jinyimeng01/mastermind-bug-bounty/passive-recon

Claude Code and agent skill by jinyimeng01/mastermind-bug-bounty

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

Passive reconnaissance: subdomain enumeration via crt.sh/DNS history, Shodan/Censys IP intelligence, favicon hash matching for tech stack, Wayback Machine URL history, WHOIS data. All free, no target contact.

Install

npx vskill@latest install jinyimeng01/mastermind-bug-bounty/passive-recon

SKILL.md

Passive Recon — 被动信息收集

Core Principle

不向目标发任何请求，纯被动收集。速度快（秒级），无痕迹。

1. Subdomain Discovery

crt.sh (Certificate Transparency)
bash
# 查询证书透明度日志
curl -s "https://crt.sh/?q=%25.${TARGET}&output=json" | \
  jq -r '.[].name_value' | sort -u | tee subdomains_crtsh.txt
 
# 也支持组织名搜索
curl -s "https://crt.sh/?q=${ORG_NAME}&output=json"
DNS Dumpster / SecurityTrails (可选)
bash
# SecurityTrails API (免费 tier 可用)
curl -s "https://api.securitytrails.com/v1/domain/${TARGET}/subdomains" \
  -H "apikey: $ST_API_KEY"
快速价值判断
bash
# 挑选高价值子域名
grep -E 'admin|api|dev|test|staging|internal|vpn|jenkins|git|wiki' subdomains.txt
grep -E 'oss|s3|bucket|cdn|static' subdomains.txt  # 云资产

2. Favicon Hash Matching

相同的 favicon → 相同的技术栈。即使改了 Server header 也能识别。

python
import mmh3, requests, codecs
def favicon_hash(url):
    resp = requests.get(f"{url}/favicon.ico")
    favicon_b64 = codecs.encode(resp.content, 'base64')
    return mmh3.hash(favicon_b64)
# 与已知指纹库比对
# shodan.io 的 favicon hash 数据库
# 例: -1273094408 → Apache Tomcat
#      -306746971  → Spring Boot

3. Wayback Machine URL History

bash
# 获取目标历史上所有 URL
curl -s "https://web.archive.org/cdx/search/cdx?url=*.${TARGET}/*&output=text&fl=original&collapse=urlkey" | \
  tee wayback_urls.txt
 
# 提取 JS 文件 (可能包含旧版本、未删除的测试端点)
grep '\.js$' wayback_urls.txt > wayback_js.txt
 
# 提取 API 路径
grep -E '/api/|/v[0-9]/|/graphql' wayback_urls.txt > wayback_apis.txt
 
# 提取敏感路径
grep -E 'admin|config|backup|test|debug|\.env|\.yml|\.json' wayback_urls.txt

4. Shodan / Censys (IP Intelligence)

bash
# Shodan CLI
shodan domain $TARGET            # → IPs + 开放端口
shodan host $IP                  # → 服务版本、SSL 证书
 
# 无需认证的基础搜索
# 直接在浏览器搜: shodan.io → "org:Company Name"

5. Google Dork Quick Hits

site:target.com inurl:admin
site:target.com ext:json
site:target.com ext:log
site:target.com intitle:"index of"
site:target.com "password" filetype:txt
site:target.com "BEGIN RSA PRIVATE KEY"
site:github.com "target.com" "password"

6. 输出整合

把被动收集的结果注入 Recon agent:

subdomains_crtsh.txt  → 加入子域名扫列表
wayback_apis.txt      → 加入 API 端点清单
wayback_js.txt        → 下载历史 JS 版本
favicon hash          → 确认技术栈指纹
Shodan IP/端口        → 加入端口扫描清单
Google dork hits      → 加入源码泄露搜索

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/jinyimeng01/mastermind-bug-bounty/passive-recon/badge)](https://verified-skill.com/skills/jinyimeng01/mastermind-bug-bounty/passive-recon)

Something wrong with this skill or its page? Tell us.