跳到正文
cccskills
免费在 GitHub 公开

arsenal

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH
查看安装方法

包含的文件（1）

  • SKILL.md3.9 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Arsenal

Wiki-first router. On any surface/service/vuln, get the documented TOOL and PAYLOAD from the wiki BEFORE hand-rolling or recalling from memory. The lookup itself is delegated to the fast parallel engine:

-> Skill(wiki-arsenal) - quick by default (one qmd search across all four areas, cheap, fire it constantly); say "deep" / "full arsenal" for the 4-parallel-agent synthesized + cached card. It covers wiki/tools + wiki/payloads + wiki/techniques + wiki/cheatsheets and returns the tool + payload + technique + commands.

The tables below are the at-a-glance index of what wiki-arsenal pulls from - use them to sanity-check its result, not as a substitute for the lookup. Order: automated tool -> technique -> capture.

1. Tool first (from wiki/tools/ - don't improvise)

A service/surface is fingerprinted -> reach for the tool we already document for it. Have a tool for the service? Use it; do not hand-roll a curl/socket loop. ls wiki/tools/ for all 64.

Surface / serviceAutomated tools (wiki/tools/<name>.md)
Web HTTP(S)httpx, whatweb, nikto -> ffuf/feroxbuster/gobuster (content) -> katana/gau (crawl) -> arjun (params) -> nuclei (CVE/misconfig) -> dalfox (XSS) -> wpscan (WP); gowitness, burp-suite/burp-mcp
Ports / hostnmap, rustscan, naabu
DNS / subdomainssubfinder, amass, dnsx, gau
SMB / Windows / ADnetexec, responder, impacket, bloodhound/powerview, kerbrute, certipy/rubeus, evil-winrm
Login / credshydra, medusa (brute) -> hashcat, john (crack) -> jwt_tool (JWT) -> swaks (SMTP)
Post-shell privescpspy + linpeas/peass (ALWAYS, first)
Pivot / tunnelchisel, ligolo-ng
Cloudpacu, scoutsuite, roadtools, trivy
Binary / RE / pwnghidra, radare2, gdb-gef, pwntools, angr, binwalk, jadx, apktool, frida
Secrets / SAST / forensicstrufflehog, trivy, semgrep, codeql, volatility, tshark

Read the tool page for the exact flags before running; no page -> qmd_query/Skill(wiki).

2. Then technique / payload (wiki/payloads/ + wiki/cheatsheets/)

  • Vuln class -> wiki/payloads/<class>.md: sqli, xss, ssrf, ssti, xxe, idor, nosql, jwt, deserialization, command-injection, lfi-path-traversal, csrf, cors, crlf, graphql, api, auth-bypass, session, race-conditions, prototype-pollution, open-redirect, host-header, smuggling, web-cache, oauth-saml, mfa-bypass, crypto, ldap, xpath, webauthn-passkey, file-upload, imds-cloud-metadata, llm-prompt-injection, modbus, cicd.
  • Exploitation / privesc / chains -> wiki/cheatsheets/*: privesc-exploit-arsenal, cve-arsenal, attack-chains, linux-privesc / windows-privesc, default-credentials, nuclei-arsenal, sqlmap, password-attacks.

Read the matching page(s) BEFORE hand-rolling a payload/exploit. The full class-specific methodology lives in the matching hunt-* skill - hand off to it.

3. Capture the moment

Something lands (a confirmed vuln, creds, a shell, a flag) -> capture it AS it lands, not at the end. Capture is manual and live: run capture.sh (or Skill(screenshot)) into poc/ the moment a flag/shell lands, for the deliberate exploited/authed state so it can be manually reviewed.

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护，适用 Google 的隐私权政策和服务条款。

同一仓库的技能

bb-workflow

免费

Autonomous bug-bounty campaign driver. Runs a full programme end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (including which Skill and tool to run) every turn. Use when starting or resuming a bug-bounty engagement, "run the bb workflow", "hunt this program", "9-pass campaign", or when handed a *.scope wildcard to test for TIER1 findings. Single agent, refuter-verified, wiki-first, tool-first.

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

campaign-health

免费

Health check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live init->board->next smoke test. Use when setting up the workflow on a new machine, after a vault sync, when the driver misbehaves, or on "bb-health", "campaign health", "is the workflow set up", "check hooks and scripts", "why is the board not working".

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

chrome-devtools-browser

免费

Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

claude-md-improver

免费

OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

coverage

免费

Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

ctf-box

免费

Boot-to-root methodology for a full machine (THM/HTB/PG/CTF box, "get user.txt+root.txt", "root the box", "foothold to root"). Enforces basic-tool recon (nmap, nc, ffuf, nuclei, dig) before anything custom, wiki-first lookups, and ALWAYS pspy + linpeas/winpeas for privesc. Use when handed a box/IP to own end-to-end.

中文简介正在准备中。当前显示原文说明。

Encod3d-Sec/TORCH3332026年9月1日 更新

查看 Encod3d-Sec 的全部技能

报告此技能的问题