菜单
This skill should be used when the user asks about "gobuster", "directory fuzzing", "web enumeration", "nikto", "web vulnerabilities", "feroxbuster", "ffuf", "subdomain enumeration", or needs guidance on web application testing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.
This skill covers Cacti network monitoring tool exploitation including authenticated RCE via graph templates (CVE-2025-24367), unauthenticated command injection (CVE-2022-46169), and authentication bypass techniques.
This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.
This skill covers container escape techniques for Docker, LXC/LXD, and Kubernetes environments. Includes Docker socket escape, Docker Desktop API escape (192.168.65.7:2375), privileged container breakout, and capability-based escapes.
This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.
This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".
| name | Web Application Enumeration |
| description | This skill should be used when the user asks about "gobuster", "directory fuzzing", "web enumeration", "nikto", "web vulnerabilities", "feroxbuster", "ffuf", "subdomain enumeration", or needs guidance on web application testing. |
| version | 1.0.0 |
Techniques for discovering web content, identifying technologies, and finding vulnerabilities in web applications.
# Basic scan
whatweb http://<TARGET>
# Aggressive scan
whatweb -a 3 http://<TARGET>
# Verbose output
whatweb -v http://<TARGET>
# Check response headers
curl -I http://<TARGET>
# Key headers to note:
# Server: Apache/2.4.41
# X-Powered-By: PHP/7.4
# X-AspNet-Version: 4.0.30319
# Basic directory scan
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt
# With extensions
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt \
-x php,html,txt,bak,zip
# With authentication
gobuster dir -u http://<TARGET> -w wordlist.txt \
-U admin -P password
# Ignore SSL errors
gobuster dir -u https://<TARGET> -w wordlist.txt -k
# Basic recursive scan
feroxbuster -u http://<TARGET> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
# With extensions and depth
feroxbuster -u http://<TARGET> \
-w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
-x php,html,txt -d 3
# Quiet mode with output
feroxbuster -u http://<TARGET> -w wordlist.txt -q -o results.txt
# Directory fuzzing
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt
# With extensions
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt -e .php,.html,.txt
# Virtual host fuzzing
ffuf -u http://<TARGET> -H "Host: FUZZ.<DOMAIN>" \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-fs <size_to_filter>
# POST parameter fuzzing
ffuf -u http://<TARGET>/login -X POST \
-d "username=admin&password=FUZZ" -w passwords.txt
# Gobuster DNS mode
gobuster dns -d <DOMAIN> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# Amass
amass enum -passive -d <DOMAIN>
# Gobuster vhost mode
gobuster vhost -u http://<TARGET> \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# Add to /etc/hosts if found
echo "<IP> subdomain.domain.com" >> /etc/hosts
# Basic scan
nikto -h http://<TARGET>
# With output
nikto -h http://<TARGET> -o nikto.txt
# Scan specific port
nikto -h http://<TARGET>:8080
# With authentication
nikto -h http://<TARGET> -id admin:password
# All templates
nuclei -u http://<TARGET>
# CVE templates only
nuclei -u http://<TARGET> -t cves/
# Specific severity
nuclei -u http://<TARGET> -severity critical,high
curl http://<TARGET>/robots.txt
curl http://<TARGET>/sitemap.xml
curl http://<TARGET>/.git/HEAD
curl http://<TARGET>/.svn/entries
curl http://<TARGET>/.htaccess
curl http://<TARGET>/crossdomain.xml
curl http://<TARGET>/clientaccesspolicy.xml
curl http://<TARGET>/web.config
curl http://<TARGET>/wp-config.php.bak
curl http://<TARGET>/config.php.bak
curl http://<TARGET>/.env
curl http://<TARGET>/phpinfo.php
# Common backup extensions
for ext in bak old orig backup ~; do
curl -s -o /dev/null -w "%{http_code}" http://<TARGET>/index.php.$ext
done
# WPScan
wpscan --url http://<TARGET> -e vp,vt,u
# With API token (more results)
wpscan --url http://<TARGET> --api-token <TOKEN> -e ap,at,u
# Brute force
wpscan --url http://<TARGET> -U admin -P /usr/share/wordlists/rockyou.txt
# Joomscan
joomscan -u http://<TARGET>
# Droopescan
droopescan scan drupal -u http://<TARGET>
# Find hidden parameters
arjun -u http://<TARGET>/page
# With wordlist
arjun -u http://<TARGET>/page -w params.txt
# Common parameter names
# id, page, file, path, dir, search, q, query, url, redirect
# user, username, pass, password, email, token, key, api
| Purpose | Wordlist |
|---|---|
| Directories | /usr/share/wordlists/dirb/common.txt |
| Directories (larger) | /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt |
| Files | /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt |
| Subdomains | /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt |
| Parameters | /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt |
# Web Enumeration: <TARGET>
## Technologies
| Component | Value |
|-----------|-------|
| Server | Apache 2.4.41 |
| Language | PHP 7.4 |
| CMS | WordPress 5.8 |
## Directories Found
| Path | Status | Size | Notes |
|------|--------|------|-------|
| /admin | 302 | - | Redirects to login |
| /backup | 200 | 4521 | Directory listing |
| /uploads | 403 | - | Forbidden |
## Files of Interest
- /robots.txt - Disallows /admin, /backup
- /.git/HEAD - Git repository exposed
- /wp-config.php.bak - Backup config file
## Vulnerabilities
- [ ] Directory listing enabled
- [ ] Git repository exposed
- [ ] Backup files accessible