Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →fenghot/passive-recon
Passive reconnaissance: subdomain enumeration via crt.sh/DNS history, Shodan/Censys IP intelligence, favicon hash matching for tech stack, Wayback Machine URL history, WHOIS data. All free, no target contact.
Passed 7 of 22 test cases with the skill, and 15 of 22 without it.
1 fixed18 passed either way1 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
When running a Shodan search for http.favicon.hash:-306746971, which specific web framework or application stock template does this hash identify?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Spring Boot as the framework matching hash -306746971 | Missed | Passed |
The instructions your model reads when the skill loads.
不向目标发任何请求，纯被动收集。速度快（秒级），无痕迹。
# 查询证书透明度日志
curl -s "https://crt.sh/?q=%25.${TARGET}&output=json" | \
jq -r '.[].name_value' | sort -u | tee subdomains_crtsh.txt
# 也支持组织名搜索
curl -s "https://crt.sh/?q=${ORG_NAME}&output=json"
# SecurityTrails API (免费 tier 可用)
curl -s "https://api.securitytrails.com/v1/domain/${TARGET}/subdomains" \
-H "apikey: $ST_API_KEY"
# 挑选高价值子域名
grep -E 'admin|api|dev|test|staging|internal|vpn|jenkins|git|wiki' subdomains.txt
grep -E 'oss|s3|bucket|cdn|static' subdomains.txt # 云资产
相同的 favicon → 相同的技术栈。即使改了 Server header 也能识别。
import mmh3, requests, codecs
def favicon_hash(url):
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.