菜单
Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gate
Automate low-impact web vulnerability verification through Burp MCP. Use when Codex is asked to check, reproduce, triage, or write evidence for vulnerabilities using Burp Suite proxy history, Repeater, Collaborator/OOB payloads, HTTP replay, parameter mutation, response diffing, or scanner issues. Also use for mini program/微信小程序 Burp history, wildcard domains like *.example.com, root-domain traffic reviews, arbitrary login/任意登录, session_key/sessionKey/sessionkey/session-key/session key/sess_key/sessKey/wxSessionKey/wx_session_key/wechatSessionKey/thirdSessionKey/decryptKey/openDataKey, jscode2Session/jscode2session/code2Session, openid/unionid, getPhoneNumber, encryptedData/iv, appSecret, or phone-login checks; in those cases enumerate all Hosts and search response bodies for WeChat session leaks before reporting no issue.
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, null origin, JSONP hijacking, preflight policy bugs, and browser-based access to authenticated APIs.
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
| name | insecure-source-code-management |
| description | Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing. |
AI LOAD INSTRUCTION: This skill covers detection and recovery of exposed version-control metadata, common backup artifacts, and related misconfigurations. Use only in authorized assessments. Treat recovered credentials and URLs as sensitive; do not exfiltrate real data beyond scope. For broad discovery workflow, cross-load recon-for-sec and recon-and-methodology when those skills exist in the workspace.
High-value paths to probe first (GET or HEAD, respect rate limits):
/.git/HEAD
/.git/config
/.svn/entries
/.svn/wc.db
/.hg/requires
/.bzr/README
/.DS_Store
/.env
中文路由提示：快速扫这些路径；若需完整侦察流程，从 recon-for-sec、recon-and-methodology 技能载入方法论后再深入。
/.git/HEAD — valid repo often returns plain text like:ref: refs/heads/main
/.git/config — may expose remote.origin.url, user identity, or embedded credentials./.git/index, /.git/objects/ — partial object store access enables reconstruction with the right tools.404 — path likely absent or fully blocked at the edge.403 on /.git/ — directory may exist but listing is denied; still try direct file URLs:/.git/HEAD
/.git/config
/.git/logs/HEAD
/.git/refs/heads/main
A 403 on the directory plus 200 on HEAD strongly indicates exposure.
arthaud/git-dumper — dumps reachable .git tree when individual files are fetchable.internetwache/GitTools — Dumper, Extractor, Finder modules for partial/corrupt dumps.WangYihang/GitHacker — alternative recovery when standard dumpers miss edge cases.| Path | Why it matters |
|---|---|
.git/config | Remotes, credentials, hooks paths |
.git/logs/HEAD | Commit history, reflog-style leakage |
.git/refs/heads/* | Branch tips, commit SHAs |
.git/packed-refs | Packed branch/tag refs |
.git/objects/** | Object blobs for reconstruction |
/.svn/entries — XML or text metadata listing paths and revisions./.svn/wc.db — SQLite working copy database (PRAGMA table_info after download).Example probe:
GET /.svn/entries HTTP/1.1
GET /.svn/wc.db HTTP/1.1
anantshri/svn-extractor — automated extraction from exposed .svn.wc.db, query with sqlite3 for file paths and checksums, then request /.svn/pristine/ blobs if exposed./.hg/requires — small text file listing repository features; confirms Mercurial metadata.GET /.hg/requires HTTP/1.1
GET /.hg/store/ HTTP/1.1
sahildhar/mercurial_source_code_dumper — dumps repository when store paths are reachable./.bzr/README and /.bzr/branch-format for Bazaar metadata..DS_Store/.DS_Store can encode directory and filename listings.gehaxelt/ds-store, lijiejie/ds_store_exp — parse .DS_Store offline.Probe (adjust for app root and naming conventions):
/.env
/backup.zip
/backup.tar.gz
/wwwroot.rar
/backup.sql
/config.php.bak
/.config.php.swp
location /.git { deny all; } — may return 403 for /.git/ while still allowing or denying specific subpaths depending on rules./.git/HEAD → ref: refs/heads/ pattern? → run git-dumper / GitTools / GitHacker; review config and logs/HEAD for secrets./.svn/wc.db or entries → success? → svn-extractor or manual wc.db + pristine recovery./.hg/requires → success? → mercurial dumper./.bzr/README → Bazaar tooling or manual path walk./.DS_Store, /.env, common backup extensions on app root and parent paths.中文：与侦察类技能联动——先定范围与速率，再针对 VCS/备份做定向验证。