菜单
[recon] Fast DNS resolver/toolkit — bulk-resolve hostnames, query record types, and run DNS brute force. Reach for it to filter a candidate subdomain list down to live, resolving hosts.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | dnsx |
| description | [recon] Fast DNS resolver/toolkit — bulk-resolve hostnames, query record types, and run DNS brute force. Reach for it to filter a candidate subdomain list down to live, resolving hosts. |
ProjectDiscovery's dnsx (pure-Go). Resolves large host lists and queries
record types at speed. Sits between subfinder (discover) and httpx (probe).
-l <file> / stdin — host list.-a -aaaa -cname -mx -ns -txt -ptr record types; -resp show the answer.-silent domains only; -json structured output.-d <domain> -w <wordlist> DNS brute force (active).-rl <n> rate limit; -t <n> concurrency; -r <resolvers.txt> custom resolvers.# Resolve candidates, keep only live hosts with their A records, as JSON
dnsx -l candidates.txt -a -cname -resp -json -rl 100 -o resolved.jsonl
-w) generates many
queries — keep -rl sane and run it only against in-scope apexes.