skills.rest
ricardoo022
ricardoo022COMMUNITY
Explore all skills by this author →
GitHub

scan-fase-0

Detect backend technology and extract configurations from a target URL.

Updated Mar 11, 2026
Search Tags:#graphql#supabase#web-security#firebase#fingerprinting#backend-detection#scan-path
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-fase-0
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-0
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-0

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Backend detection and configuration extraction is essential to tailor the security scan path for subsequent phases. This skill determines which FASEs to run based on the discovered backend technology and available configurations.

Core Features & Use Cases

  • Detects backend types (Supabase, Firebase, Hasura, Appwrite, Pocketbase, Nhost, AWS Amplify, GraphQL, Custom API, etc.) from HTML/JS, network traffic, and window objects.
  • Extracts key configurations (URLs, keys, endpoints) to drive phase selection and accurate testing.
  • Produces a structured output that informs the scan plan and enables parallelization of phases where applicable.
  • Use Case: Start with a target URL, run /scan-fase-0 to determine the backend and automatically select the appropriate FASEs for a focused security assessment.

Quick Start

Invoke /scan-fase-0 with your target URL to start backend detection.

Frequently Asked Questions about scan-fase-0

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect backend technologies like Supabase or Firebase from a target URL?▼

Backend detection identifies technologies like Supabase or Firebase by analyzing HTML/JS, network traffic, and window objects. This process extracts configurations to determine a tailored security scan path for the target URL.

What is backend detection used for in GraphQL and custom API security scanning?▼

Backend detection in GraphQL and custom API security scanning is used to identify the specific backend technology and extract key configurations. This enables automated selection of appropriate security phases for focused testing.

How do I extract backend configurations to automate a web security scan path?▼

You extract backend configurations by analyzing the target URL for endpoints, keys, and specific platform fingerprints. The extracted data produces a structured YAML output that informs the subsequent scan phases to automate the web security assessment.

Does this backend detection tool work with Hasura, Appwrite, and Pocketbase?▼

Yes, backend detection works with Hasura, Appwrite, and Pocketbase. It also supports Nhost, AWS Amplify, and GraphQL backends to determine the appropriate scan path and extract their specific configurations.

Can I use backend configurations to parallelize security scan phases?▼

Yes, you can use extracted backend configurations to parallelize security scan phases. The structured output informs the scan plan and enables parallel execution of phases where applicable based on the discovered backend technology.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

waf-detect

Detects Web Application Firewall presence and identifies product via wafw00f or curl.

Community
Intermediate
vigoliumvigolium
965

vigolium-scanner

Execute Vigolium CLI commands for web vulnerability scanning and code review.

Official
Advanced
pdparchitectpdparchitect
13

hunt-graphql

Identify and exploit GraphQL API vulnerabilities including IDOR and broken authorization.

Community
Advanced
n4igmen4igme

sc3-vuln-scan

Orchestrate vulnerability scanners to produce a unified vulnerabilities.md report.

Community
Advanced