“reconnaissance”的搜索结果

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

中文简介正在准备中。当前显示原文说明。

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

中文简介正在准备中。当前显示原文说明。

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

中文简介正在准备中。当前显示原文说明。

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

中文简介正在准备中。当前显示英语简介。

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.

中文简介正在准备中。当前显示英语简介。

• Investigating infrastructure linked to a phishing campaign
• Adding public evidence to threat actor profiles
• Reviewing an organization's external exposure

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

中文简介正在准备中。当前显示英语简介。

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

中文简介正在准备中。当前显示英语简介。

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.

中文简介正在准备中。当前显示原文说明。

Deep OSINT reconnaissance using the MITRE ATT&CK Reconnaissance framework. Email harvesting with SMTP verification, subdomain takeover detection, certificate transparency mining, Shodan/Censys intelligence, Wayback Machine historical analysis, social media profiling, cloud storage enumeration, document metadata extraction, DNS history, credential leak checks, and passive infrastructure mapping. Uses theHarvester, amass, dnsrecon, fierce, dnstwist, dmitry, whatweb, wafw00f, exiftool, metagoofil, smtp-user-enum, swaks, waybackurls, subfinder, and crt.sh. Pure reconnaissance — no active exploitation. Produces: confidence-scored findings, infrastructure diagram, employee roster, email pattern confirmation, subdomain takeover candidates. Chains into /pentester for active testing.

中文简介正在准备中。当前显示原文说明。

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

中文简介正在准备中。当前显示原文说明。

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.

中文简介正在准备中。当前显示原文说明。

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

中文简介正在准备中。当前显示原文说明。

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

中文简介正在准备中。当前显示原文说明。

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

中文简介正在准备中。当前显示原文说明。

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

中文简介正在准备中。当前显示原文说明。

Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized penetration test
• Coordinating specialist assessment skills
• Evaluating the impact of linked vulnerabilities

Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.

中文简介正在准备中。当前显示英语简介。

• Plan a penetration test across multiple stages
• Assess how far a vulnerability could lead
• Replan from existing credentials or system access

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

中文简介正在准备中。当前显示英语简介。

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Choose and configure AI tools for Web3 security work across web applications, APIs, and Solidity contracts. Follow setup examples for reconnaissance, vulnerability validation, and proof-of-concept generation, then combine automated findings with manual review.

中文简介正在准备中。当前显示英语简介。

• Choosing AI tools for a security testing target
• Automating web application and API reconnaissance
• Preparing Solidity checks and proof-of-concept code

Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.

中文简介正在准备中。当前显示英语简介。

• Mapping an organization's publicly exposed infrastructure
• Connecting public company records and social profiles
• Investigating image locations and video evidence

Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.

中文简介正在准备中。当前显示原文说明。