eni-redteam-recon-intake
[DOCUMENTATION ONLY] [仅文档] Recon intake skill for first contact with a bare domain, URL, or IP address. Use to build an initial recon_profile and provide factual inputs for CVE lookup and attack-path routing.
- License 许可
- MIT
- 最近更新
- 2026-10-15
- Stars
- ★ 42
- Forks
- 24
01 前言 Front Matter
- name
- eni-redteam-recon-intake
- description
- [DOCUMENTATION ONLY] [仅文档] Recon intake skill for first contact with a bare domain, URL, or IP address. Use to build an initial recon_profile and provide factual inputs for CVE lookup and attack-path routing.
02 资源文件 1
- 参考文档.slo-install.json533 B
03 SKILL.md 正文
仅文档：本 Skill 提供方法与检查表，不宣称自带可执行脚本。
Recon Intake
Domain
裸域名/URL/IP 首次进入安全评估时的侦察入口。 负责从零建立目标资产画像(recon_profile)，为后续 CVE Lookup 和攻击路径分配提供事实依据。
阶段顺序：
- DNS 解析 + 存活探测
- 端口扫描 + 服务指纹
- 子域枚举
- Web 目录/敏感文件探测
- WAF/CDN 识别
- 技术栈指纹(CMS/框架/中间件版本)
Boundaries
- 不执行任何主动漏洞利用
- 不发送破坏性请求(DELETE/DROP/shutdown)
- 不进行暴力破解或密码喷洒
- 不绕过速率限制(如被限速则降速或暂停)
- 侦察深度止于信息收集，不进入漏洞验证阶段
Pivot Hints
- WAF/CDN 阻断直连 → 尝试历史 DNS、邮件头、证书搜索获取真实 IP
- 子域枚举受限 → 证书透明度日志、DNS 区域传送、关联域反查
- 目录扫描被封 → 降速、换 User-Agent、使用自定义字典
- 端口全部过滤 → 检查 IPv6、尝试常见高端口、确认目标存活
- 信息收集饱和 → 整理已有信息，输出 recon_profile 并推进到下一阶段
Exit Evidence
- Required: recon_profile, port_scan_result, service_fingerprint
- min_attempts: 4
04 同仓库更多 Skills
competition-race-condition-state-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-queue-worker-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-prompt-injection
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-pcap-protocol
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-oauth-oidc-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
competition-malware-config
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.