一键在 Manus 中运行任何 Skill

katana

星标6

分支2

更新时间2026年6月3日 05:58

[recon] Crawl a live web app to enumerate URLs, endpoints, JS-referenced paths, and forms. Reach for it to build the in-app URL/endpoint inventory that feeds param discovery, fuzzing, and DAST.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

tr4m0ryp

tr4m0ryp/shor

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

katana — web crawler / endpoint discovery

ProjectDiscovery's katana (Go, built CGO_ENABLED=1). Crawls a live target and extracts URLs, parameters, and endpoints — including ones referenced from JS. This image uses DOM/source crawling (headless browser mode is optional and heavier).

When to reach for it

After httpx confirms a live host, to map its actual URL/endpoint surface.
To extract links, query params, and API paths for arjun/ffuf/nuclei to act on.
To pull endpoints out of inline and external JavaScript.

Key flags

-u <url> / -list <file> seed targets.
-d <n> crawl depth; -jc crawl JS files; -kf robotstxt,sitemapxml known files.
-fs fqdn field-scope to the seed host (stay on-target); -crawl-scope/-crawl-out-scope regex.
-rl <n> rate limit; -c <n> concurrency; -timeout <s>.
-jsonl structured output; -f url,qurl output fields (e.g. only URLs with query params).
-headless browser mode (heavier; needs chromium) — usually unnecessary here.

Safe invocation

# Depth-3 crawl incl. JS, scoped to the host, rate-limited, JSONL out
katana -u https://target.example.com -d 3 -jc -fs fqdn \
  -rl 15 -c 10 -jsonl -o katana.jsonl

Evidence to capture

The endpoint/URL inventory (esp. URLs with query params → injection candidates).
New paths not in the recon map; JS-sourced API routes.

Scope & rate caveats

Crawl ONLY the in-scope host; set -fs fqdn (or scope regex) so links to third-party domains are not followed and hit.
A crawler issues many requests and may trigger state-changing GET endpoints — keep -rl modest; honor per-host limits; stop on 429.
Authenticated crawling: drive auth separately, then crawl with the session.

同仓库更多 Skills

同仓库

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

name	katana
description	[recon] Crawl a live web app to enumerate URLs, endpoints, JS-referenced paths, and forms. Reach for it to build the in-app URL/endpoint inventory that feeds param discovery, fuzzing, and DAST.

katana — web crawler / endpoint discovery

When to reach for it

After httpx confirms a live host, to map its actual URL/endpoint surface.
To extract links, query params, and API paths for arjun/ffuf/nuclei to act on.
To pull endpoints out of inline and external JavaScript.

Key flags

-u <url> / -list <file> seed targets.
-d <n> crawl depth; -jc crawl JS files; -kf robotstxt,sitemapxml known files.
-fs fqdn field-scope to the seed host (stay on-target); -crawl-scope/-crawl-out-scope regex.
-rl <n> rate limit; -c <n> concurrency; -timeout <s>.
-jsonl structured output; -f url,qurl output fields (e.g. only URLs with query params).
-headless browser mode (heavier; needs chromium) — usually unnecessary here.

Safe invocation

# Depth-3 crawl incl. JS, scoped to the host, rate-limited, JSONL out
katana -u https://target.example.com -d 3 -jc -fs fqdn \
  -rl 15 -c 10 -jsonl -o katana.jsonl

Evidence to capture

The endpoint/URL inventory (esp. URLs with query params → injection candidates).
New paths not in the recon map; JS-sourced API routes.

Scope & rate caveats

Crawl ONLY the in-scope host; set -fs fqdn (or scope regex) so links to third-party domains are not followed and hit.
A crawler issues many requests and may trigger state-changing GET endpoints — keep -rl modest; honor per-host limits; stop on 429.
Authenticated crawling: drive auth separately, then crawl with the session.