subfinder -d target.com -silent -all | sort -u > subs.txt
httpx -l subs.txt -silent -status-code -tech-detect | tee live-hosts.txt
gau target.com | sort -u > historical-urls.txt
waybackurls target.com | sort -u >> historical-urls.txt
grep -E "\?.*=" historical-urls.txt > params.txt
grep -iE "api|admin|internal|debug|test|staging" historical-urls.txt > interesting.txt
curl -sI https://target.com | grep -iE "server|x-powered|x-runtime|x-generator"
ffuf -u https://target.com/FUZZ -w wordlists/common.txt -mc 200,301,302,403
ffuf -u https://target.com/api/FUZZ -w wordlists/api-endpoints.txt -mc 200,401,403,405
katana -u https://target.com -d 3 -jc -ef css,png,jpg,gif | grep "\.js$" | sort -u > js-files.txt
# Grep for secrets and endpoints in downloaded JS
grep -rohE '/api/[a-zA-Z0-9/_-]+' downloaded-js/ | sort -u
recon/<target>/
├── live-hosts.txt — verified live hosts with tech
├── urls.txt — all discovered URLs
├── api-endpoints.txt — API paths
├── js-analysis.txt — secrets and endpoints from JS
├── idor-candidates.txt — URLs with ID parameters
├── ssrf-candidates.txt — URLs with URL/redirect parameters
└── tech-stack.txt — technology summary
# IDOR candidates:
grep -E '/[0-9]+|id=|user_id=|order_id=' urls.txt > idor-candidates.txt
# SSRF candidates:
grep -iE 'url=|uri=|redirect=|next=|dest=|callback=' urls.txt > ssrf-candidates.txt
After recon: run /surface for P1/P2/Kill ranking.
AFaffaan-m/ECC278k近 7 天新增 4,046 个 star
DIDietrichGebert/ponytail162k近 7 天新增 5,405 个 star
DIDietrichGebert/ponytail162k近 7 天新增 5,405 个 star
DIDietrichGebert/ponytail162k近 7 天新增 5,405 个 star
GAgarrytan/gstack136k近 7 天新增 883 个 star
按 OWASP Top 10 检查输入处理、登录和依赖，加固代码。
ADaddyosmani/agent-skills106k近 7 天新增 3,628 个 star