菜单
Use IP rotation proxies (flareprox and fireprox) to bypass rate limiting, IP bans, and geo-blocking during web security testing. Use only when IPROTATE_ENABLED is set and the target is blocking normal requests. Triggers on "rate limited", "IP banned", "blocked by WAF", "429", "403", "geo-blocked", "rotate IP", "IP rotation", "flareprox", "fireprox".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable attack-surface coverage is needed.
Decision tree for selecting AIRT attacks based on goals, target type, and constraints
Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync, relay attacks, and credential reuse patterns. Use during exploitation and privilege escalation phases.
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack discipline, credential verification, trust boundary awareness, scope compliance, reversibility preference, and structured reporting. Prevents premature exploitation, credential misuse, and scope violations.
Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the caido-proxy MCP skill for efficiency WHEN the SDK is importable in the current runtime. If the import fails, or Caido/the MCP is not loaded, fall back to the caido-proxy skill.
| name | ip-rotation |
| description | Use IP rotation proxies (flareprox and fireprox) to bypass rate limiting, IP bans, and geo-blocking during web security testing. Use only when IPROTATE_ENABLED is set and the target is blocking normal requests. Triggers on "rate limited", "IP banned", "blocked by WAF", "429", "403", "geo-blocked", "rotate IP", "IP rotation", "flareprox", "fireprox". |
Activation gate: Only use this skill when the environment variable IPROTATE_ENABLED is set (any value). If unset, do not suggest, reference, or offer IP rotation. Do not ask the user to enable it.
The web-security runtime provides two IP rotation backends:
~/git/fireprox/fire.py)Use IP rotation when normal testing hits anti-automation defenses:
429 Too Many Requests403 Forbidden or connection drops after sustained testingDo NOT use for:
| Backend | Use When | Cost | Target Binding | Notes |
|---|---|---|---|---|
| flareprox | Unauthenticated recon, fuzzing, scraping, multi-target | Free (100K/day) | Dynamic per request | Built-in flareprox_* tools |
| fireprox | Authenticated testing, session/cookie-based exploits | ~$3.50/1M req | Static: one proxy per target URL | Use ~/git/fireprox/fire.py CLI |
Decision:
Built into the capability. No external install required.
Prerequisites: CF_API_TOKEN and CF_ACCOUNT_ID.
Lifecycle:
flareprox_status
flareprox_create --count 3
flareprox_request --url https://target.com/api/endpoint --method GET
flareprox_cleanup
See the tool descriptions for full argument lists.
Installed in the runtime at ~/git/fireprox/fire.py. Requires AWS credentials at runtime.
Set one of:
AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY~/.aws/credentials in the runtimeTool path: python3 ~/git/fireprox/fire.py
python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1
python3 ~/git/fireprox/fire.py --command list
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>
# 1. Create a proxy for a specific target
python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1
# 2. Note the proxy URL from the output, then use it
PROXY="https://<api-id>.execute-api.us-east-1.amazonaws.com/fireprox/"
curl -x http://localhost:8080 -k "${PROXY}api/endpoint"
# 3. Clean up when done to avoid AWS charges
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>
fireprox creates one API Gateway per target URL. The proxy URL prefix is static for that target; AWS rotates the egress IP automatically.
~/.flareprox/workers.json.If Caido or Burp is available, chain traffic through them for evidence capture:
your client → Caido/Burp → flareprox/fireprox → target
For fireprox:
curl -x http://localhost:8080 -k \
-H "Cookie: session=abc123" \
"https://<api-id>.execute-api.<region>.amazonaws.com/fireprox/api/endpoint"
For flareprox, use flareprox_request or set X-Target-URL when using a worker URL manually.