Supported Network Analysis and Threat Intelligence Features in reverse-skill

reverse-skill provides a unified framework for safely performing network-oriented reconnaissance, traffic interception, request replay, and threat-intel extraction while enforcing strict authorization gates via scope.md and network_profile constraints.

The zhaoxuya520/reverse-skill repository implements a comprehensive suite of supported network analysis and threat intelligence features designed for AI-driven security operations. This open-source framework separates routing logic, authorization controls, and tool execution to enable automated network reconnaissance and manipulation within formally defined operational scopes.

Architecture Overview

The framework employs a three-layer architecture to ensure safe and authorized network operations. According to the source code in skills/routing.md, skills/ops/scope-contract.md, and skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md, responsibilities are divided as follows:

• Routing Layer: Determines which network-related skill to invoke based on intent, such as internal-network reconnaissance, credential dumping, or command-and-control (C2) operations.
• Scope & Authorization Layer: Validates that scope.md contains auth.status=granted and a legal network_profile before permitting any ACT on a target, as enforced by the case-guard gate defined in RULES.md.
• Tool Layer (MCP JSHook): Implements concrete network actions—including intercept, replay, HAR capture, HTTP/2 probing, and token extraction—via the MCP server that powers the AI-driven hunter.

Core Network Analysis Capabilities

Network Interception and Capture

The network_intercept function hooks incoming and outgoing HTTP(S) traffic to produce HAR logs for AI agent consumption. For modern internal services, http2_probe sends custom HTTP/2 frames to test endpoints like TURN servers or internal-only APIs that traditional tools might miss.

Both functions respect the network_profile defined in scope.md, ensuring operations occur only within approved boundaries (offline, lab, or authorized-target-only environments).

Network Replay and Modification

The network_replay_request primitive enables security teams to re-send captured requests with altered hosts, schemes, or ports. This capability supports SSRF validation, protocol fuzzing, and C2 testing by allowing controlled manipulation of previously captured traffic.

Authentication Token Extraction

Via network_extract_auth, the framework automatically parses captured HAR files for JWT, OAuth tokens, cookies, and other authentication artifacts. This function integrates with threat-intel pipelines to identify credential exposure or session management vulnerabilities.

Network Reconnaissance

The network_recon capability, referenced in the reconnaissance pipeline, enumerates reachable IP addresses, open ports, and service banners within the constraints of the defined network_profile. This operates as part of the broader pentest-tools skill set.

Threat Intelligence Playbooks

SSRF Detection

The framework includes dedicated server-side request forgery (SSRF) detection through traffic interception and payload validation. By monitoring external calls via network_intercept and confirming whether payloads reach internal targets (documented in ssrf-cache-host.md), the system can identify and cache vulnerable endpoints without manual packet analysis.

OAuth, SAML, and JWT Analysis

The oauth-saml-jwt.md playbook leverages network_extract_auth to dissect authentication flows. It extracts and replays token-related parameters to test for token leakage, signature bypasses, or SAML assertion manipulation, providing automated analysis of identity provider implementations.

Integration with Adjacent Skills

JS-Reverse Integration

The js-reverse skill exposes js-reverse_list_network_requests to enumerate recent network calls made by browser scripts. Defined in skills/js-reverse/SKILL.md, this function captures client-side API communications and third-party requests that inform the broader network analysis context.

Pentest-Tools Aggregation

As documented in skills/pentest-tools/references/network-attack-defense.md, the master skill aggregates network-attack-defense knowledge and exposes shortcuts for lateral movement tools such as NetExec, CrackMapExec, and nxc. The entry point in skills/pentest-tools/SKILL.md enforces network_profile validation before permitting any network operation, ensuring compliance with operational security policies.

Usage Examples

The following JSON payloads illustrate how AI-driven skills invoke network primitives via the MCP-JSHook interface. These are sent to the local MCP server (started by case-init) with results fed back to the AI skill for further reasoning.

Intercept HTTP traffic and generate a HAR file:

{
  "action": "network_intercept",
  "params": {
    "urlPattern": "*example.com*",
    "output": "har"
  }
}

Replay a captured request with a modified host for SSRF testing:

{
  "action": "network_replay_request",
  "params": {
    "harEntryId": "12345",
    "override": {
      "host": "internal.target.local"
    }
  }
}

Extract authentication tokens from captured traffic:

{
  "action": "network_extract_auth",
  "params": {
    "harFile": "capture.har",
    "tokenTypes": ["jwt", "oauth"]
  }
}

Summary

• reverse-skill implements a three-layer architecture (routing, authorization, tools) to safely execute network operations.
• Core capabilities include network_intercept, network_replay_request, network_extract_auth, and network_recon, all gated by scope.md and network_profile validation.
• The MCP JSHook interface in skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md provides the concrete implementation for traffic manipulation and token extraction.
• Built-in playbooks support SSRF detection and OAuth/SAML/JWT analysis without manual tool switching.
• Integration with js-reverse and pentest-tools enables comprehensive coverage from client-side script analysis to lateral movement operations.

Frequently Asked Questions

How does reverse-skill enforce authorization before executing network operations?

The framework requires a valid scope.md file containing auth.status=granted and a defined network_profile before any network action. The case-guard gate, defined in RULES.md, blocks attempts to act without these credentials, ensuring operations remain within offline, lab, or authorized-target-only environments.

What is the MCP JSHook interface used for in network analysis?

The MCP (Model Context Protocol) JSHook interface serves as the tool layer implementation that executes concrete network actions. Located in skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md, it processes JSON commands for interception, replay, and authentication extraction, bridging high-level AI intents with low-level network operations.

Can reverse-skill detect SSRF vulnerabilities and extract authentication tokens automatically?

Yes. The framework provides automated SSRF detection by intercepting external calls and validating whether payloads reach internal targets. Simultaneously, network_extract_auth parses HAR files to automatically identify JWT, OAuth, and cookie tokens, enabling comprehensive threat intelligence gathering without manual packet inspection.

How does the framework integrate with existing penetration testing workflows?

Through skills/pentest-tools/references/network-attack-defense.md, reverse-skill aggregates knowledge of network attacks and exposes shortcuts for industry-standard tools like NetExec and CrackMapExec. The js-reverse skill further complements this by extracting client-side network requests, creating a unified pipeline from reconnaissance to lateral movement.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}