spray

Probe HTTP services and fingerprint web technologies on target hosts.

235|25|Updated May 7, 2026
One-click install
npx skills add https://github.com/chainreactors/aiscan --skill spray
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: spray
Source: https://github.com/chainreactors/aiscan/tree/main/skills/spray
Command: npx skills add https://github.com/chainreactors/aiscan --skill spray

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the challenge of manually identifying web services, frameworks, and exposed resources across large target scopes, which is time-consuming and prone to oversight.

Core Features & Use Cases

  • Web Probing: Automatically discovers and validates HTTP services from target lists.
  • Fingerprinting: Identifies CMS, frameworks, and specific web technologies in use.
  • Resource Discovery: Locates common files, interesting paths, and exposed resources.
  • Use Case: Use this during the reconnaissance phase to quickly map the attack surface of a web application and identify potential entry points or misconfigurations.

Quick Start

Use the spray skill to probe the target URL and identify its underlying web technologies and fingerprints.

Frequently Asked Questions about spray

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform HTTP fingerprinting and web probing on target hosts?

Web probing identifies services, frameworks, and exposed paths on target hosts by automatically discovering HTTP services, collecting status codes, and analyzing headers. It maps the attack surface rapidly to highlight potential entry points and misconfigurations.

What is the best way to map a web application attack surface during reconnaissance?

Mapping a web application attack surface is best achieved by automating service discovery and header analysis across large target scopes. This rapidly identifies web technology stacks, locates exposed resources, and prevents manual oversight during reconnaissance.

Can I identify specific CMS and web frameworks using HTTP probing?

Yes, HTTP probing identifies specific CMS platforms and web frameworks. It performs technology fingerprinting to detect the underlying web stacks, which helps pinpoint potential entry points and misconfigurations on target hosts during security reconnaissance.

How do I find exposed paths and common files across large target lists?

Finding exposed paths and common files across large target lists requires automated web probing. It validates HTTP services and performs resource discovery to locate interesting files and paths, overcoming the time-consuming challenge of manual identification.

Does web probing work for automated service discovery without manual intervention?

Web probing works for automated service discovery by automatically discovering and validating HTTP services from target lists. It collects status codes and analyzes headers without manual intervention, satisfying requirements for rapid identification of web technology stacks.

Why does manual web technology identification cause oversight in security reconnaissance?

Manual web technology identification causes oversight because identifying services, frameworks, and exposed resources across large target scopes is time-consuming. Automating HTTP fingerprinting and resource discovery ensures rapid, comprehensive attack surface mapping.