菜单
[recon] Fingerprint whether a target sits behind a WAF/CDN and which product it is. Reach for it before active testing so you know to expect/throttle around filtering and plan bypasses.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | wafw00f |
| description | [recon] Fingerprint whether a target sits behind a WAF/CDN and which product it is. Reach for it before active testing so you know to expect/throttle around filtering and plan bypasses. |
wafw00f (Python, shared venv). Sends a few benign probes and matches the
responses against signatures to identify the Web Application Firewall or CDN in
front of a target. Run it early so downstream agents know filtering is present.
403'd and you suspect a WAF.wafw00f <url> single target; -i <file> list of URLs.-a test for ALL WAFs even after a match (don't stop at first).-o out.json -f json structured output; -f csv also supported.-p proxy route through a proxy; -v/-vv verbosity.-l list all WAFs it can detect.# Fingerprint the in-scope host, check all signatures, JSON out
wafw00f https://target.example.com -a -o wafw00f.json -f json
--tamper, encoded payloads) and explains blocked requests.