菜单
Techniques for accurately identifying services, versions, and technologies running on discovered hosts
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Systematic approach to analyzing compiled binaries, understanding program behavior, and identifying vulnerabilities without source code access
Methodical approach to finding security vulnerabilities through source code review and static analysis
Systematic approach to discovering novel vulnerabilities through code analysis, fuzzing, and attack surface research
Systematic methodology for developing reliable exploits from vulnerability discovery to weaponization
Building effective fuzzing harnesses to maximize code coverage and vulnerability discovery through automated input generation
Techniques for creating and adapting payloads for various exploitation scenarios, target environments, and evasion requirements
| name | Service Fingerprinting |
| description | Techniques for accurately identifying services, versions, and technologies running on discovered hosts |
| when_to_use | After discovering live hosts during reconnaissance, when mapping technology stack for vulnerability assessment, or when preparing targeted exploitation strategies |
| version | 1.0.0 |
| languages | bash, python |
Service fingerprinting identifies the specific software, version, and configuration of network services. Accurate fingerprinting enables targeted vulnerability assessment, exploit selection, and understanding of the attack surface. This skill combines active probing, banner grabbing, and behavioral analysis.
Core principle: Start passive, escalate to active when needed. Combine multiple techniques for accuracy.
# Fast SYN scan of common ports
nmap -sS -F target.com
# Comprehensive scan of all ports
nmap -p- -T4 target.com
# Service version detection
nmap -sV -p 80,443,22,3306 target.com
# OS detection
sudo nmap -O target.com
# Aggressive scan (version, OS, scripts, traceroute)
nmap -A target.com
# Manual banner grab
nc target.com 80
GET / HTTP/1.0
# Automated with nmap
nmap -sV --version-intensity 9 -p 80,443 target.com
# Multiple services
for port in 21 22 25 80 443 3306; do
echo "=== Port $port ==="
nc -w 2 target.com $port
done
# Detailed HTTP headers
curl -I https://target.com
# Technology detection
whatweb -a 3 https://target.com
# Certificate information
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -text
# Database fingerprinting
nmap -p 3306 --script mysql-info target.com
nmap -p 5432 --script pgsql-info target.com
# SMB enumeration
nmap -p 445 --script smb-os-discovery target.com
# SSH fingerprinting
ssh-audit target.com
| Port | Service | Fingerprinting Command |
|---|---|---|
| 21 | FTP | nc target.com 21 |
| 22 | SSH | nc target.com 22 |
| 80/443 | HTTP/HTTPS | curl -I https://target.com |
| 3306 | MySQL | nmap -p 3306 --script mysql-info |
| 5432 | PostgreSQL | nmap -p 5432 --script pgsql-info |
| 6379 | Redis | redis-cli -h target.com info |
| 27017 | MongoDB | nmap -p 27017 --script mongodb-info |