[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6XFPVTZGR8ABEVWQX2P3ZQV":3,"skill-same:01M6XFPVTZGR8ABEVWQX2P3ZQV":46},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":6,"ownerDescription":30,"updatedAt":31,"install":32,"resources":45},"01M6XFPVTZGR8ABEVWQX2P3ZQV","surface-discovery",null,"iwiels\u002FAuditForge","iwiels","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F158532848?v=4","01M6XFKRHHEEHGWZ3KJJ5T4P0N","Victor Celadita","01M6XFKRQAK6XEREZWKENFRBMR",2,"MIT","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fsurface-discovery\u002FSKILL.md",[],[18,19],"discovery","surface discovery","2026-11-10 10:12:30",false,"# Skill: Surface Discovery & Recon\n\n**Categoría:** recon  \n**Metodología base:** PTES Intelligence Gathering, OWASP Testing Guide OTG-INFO  \n**Cuándo activar:** inicio de cualquier engagement antes de cualquier análisis activo\n\n---\n\n## Protocolo\n\n### Fase 1 — Definición de perímetro\n\nAntes de tocar el target, establecé el mapa mental del sistema:\n\n```\n¿Qué está explícitamente en scope?\n¿Hay subdominios, APIs secundarias, o entornos (staging, dev) incluidos?\n¿Hay restricciones explícitas (no tocar \u002Fadmin, no autenticarse)?\n```\n\nEjecutá `memory.search` con `scope`, `authorized`, `engagement` para recuperar contexto previo. Si no existe, solicitalo antes de continuar.\n\n### Fase 2 — Stack fingerprinting pasivo\n\nIdentificá el stack tecnológico sin interacción activa:\n\n**Headers HTTP a inspeccionar:**\n- `Server`, `X-Powered-By`, `X-Generator`, `X-Frame-Options` (ausencia es un hallazgo)\n- `Set-Cookie` — flags `HttpOnly`, `Secure`, `SameSite`, nombre de la cookie (PHPSESSID, JSESSIONID revelan stack)\n- `Content-Security-Policy` — ausencia o política débil (`unsafe-inline`, `*`) es MEDIO\n- `Strict-Transport-Security` — ausencia es BAJO, mal configurado es MEDIO\n\n**Archivos de fingerprinting:**\n- `\u002Frobots.txt` — rutas excluidas son superficie de ataque\n- `\u002Fsecurity.txt` (RFC 9116) — presencia indica madurez; ausencia es informativo\n- `\u002F.well-known\u002F` — puede exponer configuración ACME, WebFinger, OAuth metadata\n- `\u002Fsitemap.xml` — enumera endpoints sin autenticación\n- `\u002F.git\u002F` — si accesible, CRÍTICO (extracción de código fuente)\n- `\u002Fapi\u002F`, `\u002Fapi\u002Fv1\u002F`, `\u002Fapi\u002Fdocs`, `\u002Fswagger.json`, `\u002Fopenapi.yaml` — superficie API\n\n**CMS y frameworks:**\n- WordPress: `\u002Fwp-login.php`, `\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers`, `readme.html`\n- Django: páginas de error con traceback, `\u002Fadmin\u002F`\n- Laravel: `.env` expuesto, `storage\u002Flogs\u002Flaravel.log`\n- Next.js\u002FNuxt: `\u002F_next\u002Fstatic\u002F`, `\u002F__nuxt\u002F`\n\n### Fase 3 — Enumeración de assets\n\nConstruí un inventario estructurado:\n\n```\nASSET INVENTORY\n───────────────\n[URL]           https:\u002F\u002Ftarget.com\n[STACK]         Nginx 1.24 \u002F Node.js \u002F React\n[ENDPOINTS]     \u002Fapi\u002Fv2\u002F* (REST), \u002Fgraphql (GraphQL)\n[AUTH]          JWT Bearer tokens, \u002Fauth\u002Flogin\n[ADMIN]         \u002Fadmin (responde 403 — confirmar bypass)\n[EXPOSURES]     \u002Frobots.txt lista \u002Finternal, \u002Fbackup\n[COOKIES]       session= (falta Secure flag)\n```\n\n### Fase 4 — Priorización de superficie\n\nClasifica cada asset por potencial de impacto:\n\n| Prioridad | Criterio | Acción |\n|-----------|----------|--------|\n| P0 | Admin panels, autenticación, API keys expuestos | Investigar inmediatamente |\n| P1 | APIs sin documentación, endpoints de upload, GraphQL | Delegar a security-web |\n| P2 | Endpoints autenticados, funciones de negocio | Queue para web-triage |\n| P3 | Assets estáticos, páginas públicas | Registrar, baja prioridad |\n\n### Fase 5 — Subdomain enumeration (pasiva)\n\nSin herramientas activas:\n- Revisar certificado SSL\u002FTLS: Subject Alternative Names revelan subdominios\n- DNS histórico: consultar Certificate Transparency logs (crt.sh)\n- Archivos JS del frontend: URLs hardcodeadas de APIs internas\n- Respuestas de error: stack traces con hostnames internos\n\n### Fase 6 — Output estructurado\n\nAl finalizar esta skill, producí:\n\n```markdown\n## Surface Discovery Report\n\n**Target:** [target]\n**Fecha:** [fecha]\n**Stack detectado:** [stack]\n\n### Assets identificados\n[lista priorizada]\n\n### Hallazgos inmediatos\n[findings con severidad]\n\n### Próximos pasos recomendados\n- Delegar [X] a security-web\n- Delegar [Y] a security-supply\n```\n\n---\n\n## Anti-patterns a evitar\n\n- ❌ Asumir que un endpoint en `\u002Frobots.txt` no existe porque está excluido\n- ❌ Ignorar headers de respuesta — contienen más información que el body en el recon inicial\n- ❌ Marcar \"sin hallazgos\" sin haber revisado los archivos de fingerprinting estándar\n- ❌ Enumerar subdominios con herramientas activas sin autorización explícita\n",{},"main","3dcdc209fd438fe5d7c93bbe7ad5cac3e07f1cf4","internal\u002Fassets\u002Fskills\u002Fsurface-discovery",0,"https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge","https:\u002F\u002Fgithub.com\u002Fiwiels","Security Software Development","2026-07-20 11:57:06",{"source":7,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add iwiels\u002FAuditForge --skill surface-discovery",{"tool":38,"command":39},"bunx","bunx skills add iwiels\u002FAuditForge --skill surface-discovery",{"tool":41,"command":42},"pnpm","pnpm dlx skills add iwiels\u002FAuditForge --skill surface-discovery","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fsurface-discovery\u002FSKILL.md",true,[],[47,56,64,73,81,90],{"skillNo":48,"name":49,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":50,"categories":51,"keywords":52,"publishedAt":20},"01M6XFQH7JDSESRYJ5P4T02NQG","web-triage","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fweb-triage\u002FSKILL.md",[],[53,54,55],"web triage","web","triage",{"skillNo":57,"name":58,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":20},"01M6XFQE1DM24X8HYNWZ848B5Y","web-js-intel","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fweb-js-intel\u002FSKILL.md",[],[62,63,54],"web js intel","js",{"skillNo":65,"name":66,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":20},"01M6XFQ9QGEH0R1FHCXXPBWZTN","vulnerability-correlation","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fvulnerability-correlation\u002FSKILL.md",[],[70,71,72],"vulnerability correlation","vulnerability","correlation",{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":20},"01M6XFQ5NZYNW0MJESZP0SM9EC","tls-vhost-enum","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Ftls-vhost-enum\u002FSKILL.md",[],[79,80],"tls vhost enum","tls",{"skillNo":82,"name":83,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":20},"01M6XFQ11YZC3G4BW8A7AF918Y","threat-modeling","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fthreat-modeling\u002FSKILL.md",[],[87,88,89],"modeling","threat","threat modeling",{"skillNo":91,"name":92,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":20},"01M6XFPPNY58KNBF06RZPER34M","supply-chain-triage","https:\u002F\u002Fgithub.com\u002Fiwiels\u002FAuditForge\u002Fblob\u002Fmain\u002Finternal\u002Fassets\u002Fskills\u002Fsupply-chain-triage\u002FSKILL.md",[],[55,96,97,98,99],"supply chain triage","supply","chain","supply chain"]