菜单
[recon] Fetch every URL the Wayback Machine recorded for a domain (passive). Reach for it alongside gau to recover historical endpoints and parameterized URLs without sending traffic to the target.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | waybackurls |
| description | [recon] Fetch every URL the Wayback Machine recorded for a domain (passive). Reach for it alongside gau to recover historical endpoints and parameterized URLs without sending traffic to the target. |
waybackurls (tomnomnom, Go). Pulls all URLs the Internet Archive's Wayback
Machine has for a host. Single-source and minimal by design; run it together with
gau (which adds Common Crawl/OTX/URLScan) for fuller coverage.
waybackurls <domain> or domains on stdin (no resolution, no probing).--dates prefix each URL with its archive timestamp.--no-subs restrict to the exact host (default includes subdomains).sort -u, grep, unfurl.# Wayback URLs for the host, keep parameterized ones, de-dup
waybackurls target.example.com | grep '?' | sort -u > wayback-params.txt
# Combine with gau for broader history:
# cat wayback-params.txt gau-params.txt | sort -u > all-historical.txt