Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fb0sh/pentester/pentester-reconnpx skills add fb0sh/pentester --skill pentester-recongit clone --depth 1 https://github.com/fb0sh/pentesterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fb0sh/pentester/pentester-recon)<a href="https://agentmods.dev/skills/fb0sh/pentester/pentester-recon"><img src="https://agentmods.dev/badge/skills/fb0sh/pentester/pentester-recon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.01339 |
| Opus 5 | $0.00034 | $0.00669 |
| Sonnet 5 | $0.00014 | $0.00268 |
| Haiku 4.5 | $0.00007 | $0.00134 |
Grade A, and why
pentester-recon scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sI https://target.com How it starts
The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.
信息收集 Skill
执行被动和主动信息收集，构建目标画像和攻击面地图。
1. 被动侦察
不直接触碰目标，从外部信息源收集情报。
HTTP 响应分析
# 获取响应头（服务器类型、版本、WAF 指纹）
curl -sI https://target.com
# 检查安全头缺失
curl -sI https://target.com | grep -iE '(strict-transport|x-frame|x-content-type|content-security-policy)'
HTML 源码分析
# 提取技术栈标识
curl -s https://target.com | grep -iE '(generator|powered-by|framework|react|vue|angular|jquery|bootstrap)'
子域名与 DNS
# 子域名枚举
subfinder -d target.com -o subdomains.txt
# DNS 记录
dig target.com ANY
OSINT
- Shodan/Censys 搜索历史暴露端口
- Wayback Machine 查找历史页面
- GitHub/GitLab 泄露搜索
2. 主动侦察
直接探测目标，获取实时信息。
端口与服务
# 快速端口扫描
nmap -sV -sC -T4 target.com
# 全端口扫描
nmap -p- -sV -sC target.com -oA nmap-full
# UDP 服务
nmap -sU --top-ports 20 target.com
Web 技术识别
# 指纹识别
whatweb https://target.com
# Nikto 漏洞扫描
nikto -h https://target.com -o nikto.txt
# HTTP 方法检测
nikto -h target.com -Tuning 1
目录枚举
# dirsearch（优先使用，默认字典）
dirsearch -u https://target.com -e php,txt,html,bak,zip,sql
# 指定字典
dirsearch -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
# gobuster
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html
# feroxbuster 递归扫描
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
敏感文件探测
# robots.txt
curl -s https://target.com/robots.txt
# 常见敏感路径
for path in .env .git/config .git/HEAD wp-config.php.bak composer.json .DS_Store; do
curl -sI "https://target.com/$path" | head -1
done
API 端点发现
# 探测常见 API 路径
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,201,204
3. 技术栈识别
前端框架
- React:
__NEXT_DATA__,_reactRootContainer,react.js - Vue:
__vue__,vue.min.js,v-cloak - Angular:
ng-version,angular.js - jQuery:
jquery.min.js,$全局变量
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 169 lines · 68 tokens per session scan A 51ba3b8dc16c
pentester-recon is a skill published in the GitHub repository fb0sh/pentester (23 stars, last pushed 1mo ago), licensed MIT. It adds 68 tokens to every session and 1,339 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
transilience-report-style
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
firewall-review
Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped…
pentest-engagement
Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500…
attack-path-stitcher
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
coordination
Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.
hackerone
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.