用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill web-waf-detection命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
基于 SOC 职业分类
正在显示 SKILL.md
| name | web-waf-detection |
| description | Web Application Firewall fingerprinting — Cloudflare, AWS WAF, Akamai, Imperva, etc. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"reconnaissance","when_to_use":"WAF detection, wafw00f, Cloudflare, AWS WAF, Akamai, Imperva, web shield","tags":"waf-detection","mitre_attack":"T1592.004"} |
Identify any front-end shield (Cloudflare, AWS WAF, Akamai, Imperva, etc.) so exploit can choose appropriate evasion (encoding, payload obfuscation, alternate transport). A multi-proxy/CDN stack is also the recognition signal for HTTP request smuggling — note this for handoff.
# wafw00f
wafw00f https://<target>
# Manual detection via response patterns
curl -s "https://<target>/?id=1' OR '1'='1" -I | grep -iE '(server|x-cdn|cf-ray|x-sucuri|x-aws)'
| WAF | Signal |
|---|---|
| Cloudflare | CF-RAY header, __cfduid cookie |
| AWS WAF | x-amzn-requestid header |
| Akamai | AkamaiGHost server header |
| Imperva | X-CDN header, incap_ses cookie |
| Sucuri | X-Sucuri-ID header |
| F5 BIG-IP | BIGipServer cookie |
If the response chain shows TWO different Server: strings on subsequent requests, or a CDN front in front of an origin server with different framing, note this in the handoff under "Frontend stack" — it is the recognition signal for HTTP request smuggling routing in exploit.