# Pentest Hacktricks Finder

> Support skill for HackTricks technique research, payload ideas, bypasses, prerequisites, caveats, and edge-case behavior across web, network, cloud, and application security topics. Use as owner only when research is the current blocker.

- Skill: `crtvrffnrt/pentest-hacktricks-finder` (Agent Skill)
- Install (CLI): `npx skillmds@latest add crtvrffnrt/pentest-hacktricks-finder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/crtvrffnrt/pentest-hacktricks-finder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: crtvrffnrt (https://skillmd.com/u/crtvrffnrt)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/crtvrffnrt/pentest-hacktricks-finder

---


# HackTricks Search Skill

## Purpose

Use this skill to reliably discover and extract the most relevant HackTricks pages for a given technique, vulnerability class, bypass, or exploitation workflow across the main and cloud HackTricks properties, then pull the exact sections needed (payloads, prerequisites, caveats, and defensive notes).
Keep this as a support skill for technique, payload, bypass, and edge-case research unless the current owner phase is explicitly research.

HackTricks can be inconsistently indexed across search engines. This skill therefore defines two search backends:

1. Primary: Exa-based web search with strict site scoping.
2. Secondary: DuckDuckGo dorks with strict site scoping and noise reduction.
3. Verification: GitHub repository search against the upstream HackTricks repositories.

Use the secondary backend when:
- Exa results are sparse or irrelevant.
- You need very tight matching by title/path/keyword.
- You want reproducible dork sets for common vuln classes.

## Scope Guardrails

Only target content under:

```text
https://hacktricks.wiki/
https://book.hacktricks.wiki/en/
https://cloud.hacktricks.wiki/
https://github.com/HackTricks-wiki/hacktricks
https://github.com/HackTricks-wiki/hacktricks-cloud
```

Treat `hacktricks.wiki` as the current canonical host for the main wiki and `book.hacktricks.wiki` as the legacy path when both appear. Avoid unrelated mirrors, translations, or cached copies unless explicitly requested.

## Inputs

- Topic: a short phrase describing the target, example: “DOM XSS bypass”, “XXE parameter entities”, “CSRF SameSite bypass”.
- Optional: vuln class (XSS, XXE, CSRF, SSRF, SSTI, IDOR, Smuggling, Deserialization, Cloud).
- Optional: constraints (framework, language, cloud provider, WAF, browser).

## Workflow

1. **Search**: Execute Exa first. If results are shallow, use DDG dorks or Exa to query DDG.
2. **Verify**: Cross-check the result against the related upstream GitHub repository when possible:
   - `https://github.com/HackTricks-wiki/hacktricks` for `hacktricks.wiki` and legacy `book.hacktricks.wiki`
   - `https://github.com/HackTricks-wiki/hacktricks-cloud` for `cloud.hacktricks.wiki`
3. **Fetch**: Use the **`web_fetch`** tool for HackTricks URLs. **DO NOT** use `read_file`.
4. **Extract**: Focus on:
   - Payloads and variants
   - Preconditions / limitations (e.g., IMDSv2, TTL, Hop Limit)
   - Bypass techniques
   - Detection / hardening notes
5. **Pivot**: If a page is an index or high-level overview (like `cloud-ssrf.html`), perform a follow-up search or fetch sub-pages mentioned in the text for specific payloads (e.g., ECS vs EC2).
6. **Double-check**: If the wiki result looks incomplete, outdated, or ambiguous, search the matching GitHub repository directly for the same slug, title, or unique phrase and compare the repository source to the rendered page.
7. **Return**:
   - The selected URLs
   - The extracted payloads / steps
   - Any prerequisites and constraints

## Backend A: Exa Search (Primary)

### Generic pattern

```javascript
web_search_exa({
  query: "site:hacktricks.wiki OR site:book.hacktricks.wiki/en OR site:cloud.hacktricks.wiki <topic>",
  include: ["https://hacktricks.wiki/*", "https://book.hacktricks.wiki/en/*", "https://cloud.hacktricks.wiki/*"]
})
```

### Tighten results (recommended)

```javascript
web_search_exa({
  query: "site:hacktricks.wiki OR site:book.hacktricks.wiki/en OR site:cloud.hacktricks.wiki (<high-entropy keywords>) (<bypass|payload|trick|technique>)",
  include: ["https://hacktricks.wiki/*", "https://book.hacktricks.wiki/en/*", "https://cloud.hacktricks.wiki/*"]
})
```

Notes:
- Prefer 1–3 high-entropy tokens over long keyword chains (page slugs, function names, CVE IDs, unique headings).
- If Exa returns index pages, pivot to deeper subpages under the same directory.

## Backend B: DuckDuckGo Dorking (Secondary)

DuckDuckGo query semantics are not identical to Google “dorking”. Adjust how you construct queries:

- Do not assume implicit AND across space-separated terms. Use high-entropy anchors (slugs, quoted phrases, intitle/inurl).
- DuckDuckGo can relax constraints and show “related results” if an operator-heavy query yields few/no hits. When this happens, tighten with slugs/quotes rather than adding generic keywords.
- `+term` is a relevance boost, not a strict requirement.
- Prefer `site:` + `inurl:` / `intitle:` + quoted phrase + negative filters over boolean-style chains.

Supported operators you should rely on:
- Quotes for exact phrases
- Exclusion `-term` and `-site:example.com`
- `site:`, `inurl:`, `intitle:`, `filetype:` (limited set)

### Baseline template (DDG-correct)

```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/ <high-entropy tokens> -inurl:/print -inurl:/index -inurl:/tags
```

## Targeted Search Playbooks (Slug-first)

These playbooks are designed to work well with DuckDuckGo by anchoring on stable HackTricks slugs and directories.

### XSS playbook
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/pentesting-web/xss-cross-site-scripting/ (csp OR waf OR bypass OR payload) -inurl:/print -inurl:/index
```

### XXE playbook
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/pentesting-web/ inurl:xxe-xee-xml-external-entity (DTD OR "parameter entity" OR payload) -inurl:/print -inurl:/index
```

### SSRF playbook (Including Cloud)
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/pentesting-web/ssrf-server-side-request-forgery/ (metadata OR cloud OR "169.254" OR "169.254.170.2" OR bypass) -inurl:/print -inurl:/index
```

### Cloud Pentesting Playbook (AWS/GCP/Azure)
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/ (pentesting-web OR pentesting-cloud) (aws OR gcp OR azure) (ssrf OR privilege OR "metadata-service" OR iam) -inurl:/print -inurl:/index
```

## Backend C: GitHub Repository Verification

Use GitHub as a double-check source when search results are inconsistent, the wiki page is sparse, or you need the authoritative upstream text.

### Main wiki repository
```text
repo:HackTricks-wiki/hacktricks <topic OR slug OR unique phrase>
```

### Cloud wiki repository
```text
repo:HackTricks-wiki/hacktricks-cloud <topic OR slug OR unique phrase>
```

Verification notes:
- Prefer the repository file or rendered markdown that matches the wiki slug.
- Use the repository to confirm naming, section order, and edge-case details when search engines disagree.
- If the wiki and repository diverge, treat the repository as the source of truth for the upstream text and note the mismatch.

### SSTI playbook
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/pentesting-web/ssti-server-side-template-injection/ (payload OR bypass OR sandbox) -inurl:/print -inurl:/index
```

### IDOR playbook
```text
(site:hacktricks.wiki OR site:book.hacktricks.wiki OR site:cloud.hacktricks.wiki) inurl:/en/pentesting-web/ (idor OR "insecure direct object reference" OR "broken access control") -inurl:/print -inurl:/index
```

## Verification Checklist (Before Fetch)

- URL is on one of the HackTricks properties and matches the intended technique.
- If the wiki page is on `hacktricks.wiki`, confirm whether it also exists in `github.com/HackTricks-wiki/hacktricks`.
- If the wiki page is on `cloud.hacktricks.wiki`, confirm whether it also exists in `github.com/HackTricks-wiki/hacktricks-cloud`.
- The slug matches the intended vuln class (or at least the intended technique).
- The page is not an index-only aggregator when you need payload detail.
- If DuckDuckGo returns “related results”, reduce generic terms and increase specificity (slug + quoted phrase).

## Fetch and Extraction

After selecting URLs, **always use `web_fetch`**. Extract:
- Section headers that contain payloads, bypasses, PoCs
- Any prerequisites (versions, libraries, browser constraints)
- Any “gotchas” (encoding, parsing differences, WAF behaviors, Cloud-specific hurdles like IMDSv2 tokens)

Return results in a minimal structure:

```json
{
  "topic": "<topic>",
  "selected_urls": [
    "https://hacktricks.wiki/...",
    "https://book.hacktricks.wiki/en/..."
  ],
  "extracted": [
    {
      "url": "https://hacktricks.wiki/...",
      "sections": ["<header 1>", "<header 2>"],
      "payloads_or_steps": ["<payload/step 1>", "<payload/step 2>"],
      "constraints": ["<constraint 1>", "<constraint 2>"]
    }
  ]
}
```

## Notes for Pentesters

- Prefer subtree-restricted searches first (example: xss-cross-site-scripting, ssrf-server-side-request-forgery).
- **Pivot Strategy**: If a page mentions an environment variable (e.g., `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`), look for the section explaining how to leak it.
- **IMDSv2 Note**: Always check if a payload requires a `PUT` request for a token (IMDSv2) or if it's a simple `GET` (IMDSv1).
- When you find a strong index page, pivot to deeper subpages under the same directory for payload detail.