[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG37SD5BRV1MR2MJ424SWX":3,"skill-same:01M6AG37SD5BRV1MR2MJ424SWX":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AG37SD5BRV1MR2MJ424SWX","performing-subdomain-enumeration-with-subfinder",null,"Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"enumeration","performing subdomain enumeration with subfinder","subfinder","pr","osint","reconnaissance","attack-surface","passive-recon","security","web-application-security","t1059","t1505","web","application-security","subdomain-enumeration","bug-bounty","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-subdomain-enumeration-with-subfinder\ndescription: Enumerate subdomains of target domains using ProjectDiscovery's Subfinder\n  passive reconnaissance tool to map the attack surface during security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- subdomain-enumeration\n- reconnaissance\n- bug-bounty\n- attack-surface\n- subfinder\n- passive-recon\n- osint\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1595\n---\n\n# Performing Subdomain Enumeration with Subfinder\n\n## When to Use\n- During the reconnaissance phase of penetration testing or bug bounty hunting\n- When mapping the external attack surface of a target organization\n- Before performing vulnerability scanning on discovered subdomains\n- When building an asset inventory for continuous security monitoring\n- During red team engagements requiring passive information gathering\n\n## Prerequisites\n- Go 1.21+ installed for building from source\n- Subfinder v2 installed (`go install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest`)\n- API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)\n- Provider configuration file at `$HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml`\n- Network access to passive DNS and certificate transparency sources\n- httpx or httprobe for validating discovered subdomains\n\n## Workflow\n\n### Step 1 — Install and Configure Subfinder\n```bash\n# Install subfinder\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\n\n# Verify installation\nsubfinder -version\n\n# Configure API keys for enhanced results\nmkdir -p $HOME\u002F.config\u002Fsubfinder\ncat > $HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml \u003C\u003C 'EOF'\nshodan:\n  - YOUR_SHODAN_API_KEY\ncensys:\n  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET\nvirustotal:\n  - YOUR_VT_API_KEY\nsecuritytrails:\n  - YOUR_ST_API_KEY\nchaos:\n  - YOUR_CHAOS_API_KEY\nEOF\n```\n\n### Step 2 — Run Basic Subdomain Enumeration\n```bash\n# Single domain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Multiple domains from a file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Use all passive sources (slower but more thorough)\nsubfinder -d example.com -all -o subdomains_all.txt\n\n# Silent mode for piping to other tools\nsubfinder -d example.com -silent | httpx -silent -status-code\n```\n\n### Step 3 — Filter and Customize Source Selection\n```bash\n# Use specific sources only\nsubfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt\n\n# Exclude specific sources\nsubfinder -d example.com -es github -o results.txt\n\n# Enable recursive subdomain enumeration\nsubfinder -d example.com -recursive -o recursive_subs.txt\n\n# Match specific patterns\nsubfinder -d example.com -m \"api,dev,staging\" -o matched.txt\n```\n\n### Step 4 — Control Rate Limiting and Output Format\n```bash\n# Rate limit to avoid API throttling\nsubfinder -d example.com -rate-limit 10 -t 5 -o rate_limited.txt\n\n# JSON output for programmatic processing\nsubfinder -d example.com -oJ -o subdomains.json\n\n# Output with source information\nsubfinder -d example.com -cs -o subdomains_with_sources.txt\n\n# Collect results in a directory per domain\nsubfinder -dL domains.txt -oD .\u002Fresults\u002F\n```\n\n### Step 5 — Validate Discovered Subdomains with httpx\n```bash\n# Pipe subfinder output to httpx for live validation\nsubfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect -o live_hosts.txt\n\n# Check for specific ports\nsubfinder -d example.com -silent | httpx -ports 80,443,8080,8443 -o web_services.txt\n\n# Resolve IP addresses\nsubfinder -d example.com -silent | dnsx -a -resp -o resolved.txt\n```\n\n### Step 6 — Integrate with Broader Recon Pipeline\n```bash\n# Chain with nuclei for vulnerability scanning\nsubfinder -d example.com -silent | httpx -silent | nuclei -t cves\u002F -o vulns.txt\n\n# Combine with amass for comprehensive enumeration\nsubfinder -d example.com -o subfinder_results.txt\namass enum -passive -d example.com -o amass_results.txt\ncat subfinder_results.txt amass_results.txt | sort -u > combined_subdomains.txt\n\n# Screenshot discovered hosts\nsubfinder -d example.com -silent | httpx -silent | gowitness file -f - -P screenshots\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Passive Enumeration | Discovering subdomains without directly querying target DNS servers |\n| Certificate Transparency | Public logs of SSL\u002FTLS certificates revealing subdomain names |\n| DNS Aggregation | Collecting subdomain data from multiple passive DNS databases |\n| Recursive Enumeration | Discovering subdomains of subdomains for deeper coverage |\n| Source Providers | External APIs and databases queried for subdomain intelligence |\n| CNAME Records | Canonical name records that may reveal additional infrastructure |\n| Wildcard DNS | DNS configuration returning results for any subdomain query |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Subfinder | Primary passive subdomain enumeration engine |\n| httpx | HTTP probe tool for validating live subdomains |\n| dnsx | DNS resolution and validation toolkit |\n| Nuclei | Template-based vulnerability scanner for discovered hosts |\n| Amass | Complementary subdomain enumeration with active\u002Fpassive modes |\n| gowitness | Web screenshot utility for visual reconnaissance |\n| Shodan | Internet-wide scanning database for subdomain intelligence |\n| crt.sh | Certificate transparency log search engine |\n\n## Common Scenarios\n\n1. **Bug Bounty Reconnaissance** — Enumerate all subdomains of a target program scope to identify forgotten or misconfigured assets that may contain vulnerabilities\n2. **Attack Surface Mapping** — Build a comprehensive inventory of externally accessible subdomains for ongoing security monitoring and risk assessment\n3. **Cloud Asset Discovery** — Identify subdomains pointing to cloud services (AWS, Azure, GCP) that may be vulnerable to subdomain takeover\n4. **CI\u002FCD Integration** — Automate subdomain monitoring in pipelines to detect new subdomains and alert on changes to the attack surface\n5. **Merger & Acquisition Due Diligence** — Map the complete external footprint of an acquisition target during security assessment\n\n## Output Format\n\n```\n## Subdomain Enumeration Report\n- **Target Domain**: example.com\n- **Total Subdomains Found**: 247\n- **Live Hosts**: 183\n- **Unique IP Addresses**: 42\n- **Sources Used**: crt.sh, VirusTotal, Shodan, SecurityTrails, Censys\n\n### Discovered Subdomains\n| Subdomain | IP Address | Status Code | Technology |\n|-----------|-----------|-------------|------------|\n| api.example.com | 10.0.1.5 | 200 | Nginx, Node.js |\n| staging.example.com | 10.0.2.10 | 403 | Apache |\n| dev.example.com | 10.0.3.15 | 200 | Express |\n\n### Recommendations\n- Remove DNS records for decommissioned subdomains\n- Investigate subdomains with CNAME pointing to unclaimed services\n- Restrict access to development and staging environments\n```\n","# Performing Subdomain Enumeration with Subfinder\n\n## When to Use\n- During the reconnaissance phase of penetration testing or bug bounty hunting\n- When mapping the external attack surface of a target organization\n- Before performing vulnerability scanning on discovered subdomains\n- When building an asset inventory for continuous security monitoring\n- During red team engagements requiring passive information gathering\n\n## Prerequisites\n- Go 1.21+ installed for building from source\n- Subfinder v2 installed (`go install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest`)\n- API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)\n- Provider configuration file at `$HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml`\n- Network access to passive DNS and certificate transparency sources\n- httpx or httprobe for validating discovered subdomains\n\n## Workflow\n\n### Step 1 — Install and Configure Subfinder\n```bash\n# Install subfinder\ngo install -v github.com\u002Fprojectdiscovery\u002Fsubfinder\u002Fv2\u002Fcmd\u002Fsubfinder@latest\n\n# Verify installation\nsubfinder -version\n\n# Configure API keys for enhanced results\nmkdir -p $HOME\u002F.config\u002Fsubfinder\ncat > $HOME\u002F.config\u002Fsubfinder\u002Fprovider-config.yaml \u003C\u003C 'EOF'\nshodan:\n  - YOUR_SHODAN_API_KEY\ncensys:\n  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET\nvirustotal:\n  - YOUR_VT_API_KEY\nsecuritytrails:\n  - YOUR_ST_API_KEY\nchaos:\n  - YOUR_CHAOS_API_KEY\nEOF\n```\n\n### Step 2 — Run Basic Subdomain Enumeration\n```bash\n# Single domain enumeration\nsubfinder -d example.com -o subdomains.txt\n\n# Multiple domains from a file\nsubfinder -dL domains.txt -o all_subdomains.txt\n\n# Use all passive sources (slower but more thorough)\nsubfinder -d example.com -all -o subdomains_all.txt\n\n# Silent mode for piping to other tools\nsubfinder -d example.com -silent | httpx -silent -status-code\n```\n\n### Step 3 — Filter and Customize Source Selection\n```bash\n# Use specific sources only\nsubfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt\n\n# Exclude specific sources\nsubfinder -d example.com -es github -o results.txt\n\n# Enable recursive subdomain enumeration\nsubfinder -d example.com -recursive -o recursive_subs.txt\n\n# Match specific patterns\nsubfinder -d example.com -m \"api,dev,staging\" -o matched.txt\n```\n\n### Step 4 — Control Rate Limiting and Output Format\n```bash\n# Rate limit to avoid API throttling\nsubfinder -d example.com -rate-limit 10 -t 5 -o rate_limited.txt\n\n# JSON output for programmatic processing\nsubfinder -d example.com -oJ -o subdomains.json\n\n# Output with source information\nsubfinder -d example.com -cs -o subdomains_with_sources.txt\n\n# Collect results in a directory per domain\nsubfinder -dL domains.txt -oD .\u002Fresults\u002F\n```\n\n### Step 5 — Validate Discovered Subdomains with httpx\n```bash\n# Pipe subfinder output to httpx for live validation\nsubfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect -o live_hosts.txt\n\n# Check for specific ports\nsubfinder -d example.com -silent | httpx -ports 80,443,8080,8443 -o web_services.txt\n\n# Resolve IP addresses\nsubfinder -d example.com -silent | dnsx -a -resp -o resolved.txt\n```\n\n### Step 6 — Integrate with Broader Recon Pipeline\n```bash\n# Chain with nuclei for vulnerability scanning\nsubfinder -d example.com -silent | httpx -silent | nuclei -t cves\u002F -o vulns.txt\n\n# Combine with amass for comprehensive enumeration\nsubfinder -d example.com -o subfinder_results.txt\namass enum -passive -d example.com -o amass_results.txt\ncat subfinder_results.txt amass_results.txt | sort -u > combined_subdomains.txt\n\n# Screenshot discovered hosts\nsubfinder -d example.com -silent | httpx -silent | gowitness file -f - -P screenshots\u002F\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Passive Enumeration | Discovering subdomains without directly querying target DNS servers |\n| Certificate Transparency | Public logs of SSL\u002FTLS certificates revealing subdomain names |\n| DNS Aggregation | Collecting subdomain data from multiple passive DNS databases |\n| Recursive Enumeration | Discovering subdomains of subdomains for deeper coverage |\n| Source Providers | External APIs and databases queried for subdomain intelligence |\n| CNAME Records | Canonical name records that may reveal additional infrastructure |\n| Wildcard DNS | DNS configuration returning results for any subdomain query |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Subfinder | Primary passive subdomain enumeration engine |\n| httpx | HTTP probe tool for validating live subdomains |\n| dnsx | DNS resolution and validation toolkit |\n| Nuclei | Template-based vulnerability scanner for discovered hosts |\n| Amass | Complementary subdomain enumeration with active\u002Fpassive modes |\n| gowitness | Web screenshot utility for visual reconnaissance |\n| Shodan | Internet-wide scanning database for subdomain intelligence |\n| crt.sh | Certificate transparency log search engine |\n\n## Common Scenarios\n\n1. **Bug Bounty Reconnaissance** — Enumerate all subdomains of a target program scope to identify forgotten or misconfigured assets that may contain vulnerabilities\n2. **Attack Surface Mapping** — Build a comprehensive inventory of externally accessible subdomains for ongoing security monitoring and risk assessment\n3. **Cloud Asset Discovery** — Identify subdomains pointing to cloud services (AWS, Azure, GCP) that may be vulnerable to subdomain takeover\n4. **CI\u002FCD Integration** — Automate subdomain monitoring in pipelines to detect new subdomains and alert on changes to the attack surface\n5. **Merger & Acquisition Due Diligence** — Map the complete external footprint of an acquisition target during security assessment\n\n## Output Format\n\n```\n## Subdomain Enumeration Report\n- **Target Domain**: example.com\n- **Total Subdomains Found**: 247\n- **Live Hosts**: 183\n- **Unique IP Addresses**: 42\n- **Sources Used**: crt.sh, VirusTotal, Shodan, SecurityTrails, Censys\n\n### Discovered Subdomains\n| Subdomain | IP Address | Status Code | Technology |\n|-----------|-----------|-------------|------------|\n| api.example.com | 10.0.1.5 | 200 | Nginx, Node.js |\n| staging.example.com | 10.0.2.10 | 403 | Apache |\n| dev.example.com | 10.0.3.15 | 200 | Express |\n\n### Recommendations\n- Remove DNS records for decommissioned subdomains\n- Investigate subdomains with CNAME pointing to unclaimed services\n- Restrict access to development and staging environments\n```\n",{"name":5,"tags":46,"author":47,"domain":40,"license":15,"version":48,"nist_csf":49,"subdomain":33,"description":7,"mitre_attack":54},[38,29,39,30,26,31,28],"mahipal","1.0",[50,51,52,53],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[55,56,57,58,59],"T1190","T1059.007","T1505.003","T1083","T1595","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-subdomain-enumeration-with-subfinder",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-subdomain-enumeration-with-subfinder",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-subdomain-enumeration-with-subfinder",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-subdomain-enumeration-with-subfinder","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002FSKILL.md",true,[84,90,95,101,105,109,115],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ftemplate.md","ASSET","资产文件",1494,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Fassets\u002Ftemplate.md",{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2097,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fstandards.md",1509,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Freferences\u002Fstandards.md",{"path":106,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fworkflows.md",1627,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Freferences\u002Fworkflows.md",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fagent.py","SCRIPT","脚本",6602,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Fscripts\u002Fagent.py",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fprocess.py",5827,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-subdomain-enumeration-with-subfinder\u002Fscripts\u002Fprocess.py",[120,145,169,197,223,250],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[126],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[128,129,130,131,32,40,132,133,27,134,135,136,137,138,139,140,141,142,143,144],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,141,154,155,32,156,40,27,157,158,159,160,161,162,163,164,165,166,167,168],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,180,181,182,183,40,184,185,157,186,187,188,189,190,191,192,193,194,195,196],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[203],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,40,208,209,210,211,212,213,214,215,216,217,218,219,160,220,221,222],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[231,232,233,40,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[256],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[32,258,40,259,260,261,262,263,264,265,266,192,267,193,268,269,270,271,272,273],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]