Autonomous web-app pentest engine — a multi-agent pipeline wielding 30+ offensive-security tools as skills, PoC-validated findings. Built on Anthropic's defending-code harness + Building Effective Agents.
Skill Claude CodeCodex
Shor's bundled generate-totp CLI (RFC 6238 TOTP / RFC 4226 HOTP). It turns a base32 MFA seed — supplied for an in-scope test account in the project's auth config — into the current 6-digit code so the agent can finish a 2FA-gated login and obtain an authenticated session. This is a login helper, not an exploit.
Skill Claude CodeCodex
Skill "hydra" from tr4m0ryp/shor, covering hydra — network login brute force, when to reach for it, key flags, safe invocation and http form example (adjust path/fields/fail-string).
Skill Claude CodeCodex
Skill "jwt_tool" from tr4m0ryp/shor, covering jwttool — jwt analysis & attacks, when to reach for it, key flags / modes, safe invocation and form field (oidc-style).
Skill Claude CodeCodex
Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…
Skill Claude CodeCodex
Headless Chromium via Playwright (installed pip install playwright && playwright install chromium, with glibc font/nss deps). Use it to interact with JS-heavy apps, complete login/SSO/multi-step flows for an authenticated session, and — critically — to prove client-side findings by observing real execution (an XSS…
Skill Claude CodeCodex
Skill "commix" from tr4m0ryp/shor, covering commix — command injection exploitation, when to reach for it, key flags, safe invocation and evidence to capture.
Skill Claude CodeCodex
Skill "nosqli" from tr4m0ryp/shor, covering nosqli — nosql injection scanner, when to reach for it, key flags, safe invocation and scan a login endpoint for nosql operator injection.
Skill Claude CodeCodex
Skill "sqlmap" from tr4m0ryp/shor, covering sqlmap — sql injection exploitation, when to reach for it, key flags, safe invocation and then, scoped extraction (one table, capped rows).
Skill Claude CodeCodex
SSTImap (Python; pinned git clone, run in place from /opt/shor/tools/SSTImap, e.g. python sstimap.py). Maintained py3 successor to tplmap. Detects the template engine and escalates SSTI to code/command execution where the engine allows. Live → exploitation phase.
Skill Claude CodeCodex
ProjectDiscovery's interactsh-client (Go, go install). Mints a unique interaction domain and records any DNS/HTTP/SMTP callback to it. The standard way to prove blind vulnerabilities: plant a unique-nonce subdomain in a payload, trigger it, and watch for the hit. Live → exploitation phase. Pairs with ssrfmap, nuclei…
Skill Claude CodeCodex
SSRFmap (Python; pinned git clone, run in place from /opt/shor/tools/SSRFmap, e.g. python ssrfmap.py). Takes a raw request file plus the SSRF-vulnerable parameter and runs modules (internal-host probe, cloud metadata, port scan, etc.). Live → exploitation phase. Honor the SSRF PoC ceiling: stop at first…
Skill Claude CodeCodex
Skill "dalfox" from tr4m0ryp/shor, covering dalfox — xss scanning & verification, when to reach for it, key flags / modes, safe invocation and evidence to capture.
Skill Claude CodeCodex
XSStrike (Python; pinned git clone, run in place from /opt/shor/tools/XSStrike, e.g. python xsstrike.py). Context-aware analysis with intelligent payload generation, reflection/DOM checks, fuzzing, and WAF fingerprinting. Secondary to dalfox; reach for it when dalfox is inconclusive or a hand-crafted bypass is needed.…
Skill Claude CodeCodex
Skill "ffuf" from tr4m0ryp/shor, covering ffuf — http fuzzer, when to reach for it, key flags, safe invocation and evidence to capture.
Skill Claude CodeCodex
ProjectDiscovery's katana (Go, built CGOENABLED=1). Crawls a live target and extracts URLs, parameters, and endpoints — including ones referenced from JS. This image uses DOM/source crawling (headless browser mode is optional and heavier).
Skill Claude CodeCodex
Skill "arjun" from tr4m0ryp/shor, covering arjun — hidden parameter discovery, when to reach for it, key flags, safe invocation and evidence to capture.
Skill Claude CodeCodex
ProjectDiscovery's dnsx (pure-Go). Resolves large host lists and queries record types at speed. Sits between subfinder (discover) and httpx (probe).
Skill Claude CodeCodex
Skill "gau" from tr4m0ryp/shor, covering gau — historical url harvesting, when to reach for it, key flags, safe invocation and evidence to capture.
Skill Claude CodeCodex
Skill "paramspider" from tr4m0ryp/shor, covering paramspider — archived parameter url mining, when to reach for it, key flags, safe invocation and evidence to capture.
Skill Claude CodeCodex
ProjectDiscovery's subfinder (pure-Go). Aggregates subdomains from passive sources (certificate transparency, passive DNS, search APIs). Passive by design: it queries third-party data sources, not the target itself.
Skill Claude CodeCodex
Skill "waybackurls" from tr4m0ryp/shor, covering waybackurls — wayback machine url dump, when to reach for it, key flags, safe invocation and wayback urls for the host, keep parameterized ones, de-dup.
Skill Claude CodeCodex
ProjectDiscovery's httpx (pure-Go). Takes a list of hosts/URLs on stdin or -l and reports which are live, with metadata. This is the recon step that converts subfinder/dnsx/naabu output into confirmed web endpoints.
Skill Claude CodeCodex
Skill "kxss" from tr4m0ryp/shor, covering kxss — reflected-xss character triage, when to reach for it, usage, safe invocation and typical chain.
Skill Claude CodeCodex
ProjectDiscovery's naabu (Go; needs libpcap for SYN scan). Built for breadth: sweep many hosts for open ports fast, then feed the survivors to nmap for the slow, accurate service/version pass.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: