用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill recon-playbook命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
基于 SOC 职业分类
正在显示 SKILL.md
| name | recon-playbook |
| description | Use when starting or restructuring an authorized external web and API assessment. |
| version | 2.0.0 |
| license | MIT |
| platforms | ["linux","macos"] |
| compatibility | Requires curl, jq, subfinder, dnsx, httpx, katana, and optional nmap |
| tags | ["meta","recon","web","api","workflow"] |
| category | meta |
| related_skills | ["attack-patterns-reference","evidence-hygiene","offensive-osint","port-service-discovery","report-writing","subdomain-enumeration","triage-validation","web-enumeration","web2-recon"] |
Use this playbook to turn an authorized root domain or asset list into a prioritized map of web applications, APIs, authentication boundaries, and testable security hypotheses.
scope
-> assets
-> DNS and services
-> routes and client code
-> APIs and identities
-> hypotheses
-> focused validation
-> evidence and reporting
Do not use this playbook to justify activity outside the agreed scope or to run every available tool against every asset.
curl, jq, subfinder, dnsx, httpx, and katana.nmap only when IP or port discovery is in scope.export TARGET="example.test"
export OUTPUT_DIR="${OUTPUT_DIR:-./output/$TARGET}"
mkdir -p \
"$OUTPUT_DIR/assets" \
"$OUTPUT_DIR/http" \
"$OUTPUT_DIR/urls" \
"$OUTPUT_DIR/evidence"
Run each phase only after reviewing the preceding output. Keep raw source files so every hostname, URL, and hypothesis has provenance.
Keep a short operator-readable scope record beside the output:
allowed: *.example.test
excluded: status.example.test
identities: anonymous, test-user-a, test-user-b
request rate: 2 requests/second/host
state changes: synthetic records only
The scope must answer what may be tested, which identities may be used, how much traffic is acceptable, and whether a state-changing test is allowed.
subfinder -d "$TARGET" -silent \
> "$OUTPUT_DIR/assets/subfinder.txt"
curl -sS --max-time 30 \
"https://crt.sh/?q=%25.${TARGET}&output=json" \
| jq -r '.[].name_value' \
| sed 's/^\*\.//' \
> "$OUTPUT_DIR/assets/crtsh.txt"
cat "$OUTPUT_DIR/assets/subfinder.txt" \
"$OUTPUT_DIR/assets/crtsh.txt" \
| tr '[:upper:]' '[:lower:]' \
| grep -E '^[a-z0-9.-]+\.[a-z]{2,}$' \
| sort -u \
> "$OUTPUT_DIR/assets/hostnames.txt"
Review wildcard results, certificate SANs, third-party CNAMEs, and excluded assets before active probing.
dnsx \
-l "$OUTPUT_DIR/assets/hostnames.txt" \
-silent -a -aaaa -cname -json \
-o "$OUTPUT_DIR/assets/dns.jsonl"
httpx \
-l "$OUTPUT_DIR/assets/hostnames.txt" \
-threads 10 \
-rate-limit 2 \
-status-code -title -tech-detect -server -ip -cname \
-json \
-o "$OUTPUT_DIR/http/services.jsonl"
jq -r '.url // empty' "$OUTPUT_DIR/http/services.jsonl" \
| sort -u \
> "$OUTPUT_DIR/http/live-urls.txt"
Treat technology labels and banners as routing signals. Confirm important components from more than one source before associating a vulnerability.
katana \
-list "$OUTPUT_DIR/http/live-urls.txt" \
-silent -jc -kf all \
-c 2 -p 2 -rl 2 \
-o "$OUTPUT_DIR/urls/katana.txt"
grep -Ei '/api/|/graphql|swagger|openapi|/rest/' \
"$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/api-candidates.txt"
grep -Ei 'login|logout|register|reset|oauth|saml|callback|session|token' \
"$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/auth-candidates.txt"
grep -Ei '\.js([?#].*)?$' "$OUTPUT_DIR/urls/katana.txt" \
> "$OUTPUT_DIR/urls/javascript.txt"
Map current routes before adding archive sources. Historical URLs are useful for discovery, but they do not prove that an endpoint remains reachable.
For each application, record:
Authorization testing needs at least two approved identities when the claim depends on cross-user or cross-tenant access.
Use attack-patterns-reference to classify observations, then open only the
skills supported by current evidence. Common routes include:
| Observation | Follow-up skill |
|---|---|
| JavaScript bundles or source maps | js-secrets-extraction, source-leak-hunt |
| REST objects and identifiers | hunt-api-misconfig, hunt-idor |
| GraphQL endpoint | hunt-graphql |
| OAuth or SAML flow | hunt-oauth, hunt-saml |
| WordPress surface | hunt-wordpress, wordpress-plugin-hunt |
| Public service port | port-service-discovery |
| Candidate multi-step path | cross-attack-chains |
Write the hypothesis before the probe:
Expected: user A cannot read user B's synthetic object.
Test: repeat the same object request with both approved sessions.
Positive evidence: user A receives user B's object and its non-public fields.
Negative control: an unknown object returns the documented not-found response.
Stop condition: any access to non-synthetic or out-of-scope data.
Use triage-validation before reporting. A status code, scanner label, version
string, or permissive-looking header is not sufficient by itself.
For every material result, retain:
Use evidence-hygiene while testing and report-writing after validation.
200 for nonexistent sensitive paths.OUTPUT_DIR.