mcpField
L
local-resources

local-resources

github.com/wgpsecSecurity1.8k48 installsUpdated 4d ago
Repository

About local-resources

A local resource navigation skill for penetration testing that organizes dictionary and payload paths under `/pentest/` and explains how to select and use them by task.

Key features

  1. 01Indexes web and authentication wordlists
  2. 02Lists paths for directory, parameter, and password testing
  3. 03Catalogs SQLi, XSS, and other payload groups
  4. 04Explains workflows with ffuf and spray

Use cases

  1. 01Choose a wordlist for web directory discovery
  2. 02Select focused lists for CTF URI or parameter testing
  3. 03Locate payload files for vulnerability validation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill local-resources

After installing, type/local-resourcesin Claude Code to confirm it loaded.

Bundled filesevals/evals.jsonevals/recall.json

Details

From the project README

本地资源库导航

⚠️ 核心规则：字典统一在 /pentest 目录 — aboutsecurity 字典库和 nuclei 模板库均安装在 /pentest/ 下。

📁 字典库 (Dic/) — 目录爆破 / 密码爆破 / 参数 Fuzz

工具链
# 查看字典库分类
ls /pentest/AboutSecurity/Dic/
# 查看 Web 字典子分类
ls /pentest/AboutSecurity/Dic/web/
# 使用字典（示例）
spray -u http://target -d /pentest/AboutSecurity/Dic/web/directory/common.txt
ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt
常用字典速查表
场景路径行数
通用目录爆破Dic/web/directory/common.txt5378
PHP 文件发现Dic/web/directory/php/php.txt48094
PHP Top100Dic/web/directory/php/top100-php.txt93
CTF URI FuzzDic/web/ctf/uri.txt222
CTF 参数 FuzzDic/web/ctf/param.txt44
CTF SQL FuzzDic/web/ctf/sql.txt94
后台路径Dic/web/directory/admin-dir.txt2166
API 路径Dic/web/directory/api.txt341
备份文件Dic/web/file-backup/—
密码 Top100Dic/auth/password/password-top100.txt172
DNS 子域名Dic/web/dns/—
决策树：该用哪个字典？
目标是 Web 应用？
├── CTF/靶场 → Dic/web/ctf/uri.txt（小而精）
├── PHP 站 → Dic/web/directory/php/php.txt（全面）
├── 通用站 → Dic/web/directory/common.txt
├── 找后台 → Dic/web/directory/admin-dir.txt
├── 找 API → Dic/web/directory/api.txt
└── 找备份 → Dic/web/file-backup/

目标是认证服务？
├── 密码爆破 → Dic/auth/password/password-top100.txt
├── 用户名枚举 → Dic/auth/username/
└── 特定服务 → Dic/port/{mysql,ssh,rdp,...}/

📁 Payload 库 — 漏洞验证 payload

工具链
# 查看 aboutsecurity payload 分类
ls /pentest/AboutSecurity/Payload/
# 查看 nuclei 模板库
ls ~/nuclei-templates/
# 读取具体 payload 文件
cat /pentest/AboutSecurity/Payload/sqli/payload.txt        # 通用 SQLi Fuzz payload
cat /pentest/AboutSecurity/Payload/sqli/sql-inj.md         # 快速查阅速查手册（含 WAF 绕过技巧）
可用分类

sqli | xss | lfi | ssrf | xxe | rce | access-bypass | upload | cors | hpp | ssi

⚠️ 使用外部工具的正确流程

❌ 错误：ffuf -u http://target/FUZZ -w /usr/share/wordlists/common.txt
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                        猜测路径，大概率不存在

✅ 正确：
1. ls /pentest/AboutSecurity/Dic/web/directory/  → 确认字典存在
2. ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt

💡 高效使用提示

  1. spray / ffuf 已封装字典 — 如果只是简单目录爆破，直接用 spray -u target -d wordlist.txt 或 ffuf -u target/FUZZ -w wordlist.txt
  2. 自定义参数用 ffuf — 需要自定义参数（如 -e .bak -mc 200）时用 ffuf -u target/FUZZ -w /pentest/AboutSecurity/Dic/...
  3. CTF 场景优先用小字典 — Dic/web/ctf/ 下的字典精简且针对性强，避免大字典浪费时间

Comments

Markdown supported