Context Protocol (MCP) servers against modern MCP 2026-07-28. Use for server architecture, tool/resource/prompt contracts, stdio or Streamable HTTP transports, MRTR, optional extensions, authorization, security, and real-transport validation. Also use to isolate legacy initialization or session behavior. Do not use merely to configure an MCP client or invoke an existing server.
| name | subfinder |
| description | Auth/lab ref: Passive subdomain enumeration tool using 40+ OSINT sources. |
| license | MIT |
| compatibility | Linux, Windows, macOS. |
| metadata | {"author":"AeonDave","version":"1.1"} |
Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.
# Enumerate subdomains for a domain
subfinder -d example.com
# Output to file
subfinder -d example.com -o subs.txt
# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent
| Flag | Description |
|---|---|
-d <domain> | Target domain |
-dL <file> | List of domains from file |
-o <file> | Output file |
-oJ | JSON output |
-silent | Print subdomains only |
-t <n> | Threads (default 10) |
-timeout <n> | Timeout per source (seconds) |
-all | Use all sources (slower, more results) |
-recursive | Enumerate recursively |
-active | Active DNS verification of results |
-v | Verbose output |
Configure API keys in ~/.config/subfinder/provider-config.yaml:
shodan:
- YOUR_SHODAN_KEY
virustotal:
- YOUR_VT_KEY
censys:
- YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
- YOUR_KEY
Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).
# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent
# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt
# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt
# Use all sources for maximum coverage
subfinder -d example.com -all -silent
# JSON output for automation
subfinder -d example.com -oJ -o subs.json
# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
dnsx -silent -a -resp | \
awk '{print $1}' | \
httpx -silent -status-code -title -tech-detect | \
tee web_services.txt
# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt
| File | When to load |
|---|---|
references/providers.md | Full passive source list, API key setup for all 40+ providers |