[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GMHDVTP8GQ53CJS4J49C1":3,"skill-same:01M71GMHDVTP8GQ53CJS4J49C1":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":14,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M71GMHDVTP8GQ53CJS4J49C1","nikto-SKILL.md",null,">\n  Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for outdated versions of over 1,250 servers, and identifies ve","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"nikto SKILL md","skill md","nikto","for","tests","open","files","scanner","server","open-source","web","servers","source","application","2026-11-10 10:12:30",false,"---\nname: nikto-SKILL.md\ndescription: \">\\n  Nikto is an open-source web server and web application scanner\\\n  \\ that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for\\\n  \\ outdated versions of over 1,250 servers, and identifies ve\"\n---\n# Performing Web Application Scanning with Nikto\n\n## Overview\nNikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing web application scanning with nikto\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nikto installed (Perl-based, included in Kali Linux)\n- Written authorization to scan target web servers\n- Network access to target web applications\n- Understanding of HTTP\u002FHTTPS protocols\n\n## Core Concepts\n\n### What Nikto Detects\n- Server misconfigurations and dangerous default files\n- Outdated server software versions with known CVEs\n- Common CGI vulnerabilities and dangerous scripts\n- Default credentials and admin pages\n- HTTP methods that should be disabled (PUT, DELETE, TRACE)\n- SSL\u002FTLS misconfigurations and weak ciphers\n- Missing security headers (X-Frame-Options, CSP, HSTS)\n- Information disclosure through headers and error pages\n\n### Nikto vs Other Web Scanners\n| Feature | Nikto | OWASP ZAP | Burp Suite | Nuclei |\n|---------|-------|-----------|------------|--------|\n| License | Open Source | Open Source | Commercial | Open Source |\n| Focus | Server\u002FConfig | App Logic | Full Pentest | Template-Based |\n| Speed | Fast | Medium | Slow | Very Fast |\n| False Positives | Moderate | Low | Low | Low |\n| Authentication | Basic | Full | Full | Template |\n| Active Community | Yes | Yes | Yes | Yes |\n\n## Workflow\n\n### Step 1: Basic Scanning\n```bash\n# Basic scan against a target\nnikto -h https:\u002F\u002Ftarget.example.com\n\n# Scan specific port\nnikto -h target.example.com -p 8443\n\n# Scan multiple ports\nnikto -h target.example.com -p 80,443,8080,8443\n\n# Scan with SSL enforcement\nnikto -h target.example.com -ssl\n\n# Scan from a host list file\nnikto -h targets.txt\n```\n\n### Step 2: Advanced Scanning Options\n```bash\n# Comprehensive scan with all tuning options\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -Tuning 123456789abcde \\\n  -timeout 10 \\\n  -Pause 2 \\\n  -Display V \\\n  -output report.html \\\n  -Format htm\n\n# Tuning options control test types:\n# 0 - File Upload\n# 1 - Interesting File \u002F Seen in logs\n# 2 - Misconfiguration \u002F Default File\n# 3 - Information Disclosure\n# 4 - Injection (XSS\u002FScript\u002FHTML)\n# 5 - Remote File Retrieval - Inside Web Root\n# 6 - Denial of Service\n# 7 - Remote File Retrieval - Server Wide\n# 8 - Command Execution \u002F Remote Shell\n# 9 - SQL Injection\n# a - Authentication Bypass\n# b - Software Identification\n# c - Remote Source Inclusion\n# d - WebService\n# e - Administrative Console\n\n# Scan with specific tuning (XSS + SQL injection + auth bypass)\nnikto -h https:\u002F\u002Ftarget.example.com -Tuning 49a\n\n# Scan with authentication\nnikto -h https:\u002F\u002Ftarget.example.com -id admin:password\n\n# Scan through a proxy\nnikto -h https:\u002F\u002Ftarget.example.com -useproxy http:\u002F\u002Fproxy:8080\n\n# Scan with custom User-Agent\nnikto -h https:\u002F\u002Ftarget.example.com -useragent \"Mozilla\u002F5.0 (Security Scan)\"\n\n# Scan specific CGI directories\nnikto -h https:\u002F\u002Ftarget.example.com -Cgidirs \u002Fcgi-bin\u002F,\u002Fscripts\u002F\n\n# Evasion techniques (IDS avoidance for authorized testing)\n# 1-Random URI encoding, 2-Directory self-reference\n# 3-Premature URL ending, 4-Prepend long random string\nnikto -h https:\u002F\u002Ftarget.example.com -evasion 1234\n```\n\n### Step 3: Output and Reporting\n```bash\n# Generate multiple output formats\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.csv -Format csv\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.xml -Format xml\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.html -Format htm\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.txt -Format txt\n\n# JSON output (newer versions)\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.json -Format json\n\n# Save to multiple formats simultaneously\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -output scan_report \\\n  -Format htm\n```\n\n### Step 4: Scan Multiple Targets\n```bash\n# Create targets file (one per line)\ncat > targets.txt \u003C\u003C 'EOF'\nhttps:\u002F\u002Fapp1.example.com\nhttps:\u002F\u002Fapp2.example.com:8443\nhttp:\u002F\u002Finternal-app.corp.local\n192.168.1.100:8080\nEOF\n\n# Scan all targets\nnikto -h targets.txt -output multi_scan.html -Format htm\n\n# Parallel scanning with GNU parallel\ncat targets.txt | parallel -j 5 \"nikto -h {} -output {\u002F}_report.html -Format htm\"\n```\n\n### Step 5: SSL\u002FTLS Assessment\n```bash\n# Comprehensive SSL scan\nnikto -h https:\u002F\u002Ftarget.example.com -ssl \\\n  -Tuning b \\\n  -Display V\n\n# Check for specific SSL vulnerabilities\n# Nikto checks for:\n# - Expired certificates\n# - Self-signed certificates\n# - Weak cipher suites\n# - SSLv2\u002FSSLv3 enabled\n# - BEAST, POODLE, Heartbleed indicators\n# - Missing HSTS header\n```\n\n### Step 6: Integration with Other Tools\n```bash\n# Pipe Nmap results into Nikto\nnmap -p 80,443,8080 --open -oG - 192.168.1.0\u002F24 | \\\n  awk '\u002Fopen\u002F{print $2}' | \\\n  while read host; do nikto -h \"$host\" -output \"${host}_nikto.html\" -Format htm; done\n\n# Export to Metasploit-compatible format\nnikto -h target.example.com -output msf_import.xml -Format xml\n\n# Parse Nikto XML output with Python for custom reporting\npython3 -c \"\nimport xml.etree.ElementTree as ET\ntree = ET.parse('scan.xml')\nfor item in tree.findall('.\u002F\u002Fitem'):\n    print(f\\\"[{item.get('id')}] {item.findtext('description', '')[:100]}\\\")\n\"\n```\n\n## Interpreting Results\n\n### Severity Classification\n- **OSVDB\u002FCVE References**: Cross-reference with NVD for CVSS scores\n- **Server Information Disclosure**: Version banners, technology stack\n- **Dangerous HTTP Methods**: PUT, DELETE, TRACE enabled\n- **Default\u002FBackup Files**: .bak, .old, .swp, web.config.bak\n- **Admin Interfaces**: \u002Fadmin, \u002Fmanager, \u002Fconsole exposed\n- **Missing Security Headers**: CSP, X-Frame-Options, HSTS\n\n### Common False Positives\n- Generic checks triggered by custom 404 pages\n- Anti-CSRF tokens flagged as form vulnerabilities\n- CDN\u002FWAF responses misidentified as vulnerable\n- Load balancer health check pages\n\n## Best Practices\n1. Always obtain written authorization before scanning\n2. Run Nikto in conjunction with application-level scanners (ZAP, Burp)\n3. Use -Pause flag to reduce load on production servers\n4. Validate findings manually before reporting\n5. Combine with SSL testing tools (testssl.sh, sslyze) for comprehensive coverage\n6. Schedule regular scans as part of continuous vulnerability management\n7. Keep Nikto database updated for latest vulnerability checks\n8. Use appropriate evasion settings only for authorized IDS testing\n\n## Common Pitfalls\n- Running Nikto without authorization (legal liability)\n- Treating Nikto as a complete web application scanner (it focuses on server\u002Fconfig issues)\n- Not validating results leading to false positive reports\n- Scanning too aggressively against production systems\n- Ignoring SSL\u002FTLS findings as \"informational\"\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- scanning-apis-for-security-vulnerabilities\n- performing-network-vulnerability-assessment\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"nikto\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Performing Web Application Scanning with Nikto\n\n## Overview\nNikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing web application scanning with nikto\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nikto installed (Perl-based, included in Kali Linux)\n- Written authorization to scan target web servers\n- Network access to target web applications\n- Understanding of HTTP\u002FHTTPS protocols\n\n## Core Concepts\n\n### What Nikto Detects\n- Server misconfigurations and dangerous default files\n- Outdated server software versions with known CVEs\n- Common CGI vulnerabilities and dangerous scripts\n- Default credentials and admin pages\n- HTTP methods that should be disabled (PUT, DELETE, TRACE)\n- SSL\u002FTLS misconfigurations and weak ciphers\n- Missing security headers (X-Frame-Options, CSP, HSTS)\n- Information disclosure through headers and error pages\n\n### Nikto vs Other Web Scanners\n| Feature | Nikto | OWASP ZAP | Burp Suite | Nuclei |\n|---------|-------|-----------|------------|--------|\n| License | Open Source | Open Source | Commercial | Open Source |\n| Focus | Server\u002FConfig | App Logic | Full Pentest | Template-Based |\n| Speed | Fast | Medium | Slow | Very Fast |\n| False Positives | Moderate | Low | Low | Low |\n| Authentication | Basic | Full | Full | Template |\n| Active Community | Yes | Yes | Yes | Yes |\n\n## Workflow\n\n### Step 1: Basic Scanning\n```bash\n# Basic scan against a target\nnikto -h https:\u002F\u002Ftarget.example.com\n\n# Scan specific port\nnikto -h target.example.com -p 8443\n\n# Scan multiple ports\nnikto -h target.example.com -p 80,443,8080,8443\n\n# Scan with SSL enforcement\nnikto -h target.example.com -ssl\n\n# Scan from a host list file\nnikto -h targets.txt\n```\n\n### Step 2: Advanced Scanning Options\n```bash\n# Comprehensive scan with all tuning options\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -Tuning 123456789abcde \\\n  -timeout 10 \\\n  -Pause 2 \\\n  -Display V \\\n  -output report.html \\\n  -Format htm\n\n# Tuning options control test types:\n# 0 - File Upload\n# 1 - Interesting File \u002F Seen in logs\n# 2 - Misconfiguration \u002F Default File\n# 3 - Information Disclosure\n# 4 - Injection (XSS\u002FScript\u002FHTML)\n# 5 - Remote File Retrieval - Inside Web Root\n# 6 - Denial of Service\n# 7 - Remote File Retrieval - Server Wide\n# 8 - Command Execution \u002F Remote Shell\n# 9 - SQL Injection\n# a - Authentication Bypass\n# b - Software Identification\n# c - Remote Source Inclusion\n# d - WebService\n# e - Administrative Console\n\n# Scan with specific tuning (XSS + SQL injection + auth bypass)\nnikto -h https:\u002F\u002Ftarget.example.com -Tuning 49a\n\n# Scan with authentication\nnikto -h https:\u002F\u002Ftarget.example.com -id admin:password\n\n# Scan through a proxy\nnikto -h https:\u002F\u002Ftarget.example.com -useproxy http:\u002F\u002Fproxy:8080\n\n# Scan with custom User-Agent\nnikto -h https:\u002F\u002Ftarget.example.com -useragent \"Mozilla\u002F5.0 (Security Scan)\"\n\n# Scan specific CGI directories\nnikto -h https:\u002F\u002Ftarget.example.com -Cgidirs \u002Fcgi-bin\u002F,\u002Fscripts\u002F\n\n# Evasion techniques (IDS avoidance for authorized testing)\n# 1-Random URI encoding, 2-Directory self-reference\n# 3-Premature URL ending, 4-Prepend long random string\nnikto -h https:\u002F\u002Ftarget.example.com -evasion 1234\n```\n\n### Step 3: Output and Reporting\n```bash\n# Generate multiple output formats\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.csv -Format csv\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.xml -Format xml\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.html -Format htm\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.txt -Format txt\n\n# JSON output (newer versions)\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.json -Format json\n\n# Save to multiple formats simultaneously\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -output scan_report \\\n  -Format htm\n```\n\n### Step 4: Scan Multiple Targets\n```bash\n# Create targets file (one per line)\ncat > targets.txt \u003C\u003C 'EOF'\nhttps:\u002F\u002Fapp1.example.com\nhttps:\u002F\u002Fapp2.example.com:8443\nhttp:\u002F\u002Finternal-app.corp.local\n192.168.1.100:8080\nEOF\n\n# Scan all targets\nnikto -h targets.txt -output multi_scan.html -Format htm\n\n# Parallel scanning with GNU parallel\ncat targets.txt | parallel -j 5 \"nikto -h {} -output {\u002F}_report.html -Format htm\"\n```\n\n### Step 5: SSL\u002FTLS Assessment\n```bash\n# Comprehensive SSL scan\nnikto -h https:\u002F\u002Ftarget.example.com -ssl \\\n  -Tuning b \\\n  -Display V\n\n# Check for specific SSL vulnerabilities\n# Nikto checks for:\n# - Expired certificates\n# - Self-signed certificates\n# - Weak cipher suites\n# - SSLv2\u002FSSLv3 enabled\n# - BEAST, POODLE, Heartbleed indicators\n# - Missing HSTS header\n```\n\n### Step 6: Integration with Other Tools\n```bash\n# Pipe Nmap results into Nikto\nnmap -p 80,443,8080 --open -oG - 192.168.1.0\u002F24 | \\\n  awk '\u002Fopen\u002F{print $2}' | \\\n  while read host; do nikto -h \"$host\" -output \"${host}_nikto.html\" -Format htm; done\n\n# Export to Metasploit-compatible format\nnikto -h target.example.com -output msf_import.xml -Format xml\n\n# Parse Nikto XML output with Python for custom reporting\npython3 -c \"\nimport xml.etree.ElementTree as ET\ntree = ET.parse('scan.xml')\nfor item in tree.findall('.\u002F\u002Fitem'):\n    print(f\\\"[{item.get('id')}] {item.findtext('description', '')[:100]}\\\")\n\"\n```\n\n## Interpreting Results\n\n### Severity Classification\n- **OSVDB\u002FCVE References**: Cross-reference with NVD for CVSS scores\n- **Server Information Disclosure**: Version banners, technology stack\n- **Dangerous HTTP Methods**: PUT, DELETE, TRACE enabled\n- **Default\u002FBackup Files**: .bak, .old, .swp, web.config.bak\n- **Admin Interfaces**: \u002Fadmin, \u002Fmanager, \u002Fconsole exposed\n- **Missing Security Headers**: CSP, X-Frame-Options, HSTS\n\n### Common False Positives\n- Generic checks triggered by custom 404 pages\n- Anti-CSRF tokens flagged as form vulnerabilities\n- CDN\u002FWAF responses misidentified as vulnerable\n- Load balancer health check pages\n\n## Best Practices\n1. Always obtain written authorization before scanning\n2. Run Nikto in conjunction with application-level scanners (ZAP, Burp)\n3. Use -Pause flag to reduce load on production servers\n4. Validate findings manually before reporting\n5. Combine with SSL testing tools (testssl.sh, sslyze) for comprehensive coverage\n6. Schedule regular scans as part of continuous vulnerability management\n7. Keep Nikto database updated for latest vulnerability checks\n8. Use appropriate evasion settings only for authorized IDS testing\n\n## Common Pitfalls\n- Running Nikto without authorization (legal liability)\n- Treating Nikto as a complete web application scanner (it focuses on server\u002Fconfig issues)\n- Not validating results leading to false positive reports\n- Scanning too aggressively against production systems\n- Ignoring SSL\u002FTLS findings as \"informational\"\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- scanning-apis-for-security-vulnerabilities\n- performing-network-vulnerability-assessment\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"nikto\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvulnerabilities\u002Fscanning\u002Fnikto","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill nikto-SKILL.md",{"tool":56,"command":57},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill nikto-SKILL.md",{"tool":59,"command":60},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill nikto-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002FSKILL.md",true,[64,70,74,80,84,87,91,95,101,104],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"assets\u002Findex.json","ASSET","资产文件",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Fassets\u002Findex.json",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md",1033,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"index.json","REFERENCE","参考文档",1462,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Findex.json",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md",1772,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":68,"sourceHtmlUrl":86},"references\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Freferences\u002Findex.json",{"path":88,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fstandards.md",2166,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Freferences\u002Fstandards.md",{"path":92,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fworkflows.md",2128,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Freferences\u002Fworkflows.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",5394,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Fscripts\u002Fagent.py",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":68,"sourceHtmlUrl":103},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Fscripts\u002Findex.json",{"path":105,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fprocess.py",12297,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvulnerabilities\u002Fscanning\u002Fnikto\u002Fscripts\u002Fprocess.py",[109,135,158,180,202,218],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":38},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":38},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[142,116,143,119,144,145,146,133,147,148,149,150,151,152,121,153,154,155,156,157],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":38},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[165,166,167,168,169,170,133,147,171,148,172,173,121,155,174,175,176,177,178,179],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":38},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[117,187,188,189,190,191,192,122,193,133,134,194,195,196,197,198,199,200,201,121],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":38},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[209,210,117,211,189,191,212,122,213,193,133,134,148,214,215,216,217,201,121,123],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":224,"publishedAt":38},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[225,117,189,226,212,122,227,228,133,134,229,230,231,232,233,234,121,123,235,236],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]