# Supported Network Analysis and Threat Intelligence Features in reverse-skill

> Discover reverse-skill's network analysis and threat intelligence features. Safely perform reconnaissance, interception, replay, and extraction with strict authorization. Learn more now!

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-30

---

**reverse-skill provides a unified framework for safely performing network-oriented reconnaissance, traffic interception, request replay, and threat-intel extraction while enforcing strict authorization gates via [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and `network_profile` constraints.**

The `zhaoxuya520/reverse-skill` repository implements a comprehensive suite of supported network analysis and threat intelligence features designed for AI-driven security operations. This open-source framework separates routing logic, authorization controls, and tool execution to enable automated network reconnaissance and manipulation within formally defined operational scopes.

## Architecture Overview

The framework employs a three-layer architecture to ensure safe and authorized network operations. According to the source code in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md), and [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md), responsibilities are divided as follows:

- **Routing Layer**: Determines which network-related skill to invoke based on intent, such as internal-network reconnaissance, credential dumping, or command-and-control (C2) operations.
- **Scope & Authorization Layer**: Validates that [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) contains `auth.status=granted` and a legal `network_profile` before permitting any ACT on a target, as enforced by the `case-guard` gate defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).
- **Tool Layer (MCP JSHook)**: Implements concrete network actions—including intercept, replay, HAR capture, HTTP/2 probing, and token extraction—via the MCP server that powers the AI-driven hunter.

## Core Network Analysis Capabilities

### Network Interception and Capture

The `network_intercept` function hooks incoming and outgoing HTTP(S) traffic to produce HAR logs for AI agent consumption. For modern internal services, `http2_probe` sends custom HTTP/2 frames to test endpoints like TURN servers or internal-only APIs that traditional tools might miss.

Both functions respect the **network_profile** defined in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), ensuring operations occur only within approved boundaries (offline, lab, or authorized-target-only environments).

### Network Replay and Modification

The `network_replay_request` primitive enables security teams to re-send captured requests with altered hosts, schemes, or ports. This capability supports SSRF validation, protocol fuzzing, and C2 testing by allowing controlled manipulation of previously captured traffic.

### Authentication Token Extraction

Via `network_extract_auth`, the framework automatically parses captured HAR files for JWT, OAuth tokens, cookies, and other authentication artifacts. This function integrates with threat-intel pipelines to identify credential exposure or session management vulnerabilities.

### Network Reconnaissance

The `network_recon` capability, referenced in the reconnaissance pipeline, enumerates reachable IP addresses, open ports, and service banners within the constraints of the defined `network_profile`. This operates as part of the broader `pentest-tools` skill set.

## Threat Intelligence Playbooks

### SSRF Detection

The framework includes dedicated server-side request forgery (SSRF) detection through traffic interception and payload validation. By monitoring external calls via `network_intercept` and confirming whether payloads reach internal targets (documented in [`ssrf-cache-host.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ssrf-cache-host.md)), the system can identify and cache vulnerable endpoints without manual packet analysis.

### OAuth, SAML, and JWT Analysis

The [`oauth-saml-jwt.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/oauth-saml-jwt.md) playbook leverages `network_extract_auth` to dissect authentication flows. It extracts and replays token-related parameters to test for token leakage, signature bypasses, or SAML assertion manipulation, providing automated analysis of identity provider implementations.

## Integration with Adjacent Skills

### JS-Reverse Integration

The `js-reverse` skill exposes `js-reverse_list_network_requests` to enumerate recent network calls made by browser scripts. Defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md), this function captures client-side API communications and third-party requests that inform the broader network analysis context.

### Pentest-Tools Aggregation

As documented in [`skills/pentest-tools/references/network-attack-defense.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/network-attack-defense.md), the master skill aggregates network-attack-defense knowledge and exposes shortcuts for lateral movement tools such as **NetExec**, **CrackMapExec**, and `nxc`. The entry point in [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) enforces `network_profile` validation before permitting any network operation, ensuring compliance with operational security policies.

## Usage Examples

The following JSON payloads illustrate how AI-driven skills invoke network primitives via the MCP-JSHook interface. These are sent to the local MCP server (started by `case-init`) with results fed back to the AI skill for further reasoning.

Intercept HTTP traffic and generate a HAR file:

```json
{
  "action": "network_intercept",
  "params": {
    "urlPattern": "*example.com*",
    "output": "har"
  }
}

```

Replay a captured request with a modified host for SSRF testing:

```json
{
  "action": "network_replay_request",
  "params": {
    "harEntryId": "12345",
    "override": {
      "host": "internal.target.local"
    }
  }
}

```

Extract authentication tokens from captured traffic:

```json
{
  "action": "network_extract_auth",
  "params": {
    "harFile": "capture.har",
    "tokenTypes": ["jwt", "oauth"]
  }
}

```

## Summary

- **reverse-skill** implements a three-layer architecture (routing, authorization, tools) to safely execute network operations.
- Core capabilities include `network_intercept`, `network_replay_request`, `network_extract_auth`, and `network_recon`, all gated by [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and `network_profile` validation.
- The MCP JSHook interface in [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md) provides the concrete implementation for traffic manipulation and token extraction.
- Built-in playbooks support SSRF detection and OAuth/SAML/JWT analysis without manual tool switching.
- Integration with `js-reverse` and `pentest-tools` enables comprehensive coverage from client-side script analysis to lateral movement operations.

## Frequently Asked Questions

### How does reverse-skill enforce authorization before executing network operations?

The framework requires a valid [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file containing `auth.status=granted` and a defined `network_profile` before any network action. The `case-guard` gate, defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), blocks attempts to act without these credentials, ensuring operations remain within offline, lab, or authorized-target-only environments.

### What is the MCP JSHook interface used for in network analysis?

The MCP (Model Context Protocol) JSHook interface serves as the tool layer implementation that executes concrete network actions. Located in [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md), it processes JSON commands for interception, replay, and authentication extraction, bridging high-level AI intents with low-level network operations.

### Can reverse-skill detect SSRF vulnerabilities and extract authentication tokens automatically?

Yes. The framework provides automated SSRF detection by intercepting external calls and validating whether payloads reach internal targets. Simultaneously, `network_extract_auth` parses HAR files to automatically identify JWT, OAuth, and cookie tokens, enabling comprehensive threat intelligence gathering without manual packet inspection.

### How does the framework integrate with existing penetration testing workflows?

Through [`skills/pentest-tools/references/network-attack-defense.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/network-attack-defense.md), reverse-skill aggregates knowledge of network attacks and exposes shortcuts for industry-standard tools like NetExec and CrackMapExec. The `js-reverse` skill further complements this by extracting client-side network requests, creating a unified pipeline from reconnaissance to lateral movement.