[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG4VZZFS8QVMCW2YMDNY2P":3,"skill-same:01M6AG4VZZFS8QVMCW2YMDNY2P":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AG4VZZFS8QVMCW2YMDNY2P","performing-web-application-scanning-with-nikto",null,"Runs Nikto, an open-source web server and web application scanner, to test over 7,000 potentially dangerous files\u002Fprograms, check for outdated versions across 1,250+ servers, and identify XSS, SQL injection, misconfigurations, default credentials, and vulnerable CGI scripts. Use when performing web application vulnerability scanning, security assessments, scheduled security testing, or validating web server security controls.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"performing web application scanning with nikto","web","vulnerability-management","web-scanning","nikto","vulnerability","credentials","risk","xss","injection","owasp","testing","server","cve","vulnerability scanning","sql","test","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-web-application-scanning-with-nikto\ndescription: Runs Nikto, an open-source web server and web application scanner,\n  to test over 7,000 potentially dangerous files\u002Fprograms, check for outdated versions\n  across 1,250+ servers, and identify XSS, SQL injection, misconfigurations, default\n  credentials, and vulnerable CGI scripts. Use when performing web application vulnerability\n  scanning, security assessments, scheduled security testing, or validating web\n  server security controls.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- vulnerability-management\n- cve\n- nikto\n- web-scanning\n- owasp\n- risk\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n# Performing Web Application Scanning with Nikto\n\n## Overview\nNikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing web application scanning with nikto\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nikto installed (Perl-based, included in Kali Linux)\n- Written authorization to scan target web servers\n- Network access to target web applications\n- Understanding of HTTP\u002FHTTPS protocols\n\n## Core Concepts\n\n### What Nikto Detects\n- Server misconfigurations and dangerous default files\n- Outdated server software versions with known CVEs\n- Common CGI vulnerabilities and dangerous scripts\n- Default credentials and admin pages\n- HTTP methods that should be disabled (PUT, DELETE, TRACE)\n- SSL\u002FTLS misconfigurations and weak ciphers\n- Missing security headers (X-Frame-Options, CSP, HSTS)\n- Information disclosure through headers and error pages\n\n### Nikto vs Other Web Scanners\n| Feature | Nikto | OWASP ZAP | Burp Suite | Nuclei |\n|---------|-------|-----------|------------|--------|\n| License | Open Source | Open Source | Commercial | Open Source |\n| Focus | Server\u002FConfig | App Logic | Full Pentest | Template-Based |\n| Speed | Fast | Medium | Slow | Very Fast |\n| False Positives | Moderate | Low | Low | Low |\n| Authentication | Basic | Full | Full | Template |\n| Active Community | Yes | Yes | Yes | Yes |\n\n## Workflow\n\n### Step 1: Basic Scanning\n```bash\n# Basic scan against a target\nnikto -h https:\u002F\u002Ftarget.example.com\n\n# Scan specific port\nnikto -h target.example.com -p 8443\n\n# Scan multiple ports\nnikto -h target.example.com -p 80,443,8080,8443\n\n# Scan with SSL enforcement\nnikto -h target.example.com -ssl\n\n# Scan from a host list file\nnikto -h targets.txt\n```\n\n### Step 2: Advanced Scanning Options\n```bash\n# Comprehensive scan with all tuning options\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -Tuning 123456789abcde \\\n  -timeout 10 \\\n  -Pause 2 \\\n  -Display V \\\n  -output report.html \\\n  -Format htm\n\n# Tuning options control test types:\n# 0 - File Upload\n# 1 - Interesting File \u002F Seen in logs\n# 2 - Misconfiguration \u002F Default File\n# 3 - Information Disclosure\n# 4 - Injection (XSS\u002FScript\u002FHTML)\n# 5 - Remote File Retrieval - Inside Web Root\n# 6 - Denial of Service\n# 7 - Remote File Retrieval - Server Wide\n# 8 - Command Execution \u002F Remote Shell\n# 9 - SQL Injection\n# a - Authentication Bypass\n# b - Software Identification\n# c - Remote Source Inclusion\n# d - WebService\n# e - Administrative Console\n\n# Scan with specific tuning (XSS + SQL injection + auth bypass)\nnikto -h https:\u002F\u002Ftarget.example.com -Tuning 49a\n\n# Scan with authentication\nnikto -h https:\u002F\u002Ftarget.example.com -id admin:password\n\n# Scan through a proxy\nnikto -h https:\u002F\u002Ftarget.example.com -useproxy http:\u002F\u002Fproxy:8080\n\n# Scan with custom User-Agent\nnikto -h https:\u002F\u002Ftarget.example.com -useragent \"Mozilla\u002F5.0 (Security Scan)\"\n\n# Scan specific CGI directories\nnikto -h https:\u002F\u002Ftarget.example.com -Cgidirs \u002Fcgi-bin\u002F,\u002Fscripts\u002F\n\n# Evasion techniques (IDS avoidance for authorized testing)\n# 1-Random URI encoding, 2-Directory self-reference\n# 3-Premature URL ending, 4-Prepend long random string\nnikto -h https:\u002F\u002Ftarget.example.com -evasion 1234\n```\n\n### Step 3: Output and Reporting\n```bash\n# Generate multiple output formats\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.csv -Format csv\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.xml -Format xml\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.html -Format htm\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.txt -Format txt\n\n# JSON output (newer versions)\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.json -Format json\n\n# Save to multiple formats simultaneously\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -output scan_report \\\n  -Format htm\n```\n\n### Step 4: Scan Multiple Targets\n```bash\n# Create targets file (one per line)\ncat > targets.txt \u003C\u003C 'EOF'\nhttps:\u002F\u002Fapp1.example.com\nhttps:\u002F\u002Fapp2.example.com:8443\nhttp:\u002F\u002Finternal-app.corp.local\n192.168.1.100:8080\nEOF\n\n# Scan all targets\nnikto -h targets.txt -output multi_scan.html -Format htm\n\n# Parallel scanning with GNU parallel\ncat targets.txt | parallel -j 5 \"nikto -h {} -output {\u002F}_report.html -Format htm\"\n```\n\n### Step 5: SSL\u002FTLS Assessment\n```bash\n# Comprehensive SSL scan\nnikto -h https:\u002F\u002Ftarget.example.com -ssl \\\n  -Tuning b \\\n  -Display V\n\n# Check for specific SSL vulnerabilities\n# Nikto checks for:\n# - Expired certificates\n# - Self-signed certificates\n# - Weak cipher suites\n# - SSLv2\u002FSSLv3 enabled\n# - BEAST, POODLE, Heartbleed indicators\n# - Missing HSTS header\n```\n\n### Step 6: Integration with Other Tools\n```bash\n# Pipe Nmap results into Nikto\nnmap -p 80,443,8080 --open -oG - 192.168.1.0\u002F24 | \\\n  awk '\u002Fopen\u002F{print $2}' | \\\n  while read host; do nikto -h \"$host\" -output \"${host}_nikto.html\" -Format htm; done\n\n# Export to Metasploit-compatible format\nnikto -h target.example.com -output msf_import.xml -Format xml\n\n# Parse Nikto XML output with Python for custom reporting\npython3 -c \"\nimport xml.etree.ElementTree as ET\ntree = ET.parse('scan.xml')\nfor item in tree.findall('.\u002F\u002Fitem'):\n    print(f\\\"[{item.get('id')}] {item.findtext('description', '')[:100]}\\\")\n\"\n```\n\n## Interpreting Results\n\n### Severity Classification\n- **OSVDB\u002FCVE References**: Cross-reference with NVD for CVSS scores\n- **Server Information Disclosure**: Version banners, technology stack\n- **Dangerous HTTP Methods**: PUT, DELETE, TRACE enabled\n- **Default\u002FBackup Files**: .bak, .old, .swp, web.config.bak\n- **Admin Interfaces**: \u002Fadmin, \u002Fmanager, \u002Fconsole exposed\n- **Missing Security Headers**: CSP, X-Frame-Options, HSTS\n\n### Common False Positives\n- Generic checks triggered by custom 404 pages\n- Anti-CSRF tokens flagged as form vulnerabilities\n- CDN\u002FWAF responses misidentified as vulnerable\n- Load balancer health check pages\n\n## Best Practices\n1. Always obtain written authorization before scanning\n2. Run Nikto in conjunction with application-level scanners (ZAP, Burp)\n3. Use -Pause flag to reduce load on production servers\n4. Validate findings manually before reporting\n5. Combine with SSL testing tools (testssl.sh, sslyze) for comprehensive coverage\n6. Schedule regular scans as part of continuous vulnerability management\n7. Keep Nikto database updated for latest vulnerability checks\n8. Use appropriate evasion settings only for authorized IDS testing\n\n## Common Pitfalls\n- Running Nikto without authorization (legal liability)\n- Treating Nikto as a complete web application scanner (it focuses on server\u002Fconfig issues)\n- Not validating results leading to false positive reports\n- Scanning too aggressively against production systems\n- Ignoring SSL\u002FTLS findings as \"informational\"\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- scanning-apis-for-security-vulnerabilities\n- performing-network-vulnerability-assessment\n","# Performing Web Application Scanning with Nikto\n\n## Overview\nNikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files\u002Fprograms, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing web application scanning with nikto\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nikto installed (Perl-based, included in Kali Linux)\n- Written authorization to scan target web servers\n- Network access to target web applications\n- Understanding of HTTP\u002FHTTPS protocols\n\n## Core Concepts\n\n### What Nikto Detects\n- Server misconfigurations and dangerous default files\n- Outdated server software versions with known CVEs\n- Common CGI vulnerabilities and dangerous scripts\n- Default credentials and admin pages\n- HTTP methods that should be disabled (PUT, DELETE, TRACE)\n- SSL\u002FTLS misconfigurations and weak ciphers\n- Missing security headers (X-Frame-Options, CSP, HSTS)\n- Information disclosure through headers and error pages\n\n### Nikto vs Other Web Scanners\n| Feature | Nikto | OWASP ZAP | Burp Suite | Nuclei |\n|---------|-------|-----------|------------|--------|\n| License | Open Source | Open Source | Commercial | Open Source |\n| Focus | Server\u002FConfig | App Logic | Full Pentest | Template-Based |\n| Speed | Fast | Medium | Slow | Very Fast |\n| False Positives | Moderate | Low | Low | Low |\n| Authentication | Basic | Full | Full | Template |\n| Active Community | Yes | Yes | Yes | Yes |\n\n## Workflow\n\n### Step 1: Basic Scanning\n```bash\n# Basic scan against a target\nnikto -h https:\u002F\u002Ftarget.example.com\n\n# Scan specific port\nnikto -h target.example.com -p 8443\n\n# Scan multiple ports\nnikto -h target.example.com -p 80,443,8080,8443\n\n# Scan with SSL enforcement\nnikto -h target.example.com -ssl\n\n# Scan from a host list file\nnikto -h targets.txt\n```\n\n### Step 2: Advanced Scanning Options\n```bash\n# Comprehensive scan with all tuning options\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -Tuning 123456789abcde \\\n  -timeout 10 \\\n  -Pause 2 \\\n  -Display V \\\n  -output report.html \\\n  -Format htm\n\n# Tuning options control test types:\n# 0 - File Upload\n# 1 - Interesting File \u002F Seen in logs\n# 2 - Misconfiguration \u002F Default File\n# 3 - Information Disclosure\n# 4 - Injection (XSS\u002FScript\u002FHTML)\n# 5 - Remote File Retrieval - Inside Web Root\n# 6 - Denial of Service\n# 7 - Remote File Retrieval - Server Wide\n# 8 - Command Execution \u002F Remote Shell\n# 9 - SQL Injection\n# a - Authentication Bypass\n# b - Software Identification\n# c - Remote Source Inclusion\n# d - WebService\n# e - Administrative Console\n\n# Scan with specific tuning (XSS + SQL injection + auth bypass)\nnikto -h https:\u002F\u002Ftarget.example.com -Tuning 49a\n\n# Scan with authentication\nnikto -h https:\u002F\u002Ftarget.example.com -id admin:password\n\n# Scan through a proxy\nnikto -h https:\u002F\u002Ftarget.example.com -useproxy http:\u002F\u002Fproxy:8080\n\n# Scan with custom User-Agent\nnikto -h https:\u002F\u002Ftarget.example.com -useragent \"Mozilla\u002F5.0 (Security Scan)\"\n\n# Scan specific CGI directories\nnikto -h https:\u002F\u002Ftarget.example.com -Cgidirs \u002Fcgi-bin\u002F,\u002Fscripts\u002F\n\n# Evasion techniques (IDS avoidance for authorized testing)\n# 1-Random URI encoding, 2-Directory self-reference\n# 3-Premature URL ending, 4-Prepend long random string\nnikto -h https:\u002F\u002Ftarget.example.com -evasion 1234\n```\n\n### Step 3: Output and Reporting\n```bash\n# Generate multiple output formats\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.csv -Format csv\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.xml -Format xml\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.html -Format htm\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.txt -Format txt\n\n# JSON output (newer versions)\nnikto -h https:\u002F\u002Ftarget.example.com -output scan.json -Format json\n\n# Save to multiple formats simultaneously\nnikto -h https:\u002F\u002Ftarget.example.com \\\n  -output scan_report \\\n  -Format htm\n```\n\n### Step 4: Scan Multiple Targets\n```bash\n# Create targets file (one per line)\ncat > targets.txt \u003C\u003C 'EOF'\nhttps:\u002F\u002Fapp1.example.com\nhttps:\u002F\u002Fapp2.example.com:8443\nhttp:\u002F\u002Finternal-app.corp.local\n192.168.1.100:8080\nEOF\n\n# Scan all targets\nnikto -h targets.txt -output multi_scan.html -Format htm\n\n# Parallel scanning with GNU parallel\ncat targets.txt | parallel -j 5 \"nikto -h {} -output {\u002F}_report.html -Format htm\"\n```\n\n### Step 5: SSL\u002FTLS Assessment\n```bash\n# Comprehensive SSL scan\nnikto -h https:\u002F\u002Ftarget.example.com -ssl \\\n  -Tuning b \\\n  -Display V\n\n# Check for specific SSL vulnerabilities\n# Nikto checks for:\n# - Expired certificates\n# - Self-signed certificates\n# - Weak cipher suites\n# - SSLv2\u002FSSLv3 enabled\n# - BEAST, POODLE, Heartbleed indicators\n# - Missing HSTS header\n```\n\n### Step 6: Integration with Other Tools\n```bash\n# Pipe Nmap results into Nikto\nnmap -p 80,443,8080 --open -oG - 192.168.1.0\u002F24 | \\\n  awk '\u002Fopen\u002F{print $2}' | \\\n  while read host; do nikto -h \"$host\" -output \"${host}_nikto.html\" -Format htm; done\n\n# Export to Metasploit-compatible format\nnikto -h target.example.com -output msf_import.xml -Format xml\n\n# Parse Nikto XML output with Python for custom reporting\npython3 -c \"\nimport xml.etree.ElementTree as ET\ntree = ET.parse('scan.xml')\nfor item in tree.findall('.\u002F\u002Fitem'):\n    print(f\\\"[{item.get('id')}] {item.findtext('description', '')[:100]}\\\")\n\"\n```\n\n## Interpreting Results\n\n### Severity Classification\n- **OSVDB\u002FCVE References**: Cross-reference with NVD for CVSS scores\n- **Server Information Disclosure**: Version banners, technology stack\n- **Dangerous HTTP Methods**: PUT, DELETE, TRACE enabled\n- **Default\u002FBackup Files**: .bak, .old, .swp, web.config.bak\n- **Admin Interfaces**: \u002Fadmin, \u002Fmanager, \u002Fconsole exposed\n- **Missing Security Headers**: CSP, X-Frame-Options, HSTS\n\n### Common False Positives\n- Generic checks triggered by custom 404 pages\n- Anti-CSRF tokens flagged as form vulnerabilities\n- CDN\u002FWAF responses misidentified as vulnerable\n- Load balancer health check pages\n\n## Best Practices\n1. Always obtain written authorization before scanning\n2. Run Nikto in conjunction with application-level scanners (ZAP, Burp)\n3. Use -Pause flag to reduce load on production servers\n4. Validate findings manually before reporting\n5. Combine with SSL testing tools (testssl.sh, sslyze) for comprehensive coverage\n6. Schedule regular scans as part of continuous vulnerability management\n7. Keep Nikto database updated for latest vulnerability checks\n8. Use appropriate evasion settings only for authorized IDS testing\n\n## Common Pitfalls\n- Running Nikto without authorization (legal liability)\n- Treating Nikto as a complete web application scanner (it focuses on server\u002Fconfig issues)\n- Not validating results leading to false positive reports\n- Scanning too aggressively against production systems\n- Ignoring SSL\u002FTLS findings as \"informational\"\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- scanning-apis-for-security-vulnerabilities\n- performing-network-vulnerability-assessment\n",{"name":5,"tags":54,"author":55,"domain":47,"license":15,"version":56,"nist_csf":57,"subdomain":32,"description":7,"mitre_attack":62},[32,43,34,33,40,37],"mahipal","1.0",[58,59,60,61],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[63,64,65],"T1190","T1203","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-web-application-scanning-with-nikto",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-web-application-scanning-with-nikto",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-web-application-scanning-with-nikto",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-web-application-scanning-with-nikto","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",1033,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",1772,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",2166,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",2128,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",5394,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",12297,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-web-application-scanning-with-nikto\u002Fscripts\u002Fprocess.py",[126,152,176,201,227,251],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,48,47,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[160,148,161,162,48,163,47,140,164,165,166,167,168,169,170,171,172,173,174,175],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":184,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[182,183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[170,185,186,187,41,47,188,189,164,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,47,212,213,214,215,216,217,218,219,220,221,222,223,167,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,47,238,239,240,32,241,242,243,244,245,246,37,35,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[48,259,47,260,261,262,263,264,265,266,267,196,268,197,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]