agentleFS
Sign inStart free
s0ld13rrs0ld13rr/pentestcode/skills/phases/enumeration/SKILL.md

enumeration-phase

Skill884 starsChanged 4 months agoMITView on GitHub

Scanning and enumeration — port/service scan, version detection, web content discovery, tech stack fingerprint. Use when the current phase is ENUMERATION.

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Never run default-rate -p- against fragile/OT targets — negotiate rate in RoE.

    line 19

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Scanning & Enumeration

Goal: every host in scope fully mapped — ports, versions, banners, hidden surfaces. Feed results into engagement state (state_update), not just terminal scrollback.

Port scan — tunable speed vs coverage

# Fast baseline, all ports, no discovery (live hosts known)
masscan -p1-65535 --rate 1000 -oJ masscan.json TARGET
# Full service detection on discovered ports
nmap -sS -sV -sC -p- -oA nmap/full TARGET          # slow but thorough
nmap -sS -sV -p <ports> --open -oA nmap/svc TARGET  # after masscan
  • Never run default-rate -p- against fragile/OT targets — negotiate rate in RoE.
  • -Pn when ICMP is filtered; combine -sn on the whole CIDR first to find live hosts cheaply.
  • UDP top-100 minimum: nmap -sU --top-ports 100 -sV -O — SNMP/DNS/mDNS/NTP/LDAP often missed.

Service enrichment

  • NSE: --script vuln,default for triage; dangerous scripts (brute, dos, exploit) ONLY with explicit authorization.
  • SMB: nxc smb HOST (shares, signing, OS, null session) → often instant finding (signing disabled = relay).
  • SNMP: snmpwalk -v2c -c public HOST .1.3.6.1.2.1 → network layout, VLANs, VPN peers.
  • TLS: testssl.sh HOST — old TLS, weak ciphers, expired/expiring certs, heartbleed.

Web surface discovery

# Content + vhosts + params
ffuf -u https://t/FUZZ -w raft-medium-directories -mc 200,204,301,302,401,403
ffuf -u https://t/ -H "Host: FUZZ.t" -w subdomains.txt      # vhost fuzzing
arjun -u https://t/page                                        # hidden params
  • Status-code triage: 401/403 → bypass tests (X-Original-URL, method override); 301 to login = app surface.
  • Mirror interesting dirs with wget --mirror or katana (crawl + JS link extraction) — JS files hold API routes and often tokens.
  • API discovery: /swagger, /openapi.json, /graphql, /.well-known/, /api/v{1..10}/.

Tech stack

whatweb -v URL / httpx -td → CMS-specific scans (wpscan), framework CVE lookup, then version-match against Nuclei templates.

Gotchas

  • Scan results without version detail are wasted — always -sV. A raw open port is not a finding.
  • Load nuclei DURING this phase, not later: framework RCEs (Log4j, Spring4Shell, CVE-2021-*) don't show up in dir-fuzz.
  • Deduplicate into engagement state via nmap_parse / nuclei_parse tools — the exploit phase queries state_query, it does not re-scan.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free