菜单
DNS attack techniques — zone transfer, subdomain enumeration/takeover, cache poisoning. Use when DNS is found or you're mapping a domain. Triggers - port 53, named/bind, AXFR zone transfer, dangling CNAME, subdomain takeover, wildcard DNS.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill svc-dns命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
基于 SOC 职业分类
正在显示 SKILL.md
| name | svc-dns |
| description | DNS attack techniques — zone transfer, subdomain enumeration/takeover, cache poisoning. Use when DNS is found or you're mapping a domain. Triggers - port 53, named/bind, AXFR zone transfer, dangling CNAME, subdomain takeover, wildcard DNS. |
dig AXFR <domain> @<ns_server>
host -t AXFR <domain> <ns_server>
dnsrecon -d <domain> -a
# Record types
dig <domain> ANY +noall +answer
dig <domain> A +short
dig <domain> AAAA +short
dig <domain> MX +short
dig <domain> NS +short
dig <domain> TXT +short
dig <domain> SOA +short
dig <domain> SRV +short
# Reverse DNS for IP range
dnsrecon -r <cidr>
# Brute force subdomains
dnsrecon -d <domain> -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t brt
dnsenum <domain>
fierce --domain <domain>
# Check for dangling CNAME records
dig CNAME <subdomain>
# If CNAME points to unclaimed resource (S3, Heroku, GitHub Pages, Azure) → takeover
# Automated check
subjack -w subdomains.txt -t 20 -o takeover_results.txt
nuclei -t takeovers/ -l subdomains.txt
# Check if recursion is open
dig @<target> example.com +recurse
# Test cache snooping (non-recursive query for cached records)
dig @<target> <popular_domain> +norecurse
# Unusually long subdomains or high query volume to single domain
# Tools: iodine, dnscat2 for establishing DNS tunnels