菜单
Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Binary analysis and reverse engineering workflow using checksec, strings, binwalk, radare2, ropgadget, and gdb for CTF and vulnerability research
Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images
Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell
Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools
Password hash identification, cracking, and credential brute-forcing using hashid, john, hashcat, hydra, medusa, and ophcrack
SMB and Windows network enumeration workflow using nmap, smbmap, enum4linux, netexec, and nbtscan for share discovery, user enumeration, and lateral movement
| name | web-recon |
| description | Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f |
Web reconnaissance workflow for NyxStrike. Use this skill when a user wants to find hidden directories, endpoints, virtual hosts, crawl a web application, or detect the tech stack and WAF.
Always check for a WAF first — it influences wordlist choice, rate, and evasion flags.
run_tool(tool="wafw00f", url="https://<target>")
If a WAF is detected, add evasion flags to subsequent tools (e.g. --random-agent, lower thread count).
Fingerprint live hosts, status codes, titles, and tech stack before brute-forcing.
run_tool(tool="httpx", target="<target>", probe=true, tech_detect=true, title=true, status_code=true)
Use the tech stack findings to choose targeted wordlists:
wp-content, wp-admin wordlists.php extensions.htaccess, server-statusFast sweep (ffuf) — preferred for vhost and parameter fuzzing as well:
run_tool(tool="ffuf", url="https://<target>/FUZZ",
wordlist="/usr/share/wordlists/dirb/common.txt",
match_codes="200,204,301,302,307,401,403")
Recursive discovery (feroxbuster) — use when you need deep recursive scanning:
run_tool(tool="feroxbuster", url="https://<target>",
wordlist="/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt",
threads=10)
Extension-aware scan (gobuster) — use when tech stack is known:
run_tool(tool="gobuster", url="https://<target>",
mode="dir",
wordlist="/usr/share/wordlists/dirb/common.txt",
additional_args="-x php,html,txt,bak")
Crawl the application for JS-embedded endpoints, forms, and parameters:
run_tool(tool="katana", url="https://<target>")
Feed discovered endpoints into vulnerability scanning (see web-vuln skill).
Use ffuf in vhost mode to discover hidden vhosts:
run_tool(tool="ffuf", url="https://<target>",
mode="vhost",
wordlist="/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt")
If WordPress is detected, run wpscan for plugin/theme vulns and user enumeration:
run_tool(tool="wpscan", url="https://<target>",
additional_args="--enumerate u,p,t --plugins-detection aggressive")
| Target type | Recommended wordlist |
|---|---|
| General dirs | /usr/share/wordlists/dirb/common.txt |
| Deep/thorough | /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt |
| Files | /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt |
| API endpoints | /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt |
| Backup files | /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt |
| Vhosts | /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt |
| Tool | Use case |
|---|---|
wafw00f | WAF detection |
httpx | HTTP probing, tech fingerprint |
ffuf | Fast fuzzing (dirs, vhosts, params) |
feroxbuster | Recursive content discovery |
gobuster | Extension-aware dir/file brute-force |
katana | Web crawling, JS endpoint extraction |
dirsearch | Alternative web path scanner |
wpscan | WordPress-specific enumeration |