菜单
[recon] Probe a list of hosts/URLs for live HTTP(S) services and fingerprint them (status, title, tech, TLS). Reach for it to turn raw subdomains/ports into a confirmed live-web attack surface.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | httpx |
| description | [recon] Probe a list of hosts/URLs for live HTTP(S) services and fingerprint them (status, title, tech, TLS). Reach for it to turn raw subdomains/ports into a confirmed live-web attack surface. |
ProjectDiscovery's httpx (pure-Go). Takes a list of hosts/URLs on stdin or
-l and reports which are live, with metadata. This is the recon step that
converts subfinder/dnsx/naabu output into confirmed web endpoints.
-l <file> / stdin — input list of hosts or URLs.-sc status-code, -title, -td tech-detect (Wappalyzer), -server Server header.-cl content-length, -location redirect target, -ip, -cname.-json structured output (one JSON object per line) — prefer for parsing.-rl <n> rate limit (requests/sec); -threads <n> concurrency.-mc 200,302 match status codes; -fc 404 filter codes.-follow-redirects (off by default).# Probe discovered hosts, emit JSON, rate-limited, in-scope only
httpx -l hosts.txt -json -sc -title -td -server -ip \
-rl 20 -threads 25 -timeout 10 -o httpx.jsonl
Single host: echo target.example.com | httpx -json -td -sc -title.
url, status_code, title, tech, webserver, a/cname.-rl modest (≤ a few dozen/sec per host); httpx fans out wide by default.
Honor per-host rate limits; stop on repeated timeouts/429.