recon-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Recon Security

侦察安全

This skill guides an agent through an authorized external pentest workflow: recon, normalization, active discovery, web and infrastructure checks, validation, scoped exploitation (when RoE allows), and reporting. Use only free/open-source tools unless the user explicitly opts into commercial services outside this skill.

Do not assume permission. Gate every active, invasive, or state-changing step on Pass 0. This skill is model-guided only: propose commands and workflows; the user or agent runs them when scope and mode allow. No bundled scripts ship with this skill.

本 skill 指导 Agent 完成一项经授权的外部 pentest 工作流：资产侦察、目标规范化、主动发现、Web 与基础设施检查、验证、受控范围内的漏洞利用（在 RoE 允许时）以及报告编写。除非用户明确选择使用本 skill 之外的商业服务，否则仅使用免费/开源工具。

不要假定已获得许可。每一个主动、侵入性或会改变状态的步骤都必须以通过 Pass 0 为前提。本 skill 仅由模型指导：负责提出命令和工作流；当范围与模式允许时，由用户或 Agent 执行。本 skill 不附带任何打包脚本。

Engagement lifecycle

项目生命周期

text

Pass 0 Scope/RoE → Pass 1 Passive → Pass 2 Normalize → Pass 3 Active
    → Pass 4 Web + infra → Pass 5 Triage → Pass 6 Validation
    → Pass 7 Scoped exploitation (if approved) → Pass 8 Report

text

Pass 0 Scope/RoE → Pass 1 Passive → Pass 2 Normalize → Pass 3 Active
    → Pass 4 Web + infra → Pass 5 Triage → Pass 6 Validation
    → Pass 7 Scoped exploitation (if approved) → Pass 8 Report

Mental model

思维模型

Recon maps what is exposed.
Validation proves what matters with minimal reproducible evidence.
Exploitation demonstrates impact only within written RoE — not unrestricted attack.

Prefer conservative, reproducible checks. One confirmed finding beats dozens of scanner lines.

资产侦察（Recon） 绘制对外暴露的资产。
验证（Validation） 使用最少且可复现的证据证明真正重要的问题。
漏洞利用（Exploitation） 仅在书面 RoE 范围内证明影响，而非进行不受限制的攻击。

优先采用保守且可复现的检查。一个已确认发现胜过扫描器输出的几十行结果。

Pass 0: scope and authorization

Pass 0：范围与授权

Establish before any active work:

In-scope domains, subdomains, IPs, ASNs, apps, and environments (prod vs staging).
Out-of-scope assets and forbidden techniques (brute force, DoS, data dump, lateral movement).
Written authorization or explicit ownership.
Scan intensity: passive only, light active, standard, or deep.
Whether exploitation and credential testing are allowed.

Evidence directory (

PROJECT_DIR

, default

~/Projects/pentest-engagement

). See

references/environment-setup.md

Deliverable: command plan only, executed tests, or full report.

If authorization is unclear, stop at passive planning and ask.

开始任何主动工作前，必须明确以下事项：

范围内的域名、子域名、IP、ASN、应用和环境（生产环境与预发布环境）。
范围外资产和禁止使用的技术（暴力破解、DoS、数据导出、横向移动）。
书面授权或明确的所有权证明。
扫描强度：仅被动、轻量主动、标准或深度。
是否允许漏洞利用和凭据测试。

证据目录（

PROJECT_DIR

，默认值为

~/Projects/pentest-engagement

）。参见

references/environment-setup.md

。

交付物：仅命令计划、已执行的测试或完整报告。

如果授权情况不明确，停止在被动规划阶段并询问用户。

Pass 1: passive recon

Pass 1：被动侦察

Build inventory from public sources only:

DNS, WHOIS/RDAP, RIPEstat/BGPView, certificate transparency (
```
crt.sh
```
,
```
subfinder
```
,
```
amass -passive
```
,
```
assetfinder
```
).
Historical URLs (
```
gau
```
,
```
waybackurls
```
, Common Crawl, public
```
urlscan.io
```
).
Search dorks and public code references (no secret copying).

Use example commands from

references/environment-setup.md

and

references/tools.md

when the user wants executable steps.

仅使用公开来源建立资产清单：

DNS、WHOIS/RDAP、RIPEstat/BGPView、证书透明度（
```
crt.sh
```
、
```
subfinder
```
、
```
amass -passive
```
、
```
assetfinder
```
）。
历史 URL（
```
gau
```
、
```
waybackurls
```
、Common Crawl、公开的
```
urlscan.io
```
）。
搜索 dork 和公开代码引用（不得复制任何密钥）。

当用户需要可执行步骤时，使用

references/environment-setup.md

和

references/tools.md

中的示例命令。

Pass 2: normalize targets

Pass 2：目标规范化

Produce working lists under

targets/

domains.txt

in_scope_domains.txt

resolved_hosts.txt

web_targets.txt

ips.txt

```
needs-scope-confirmation.txt
```
for uncertain assets

Deduplicate; drop unrelated CT names and out-of-scope SaaS unless approved.

在

targets/

下生成可用列表：

domains.txt

、

in_scope_domains.txt

、

resolved_hosts.txt

、

web_targets.txt

、

ips.txt

```
needs-scope-confirmation.txt
```
，用于存放范围不确定的资产

对目标去重；删除无关的 CT 名称和范围外的 SaaS，除非已获批准。

Pass 3: active recon

Pass 3：主动侦察

Requires Pass 0 approval. Rate-limit all probes.

```
dnsx
```
,
```
httpx
```
,
```
nmap
```
(top ports first), optional
```
naabu
```
/ rate-limited
```
masscan
```
```
wafw00f
```
,
```
testssl.sh
```
or
```
sslyze
```
,
```
nuclei
```
(open templates; triage as leads)

Propose rate-limited active commands; save raw output under

evidence/active/

必须先通过 Pass 0。对所有探测进行限速。

```
dnsx
```
、
```
httpx
```
、
```
nmap
```
（优先扫描常用端口），可选使用
```
naabu
```
或限速的
```
masscan
```
```
wafw00f
```
、
```
testssl.sh
```
或
```
sslyze
```
、
```
nuclei
```
（使用开放模板，并将结果作为线索进行分类）

提出限速的主动扫描命令；将原始输出保存至

evidence/active/

。

Pass 4: web app and infrastructure checks

Pass 4：Web 应用与基础设施检查

Web applications

Web 应用

Fingerprint headers, cookies, security headers, technologies.
Misconfigurations:
```
.git
```
,
```
.env
```
, backups,
```
phpinfo
```
, directory listing,
```
robots.txt
```
.
Content/parameter discovery:
```
ffuf
```
,
```
feroxbuster
```
,
```
arjun
```
,
```
katana
```
,
```
hakrawler
```
.
Light automated probes;
```
sqlmap
```
detection-only by default;
```
dalfox
```
for reflected XSS leads.
Manual proxy review: OWASP ZAP or Burp Suite Community.

Walk through fingerprinting, misconfiguration checks, and light probes for each priority URL.

识别 headers、cookies、安全 headers 和技术栈。
检查配置错误：
```
.git
```
、
```
.env
```
、备份文件、
```
phpinfo
```
、目录列表、
```
robots.txt
```
。
发现内容和参数：
```
ffuf
```
、
```
feroxbuster
```
、
```
arjun
```
、
```
katana
```
、
```
hakrawler
```
。
执行轻量自动化探测；
```
sqlmap
```
默认仅用于检测；
```
dalfox
```
用于查找反射型 XSS 线索。
手动代理审查：OWASP ZAP 或 Burp Suite Community。

针对每个优先级 URL，逐步完成指纹识别、配置错误检查和轻量探测。

Infrastructure (when in scope)

基础设施（在范围内时）

Telecom, storage, and file services often appear on external pentests:

SIP/VoIP: UDP/TCP 5060/5061,
```
nmap --script=sip-methods
```
, OPTIONS probes. No call setup unless authorized.
NAS/file exposure: ports 445, 139, 548, 873, 2049, 5000/5001, 8080;
```
smbclient -N -L
```
,
```
showmount -e
```
. Document share permissions, not customer file contents.

Save SIP/NAS results under

evidence/infra/

电信、存储和文件服务经常出现在外部 pentest 中：

SIP/VoIP：UDP/TCP 5060/5061、
```
nmap --script=sip-methods
```
、OPTIONS 探测。未经授权不得建立呼叫。
NAS/文件暴露：端口 445、139、548、873、2049、5000/5001、8080；
```
smbclient -N -L
```
、
```
showmount -e
```
。记录共享权限，不要访问客户文件内容。

将 SIP/NAS 结果保存至

evidence/infra/

。

Pass 5: triage and evidence

Pass 5：分类与证据

Classify every item:

Class	Meaning
Confirmed finding	Reproduced with clear evidence and impact
Likely finding	Strong signal; needs Pass 6
Lead	Interesting; not yet tested
False positive / OOS	Drop from report

Build a prioritized queue for validation. Store under

evidence/triage/

. Never paste secrets or bulk PII into reports.

对每一项进行分类：

类别	含义
已确认发现	已复现，并有明确证据和影响
疑似发现	强烈信号；需要通过 Pass 6 验证
线索	有价值，但尚未测试
误报 / OOS	从报告中删除

建立用于验证的优先级队列，并存储于

evidence/triage/

。切勿在报告中粘贴任何密钥或批量 PII。

Pass 6: validation

Pass 6：验证

Turn leads into confirmed findings. Read

references/validation.md

Import
```
web_targets.txt
```
into Burp or ZAP; map auth and roles.
Manually confirm nuclei/ffuf/sqlmap signals.
Two-account testing for IDOR/BOLA; pair with
```
authz-security
```
when code is available.
Infrastructure: focused port/service re-checks; SIP/NAS proof without data theft.

PoC bar: numbered steps, request/response or screenshot, impact, fix.

将线索转化为已确认发现。阅读

references/validation.md

。

将
```
web_targets.txt
```
导入 Burp 或 ZAP；梳理认证机制和角色。
手动确认 nuclei/ffuf/sqlmap 信号。
使用两个账户测试 IDOR/BOLA；如果可以获得代码，则结合
```
authz-security
```
使用。
基础设施：针对特定端口或服务重新检查；在不窃取数据的情况下验证 SIP/NAS。

PoC 标准：编号步骤、请求/响应或截图、影响、修复方案。

Pass 7: scoped exploitation

Pass 7：受控范围内的漏洞利用

Only when Pass 0 explicitly allows exploitation. Read

references/exploitation-roe.md

Minimum proof of impact (one row, one harmless upload, one auth bypass with test accounts).
No
```
--dump
```
, persistence, lateral movement, or destructive actions unless contract permits.
Remove test artifacts when cleanup is required.
Stop and escalate if scope, production risk, or legal boundaries are unclear.

仅当 Pass 0 明确允许漏洞利用时执行。阅读

references/exploitation-roe.md

。

以最小方式证明影响（读取一行数据、执行一次无害上传、使用测试账户完成一次身份验证绕过）。
除非合同明确允许，否则不得使用
```
--dump
```
、建立持久化、横向移动或执行破坏性操作。
需要清理时，移除测试产生的痕迹。
如果范围、生产风险或法律边界不明确，则停止并升级处理。

Pass 8: reporting

Pass 8：报告

Use

references/report-template.md

. Include:

Executive summary and scope
Methodology by phase (passive, active, validation, exploitation if run)
Findings by severity with reproduction and remediation
Leads and limitations
Remediation roadmap (immediate / short / long term)

使用

references/report-template.md

。应包括：

执行摘要和范围
各阶段的方法（被动、主动、验证，以及已执行时的漏洞利用）
按严重程度分类的发现、复现步骤和修复方案
线索和限制
修复路线图（即时、短期和长期）

Severity scale

严重程度等级

P0: Sensitive data exposure, unauthenticated admin/control, confirmed critical exploit path.
P1: High-impact issue with limited preconditions; confirmed injection or authz break without mass extraction.
P2: Medium exposure or hardening gap without confirmed exploit chain.
P3: Informational, hygiene, or scan limitations.

P0：敏感数据泄露、未经身份验证即可访问管理或控制功能、已确认的关键漏洞利用路径。
P1：前置条件有限的高影响问题；在未进行批量提取的情况下，已确认存在注入或授权绕过。
P2：中等程度的暴露或加固缺口，但未确认完整的漏洞利用链。
P3：信息性问题、安全卫生问题或扫描局限。

Output format

输出格式

[P1] exposed-admin-panel on https://admin.example.com
  Evidence: httpx + manual browser review; headers in evidence/webapp/.
  Impact: Public admin surface increases credential and exploit risk.
  Fix: Restrict by VPN/IdP, enforce MFA, monitor access.

[P1] exposed-admin-panel on https://admin.example.com
  Evidence: httpx + manual browser review; headers in evidence/webapp/.
  Impact: Public admin surface increases credential and exploit risk.
  Fix: Restrict by VPN/IdP, enforce MFA, monitor access.

Reference files

参考文件

```
references/tools.md
```
— approved tools and commercial exclusions
```
references/checklist.md
```
— full engagement checklist
```
references/environment-setup.md
```
— macOS setup and directory layout
```
references/validation.md
```
— manual validation and PoC bar
```
references/exploitation-roe.md
```
— allowed/prohibited exploitation boundaries
```
references/report-template.md
```
— final deliverable structure

```
references/tools.md
```
— 已批准的工具及商业服务排除项
```
references/checklist.md
```
— 完整的项目检查清单
```
references/environment-setup.md
```
— macOS 设置和目录结构
```
references/validation.md
```
— 手动验证流程和 PoC 标准
```
references/exploitation-roe.md
```
— 允许和禁止的漏洞利用边界
```
references/report-template.md
```
— 最终交付物结构

What this skill won't do

本 skill 不会执行的操作

Require Shodan, Censys, DeHashed, IntelX, or Burp Pro.
Treat scanner output as confirmed without Pass 6.
Run exploitation, dumping, persistence, or lateral movement without explicit RoE approval.
Bypass authorization or test out-of-scope assets.

强制要求使用 Shodan、Censys、DeHashed、IntelX 或 Burp Pro。
未经 Pass 6 验证便将扫描器输出视为已确认发现。
未经 RoE 明确批准便执行漏洞利用、数据导出、建立持久化或横向移动。
绕过授权或测试范围外资产。