Опишете задачата
Към всички skills

argus

awarexone · Бази данни

Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect injecti

Оригинален текст · няма потвърден превод на български
Платформи: Не са посочениНиво: Не е посоченоВ индекса: 21.09.2026 г.Обновен в GitHub: 21.09.2026 г.

Теми: ai-security · bug-bounty · bugcrowd · claude-ai · claude-code · cti · ethical-hacking · hackerone · hacking · hacking-tool · penetration-testing · recon · vulnerability-scanner

Първо прочетете инструкцията.

Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.

Оригинален SKILL.md
GitHub хранилище
Звезди на репото
5142
Лиценз
MIT
Последна проверка на записа
21.09.2026 г.

Добавете в своя инструмент.

Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.

npx skills add awarexone/Agentic-Bug-Hunter

Страницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.

Откъс от SKILL.md

Началото на файла на автора, без превод.

ARGUS — THE ALL-SEEING SCANNER SUITE

Named for Argus Panoptes, the hundred-eyed giant. Six "eyes" that surface what ordinary scans miss: two of the most common web2 classes (CORS, CRLF), the NoSQL "db" surface, JWT forging, blind-bug confirmation via OOB (the eye that sees the invisible — unblocks an entire severity band), and automated LLM red-teaming. All pure-Python, no new deps. Core logic is offline-testable.

0. ROUTING — which tool for what

Signal on the targetTool / command
API reflects Origin, or ACAO/ACAC headers seen/cors
Param reaches a redirect / Location / log / response header/crlf
JSON login or {user,pass} body, Mongo/Mongoose stack/nosqli
Authorization: Bearer ey... / JWT in cookie or storage/jwt-scan
Suspected blind SSRF/XXE/SQLi/RCE (no in-band signal)/oob
Chatbot / agent / LLM feature/llm-redteam

1. CORS — /cors

tools/cors_scanner.py https://api.target.com/me --cookie "session=..."
tools/cors_scanner.py -l recon/target.com/urls/api.txt --json

Sends crafted Origin headers, classifies Access-Control-Allow-Origin / Access-Control-Allow-Credentials:

  • CRITICAL — reflects attacker origin with ACAC: true → cookie-auth'd cross-origin read (account-data exfil).
  • HIGH — null origin trusted with credentials.
  • MEDIUM — reflects without creds (exploitable when auth = non-cookie token), or trusts http downgrade.
  • Probes suffix/prefix regex bypass (target.com.evil, notarget.com) and subdomain trust (chains with takeover).

Always pass --cookie with a live session — the credentialed path is the win.

2. CRLF / host-header — /crlf

tools/crlf_scanner.py "https://target.com/r?u=x" --host-header

Injects encoded CRLF (%0d%0a, double-encoded, UTF-8 overlong %E5%98%8A%E5%98%8D) trying to land Set-Cookie: crlftest=1 in the response. --host-header also tests Host / X-Forwarded-Host / Forwarded injection and flags attacker-host reflection in Location (password-reset poisoning). Impact: session fixation, open redirect, cache poisoning, reset poisoning.

urllib strips raw \r\n from URLs by design — the encoded variants are what actually go on the wire.

3. NoSQL injection — /nosqli

Целият SKILL.md в GitHub