hacklab/JARVIS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

saber: manuales cosechados e indice publico pre-construido

Browse source 
- manuales.py cosecha el --help de las herramientas que no traen man page
  (ffuf, sqlmap, suite impacket, netexec, hydra...) y lo escribe como markdown
  en conocimiento/09 - Manuales/. Es la referencia de opciones que la man page
  no da; complementa el cheatsheet de invocaciones comunes.
- indexa.py --publico construye saber-publico.jsonl: glosario + pack de
  conocimiento con los vectores ya calculados, 100% publico y portable.
- busca.py usa ese indice publico como fallback cuando no hay indice personal,
  asi un clon recien hecho consulta al instante sin reindexar nada.
- .gitignore deja pasar saber-publico.jsonl; el personal (saber.jsonl) sigue
  fuera.
- docs/rag.md y el README del pack documentan ambas cosas.
This commit is contained in:
sito 2026-08-16 18:43:56 +02:00
parent 1dfb3513e6
commit 9fa0a40edf
12 changed files with 1206 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.gitignore vendored
View file

@ -32,6 +32,10 @@ voz/comparativa/
# hacer el asistente, no son datos personales)
!nucleo/datos/acciones.json
!nucleo/datos/_generar.py
# Excepcion: el indice PUBLICO pre-construido (glosario + pack de conocimiento,
# con vectores ya calculados). Es 100 % publico y portable; se sube para que un
# clon consulte al instante sin reindexar. El personal (saber.jsonl) sigue fuera.
!nucleo/datos/saber-publico.jsonl
# Registros y temporales
*.log

30
docs/rag.md
View file

@ -2,9 +2,12 @@
JARVIS responde desde los apuntes del usuario, no desde lo que el modelo
recuerde. Para 668 herramientas de pentesting, recordar sería inventar. Este
documento explica el método y los resultados; el índice en sí no se publica
—contiene los apuntes, que son privados—, pero el código que lo construye sí
(`nucleo/saber/`).
documento explica el método y los resultados. El índice **personal** (los
apuntes de cada quien) no se publica; sí se publica un índice **público
pre-construido** —glosario de Linux más el pack de metodología y manuales, con
los vectores ya calculados (`nucleo/datos/saber-publico.jsonl`)— para que un clon
recién hecho consulte al instante, sin repetir el trabajo de indexar. El código
que lo construye está entero en `nucleo/saber/`.
## Cómo funciona
@ -85,17 +88,20 @@ forma de medirlo— sí está; el corpus lo pone cada quien con sus notas.
| | En el repo |
|---|---|
| El código: `indexa`, `busca`, `glosario`, `sistema`, `enriquece/` | **sí** |
| El código: `indexa`, `busca`, `glosario`, `sistema`, `manuales`, `enriquece/` | **sí** |
| El eval (`enriquece/eval_set.jsonl`) | **sí** |
| El glosario de tareas de Linux en castellano (`glosario.py`) | **sí** (genérico) |
| **El pack de metodología** (`saber/conocimiento/`, ~73 docs) | **sí** — limpio y genérico |
| El índice (`saber.jsonl`) y sus copias | **no** — los apuntes indexados |
| **El pack de metodología y manuales** (`saber/conocimiento/`) | **sí** — limpio y genérico |
| **El índice público pre-construido** (`datos/saber-publico.jsonl`) | **sí** — glosario + pack, con vectores |
| El índice personal (`saber.jsonl`) y sus copias | **no** — los apuntes indexados |
| El diario (`diario.jsonl`) | **no** — las conversaciones |
| Lo derivado (`cosecha.jsonl`, `sintesis.jsonl`) | **no** — salen de los apuntes |
Así que un equipo recién clonado, con `indexa.py`, construye un índice **útil sin
ningún dato privado**: las *man pages*, el glosario, y **el pack de metodología**
(`saber/conocimiento/`) —enumeración, explotación web, shells, privesc, Active
Directory, cheatsheets...— con los comandos de verdad. Son apuntes propios estilo
OSCP, scrubeados de hosts, credenciales y rutas. Los apuntes privados del usuario
(su `saber.jsonl`, su diario) siguen fuera; el pack los complementa.
Así que un equipo recién clonado consulta **al instante**, sin dato privado y sin
reindexar: el `saber-publico.jsonl` ya trae el glosario y el pack de metodología
—enumeración, explotación web, shells, privesc, Active Directory, cheatsheets— más
los **manuales** de las herramientas que no traen man page (`saber/conocimiento/09
- Manuales/`, cosechados con `manuales.py` de su `--help`). Cuando quiera sumar sus
propias notas y las *man pages* de su máquina, corre `indexa.py` y pasa a usar su
índice personal. Los apuntes privados del usuario (su `saber.jsonl`, su diario)
siguen fuera; el pack los complementa.

449
nucleo/datos/saber-publico.jsonl Normal file
View file

File diff suppressed because one or more lines are too long

19
nucleo/saber/busca.py
View file

@ -22,18 +22,31 @@ import os
AQUI = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
INDICE = os.path.join(AQUI, "datos", "saber.jsonl")
# El indice portable que viene en el repo. Se usa tal cual mientras no exista el
# personal, para que un clon recien hecho ya sepa de pentesting sin reindexar.
INDICE_PUBLICO = os.path.join(AQUI, "datos", "saber-publico.jsonl")
_modelo = None
_entradas = None
_matriz = None
def _fuente():
"""El indice personal si existe; si no, el publico que trae el repo."""
if os.path.exists(INDICE):
return INDICE
if os.path.exists(INDICE_PUBLICO):
return INDICE_PUBLICO
return None
def _carga():
global _modelo, _entradas, _matriz
if _entradas is not None:
return _entradas is not False
if not os.path.exists(INDICE):
fuente = _fuente()
if not fuente:
_entradas = False
return False
@ -41,7 +54,7 @@ def _carga():
from model2vec import StaticModel
entradas, vectores = [], []
with open(INDICE, encoding="utf-8") as f:
with open(fuente, encoding="utf-8") as f:
for l in f:
try:
d = json.loads(l)
@ -190,4 +203,4 @@ def resumen(tope_temas: int = 10) -> str:
def disponible() -> bool:
return os.path.exists(INDICE)
return _fuente() is not None

35
nucleo/saber/conocimiento/09 - Manuales/gobuster.md Normal file
View file

@ -0,0 +1,35 @@
# gobuster — manual
Salida de `gobuster --help`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
```
Usage:
gobuster [command]
Available Commands:
completion Generate the autocompletion script for the specified shell
dir Uses directory/file enumeration mode
dns Uses DNS subdomain enumeration mode
fuzz Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body
gcs Uses gcs bucket enumeration mode
help Help about any command
s3 Uses aws bucket enumeration mode
tftp Uses TFTP enumeration mode
version shows the current version
vhost Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)
Flags:
--delay duration Time each thread waits between requests (e.g. 1500ms)
-h, --help help for gobuster
--no-color Disable color output
--no-error Don't display errors
-z, --no-progress Don't display progress
-o, --output string Output file to write results to (defaults to stdout)
-p, --pattern string File containing replacement patterns
-q, --quiet Don't print the banner and other noise
-t, --threads int Number of concurrent threads (default 10)
-v, --verbose Verbose output (errors)
-w, --wordlist string Path to the wordlist
Use "gobuster [command] --help" for more information about a command.
```

89
nucleo/saber/conocimiento/09 - Manuales/impacket-secretsdump.md Normal file
View file

@ -0,0 +1,89 @@
# impacket-secretsdump — manual
Salida de `impacket-secretsdump -h`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
```
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
usage: secretsdump.py [-h] [-ts] [-debug] [-system SYSTEM] [-bootkey BOOTKEY]
[-security SECURITY] [-sam SAM] [-ntds NTDS]
[-resumefile RESUMEFILE] [-outputfile OUTPUTFILE]
[-use-vss] [-rodcNo RODCNO] [-rodcKey RODCKEY]
[-use-keylist]
[-exec-method [{smbexec,wmiexec,mmcexec}]]
[-just-dc-user USERNAME] [-just-dc] [-just-dc-ntlm]
[-pwd-last-set] [-user-status] [-history]
[-hashes LMHASH:NTHASH] [-no-pass] [-k]
[-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address]
[-target-ip ip address]
target
Performs various techniques to dump secrets from the remote machine without
executing any agent there.
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
or LOCAL (if you want to parse local files)
options:
-h, --help show this help message and exit
-ts Adds timestamp to every logging output
-debug Turn DEBUG output ON
-system SYSTEM SYSTEM hive to parse
-bootkey BOOTKEY bootkey for SYSTEM hive
-security SECURITY SECURITY hive to parse
-sam SAM SAM hive to parse
-ntds NTDS NTDS.DIT file to parse
-resumefile RESUMEFILE
resume file name to resume NTDS.DIT session dump (only
available to DRSUAPI approach). This file will also be
used to keep updating the session's state
-outputfile OUTPUTFILE
base output filename. Extensions will be added for
sam, secrets, cached and ntds
-use-vss Use the VSS method instead of default DRSUAPI
-rodcNo RODCNO Number of the RODC krbtgt account (only avaiable for
Kerb-Key-List approach)
-rodcKey RODCKEY AES key of the Read Only Domain Controller (only
avaiable for Kerb-Key-List approach)
-use-keylist Use the Kerb-Key-List method instead of default
DRSUAPI
-exec-method [{smbexec,wmiexec,mmcexec}]
Remote exec method to use at target (only when using
-use-vss). Default: smbexec
display options:
-just-dc-user USERNAME
Extract only NTDS.DIT data for the user specified.
Only available for DRSUAPI approach. Implies also
-just-dc switch
-just-dc Extract only NTDS.DIT data (NTLM hashes and Kerberos
keys)
-just-dc-ntlm Extract only NTDS.DIT data (NTLM hashes only)
-pwd-last-set Shows pwdLastSet attribute for each NTDS.DIT account.
Doesn't apply to -outputfile data
-user-status Display whether or not the user is disabled
-history Dump password history, and LSA secrets OldVal
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from
ccache file (KRB5CCNAME) based on target parameters.
If valid credentials cannot be found, it will use the
ones specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256
bits)
-keytab KEYTAB Read keys for SPN from keytab file
connection:
-dc-ip ip address IP Address of the domain controller. If ommited it use
the domain part (FQDN) specified in the target
parameter
-target-ip ip address
IP Address of the target machine. If omitted it will
use whatever was specified as target. This is useful
when target is the NetBIOS name and you cannot resolve
it
```

61
nucleo/saber/conocimiento/09 - Manuales/impacket-wmiexec.md Normal file
View file

@ -0,0 +1,61 @@
# impacket-wmiexec — manual
Salida de `impacket-wmiexec -h`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
```
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-silentcommand]
[-debug] [-codec CODEC] [-shell-type {cmd,powershell}]
[-com-version MAJOR_VERSION:MINOR_VERSION]
[-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]
[-dc-ip ip address] [-A authfile] [-keytab KEYTAB]
target [command ...]
Executes a semi-interactive shell using Windows Management Instrumentation.
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
command command to execute at the target. If empty it will
launch a semi-interactive shell
options:
-h, --help show this help message and exit
-share SHARE share where the output will be grabbed from (default
ADMIN$)
-nooutput whether or not to print the output (no SMB connection
created)
-ts Adds timestamp to every logging output
-silentcommand does not execute cmd.exe to run given command (no
output)
-debug Turn DEBUG output ON
-codec CODEC Sets encoding used (codec) from the target's output
(default "utf-8"). If errors are detected, run
chcp.com at the target, map the result with https://do
cs.python.org/3/library/codecs.html#standard-encodings
and then execute wmiexec.py again with -codec and the
corresponding codec
-shell-type {cmd,powershell}
choose a command processor for the semi-interactive
shell
-com-version MAJOR_VERSION:MINOR_VERSION
DCOM version, format is MAJOR_VERSION:MINOR_VERSION
e.g. 5.7
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from
ccache file (KRB5CCNAME) based on target parameters.
If valid credentials cannot be found, it will use the
ones specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256
bits)
-dc-ip ip address IP Address of the domain controller. If ommited it use
the domain part (FQDN) specified in the target
parameter
-A authfile smbclient/mount.cifs-style authentication file. See
smbclient man page's -A option.
-keytab KEYTAB Read keys for SPN from keytab file
```

66
nucleo/saber/conocimiento/09 - Manuales/netexec.md Normal file
View file

@ -0,0 +1,66 @@
# netexec — manual
Salida de `netexec --help`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
```
usage: netexec [-h] [--version] [-t THREADS] [--timeout TIMEOUT]
[--jitter INTERVAL] [--no-progress] [--log LOG]
[--verbose | --debug] [-6] [--dns-server DNS_SERVER]
[--dns-tcp] [--dns-timeout DNS_TIMEOUT]
{smb,ftp,ldap,mssql,winrm,nfs,ssh,wmi,vnc,rdp} ...
. .
.| |. _ _ _ _____
|| || | \ | | ___ | |_ | ____| __ __ ___ ___
\\( )// | \| | / _ \ | __| | _| \ \/ / / _ \ / __|
.=[ ]=. | |\ | | __/ | |_ | |___ > < | __/ | (__
/ /˙-˙\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___|
˙ \ / ˙
˙ ˙
The network execution tool
Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx
For documentation and usage examples, visit: https://www.netexec.wiki/
Version : 1.5.1
Codename: Yippie-Ki-Yay
Commit : 515dccee
options:
-h, --help show this help message and exit
--verbose enable verbose output
--debug enable debug level information
Generic Options:
--version Display nxc version
-t THREADS, --threads THREADS
set how many concurrent threads to use
--timeout TIMEOUT max timeout in seconds of each thread
--jitter INTERVAL sets a random delay between each authentication
Output Options:
--no-progress do not displaying progress bar during scan
--log LOG export result into a custom file
DNS:
-6 Enable force IPv6
--dns-server DNS_SERVER
Specify DNS server (default: Use hosts file & System DNS)
--dns-tcp Use TCP instead of UDP for DNS queries
--dns-timeout DNS_TIMEOUT
DNS query timeout in seconds
Available Protocols:
{smb,ftp,ldap,mssql,winrm,nfs,ssh,wmi,vnc,rdp}
smb own stuff using SMB
ftp own stuff using FTP
ldap own stuff using LDAP
mssql own stuff using MSSQL
winrm own stuff using WINRM
nfs own stuff using NFS
ssh own stuff using SSH
wmi own stuff using WMI
vnc own stuff using VNC
rdp own stuff using RDP
```

249
nucleo/saber/conocimiento/09 - Manuales/nuclei.md Normal file
View file

@ -0,0 +1,249 @@
# nuclei — manual
Salida de `nuclei --help`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
```
Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.
Usage:
nuclei [flags]
Flags:
TARGET:
-u, -target string[] target URLs/hosts to scan
-l, -list string path to file containing a list of target URLs/hosts to scan (one per line)
-eh, -exclude-hosts string[] hosts to exclude to scan from the input list (ip, cidr, hostname)
-resume string resume scan using resume.cfg (clustering will be disabled)
-sa, -scan-all-ips scan all the IP's associated with dns record
-iv, -ip-version string[] IP version to scan of hostname (4,6) - (default 4)
TARGET-FORMAT:
-im, -input-mode string mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
-ro, -required-only use only required fields in input format when generating requests
-sfv, -skip-format-validation skip format validation (like missing vars) when parsing input file
TEMPLATES:
-nt, -new-templates run only new templates added in latest nuclei-templates release
-ntv, -new-templates-version string[] run new templates added in specific version
-as, -automatic-scan automatic web scan using wappalyzer technology detection to tags mapping
-t, -templates string[] list of template or template directory to run (comma-separated, file)
-turl, -template-url string[] template url or list containing template urls to run (comma-separated, file)
-ai, -prompt string generate and run template using ai prompt
-w, -workflows string[] list of workflow or workflow directory to run (comma-separated, file)
-wurl, -workflow-url string[] workflow url or list containing workflow urls to run (comma-separated, file)
-validate validate the passed templates to nuclei
-nss, -no-strict-syntax disable strict syntax check on templates
-td, -template-display displays the templates content
-tl list all available templates
-tgl list all available tags
-sign signs the templates with the private key defined in NUCLEI_SIGNATURE_PRIVATE_KEY env variable
-code enable loading code protocol-based templates
-dut, -disable-unsigned-templates disable running unsigned templates or templates with mismatched signature
-esc, -enable-self-contained enable loading self-contained templates
-egm, -enable-global-matchers enable loading global matchers templates
-file enable loading file templates
FILTERING:
-a, -author string[] templates to run based on authors (comma-separated, file)
-tags string[] templates to run based on tags (comma-separated, file)
-etags, -exclude-tags string[] templates to exclude based on tags (comma-separated, file)
-itags, -include-tags string[] tags to be executed even if they are excluded either by default or configuration
-id, -template-id string[] templates to run based on template ids (comma-separated, file, allow-wildcard)
-eid, -exclude-id string[] templates to exclude based on template ids (comma-separated, file)
-it, -include-templates string[] path to template file or directory to be executed even if they are excluded either by default or configuration
-et, -exclude-templates string[] path to template file or directory to exclude (comma-separated, file)
-em, -exclude-matchers string[] template matchers to exclude in result
-s, -severity value[] templates to run based on severity. Possible values: info, low, medium, high, critical, unknown
-es, -exclude-severity value[] templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown
-pt, -type value[] templates to run based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
-ept, -exclude-type value[] templates to exclude based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
-tc, -template-condition string[] templates to run based on expression condition
OUTPUT:
-o, -output string output file to write found issues/vulnerabilities
-sresp, -store-resp store all request/response passed through nuclei to output directory
-srd, -store-resp-dir string store all request/response passed through nuclei to custom directory (default "output")
-silent display findings only
-nc, -no-color disable output content coloring (ANSI escape codes)
-j, -jsonl write output in JSONL(ines) format
-irr, -include-rr -omit-raw include request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only) [DEPRECATED use -omit-raw] (default true)
-or, -omit-raw omit request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only)
-ot, -omit-template omit encoded template in the JSON, JSONL output
-nm, -no-meta disable printing result metadata in cli output
-ts, -timestamp enables printing timestamp in cli output
-rdb, -report-db string nuclei reporting database (always use this to persist report data)
-ms, -matcher-status display match failure status
-me, -markdown-export string directory to export results in markdown format
-se, -sarif-export string file to export results in SARIF format
-je, -json-export string file to export results in JSON format
-jle, -jsonl-export string file to export results in JSONL(ine) format
-rd, -redact string[] redact given list of keys from query parameter, request header and body
CONFIGURATIONS:
-config string path to the nuclei configuration file
-tp, -profile string template profile config file to run
-tpl, -profile-list list community template profiles
-fr, -follow-redirects enable following redirects for http templates
-fhr, -follow-host-redirects follow redirects on the same host
-mr, -max-redirects int max number of redirects to follow for http templates (default 10)
-dr, -disable-redirects disable redirects for http templates
-rc, -report-config string nuclei reporting module configuration file
-H, -header string[] custom header/cookie to include in all http request in header:value format (cli, file)
-V, -var value custom vars in key=value format
-r, -resolvers string file containing resolver list for nuclei
-sr, -system-resolvers use system DNS resolving as error fallback
-dc, -disable-clustering disable clustering of requests
-passive enable passive HTTP response processing mode
-fh2, -force-http2 force http2 connection on requests
-ev, -env-vars enable environment variables to be used in template
-cc, -client-cert string client certificate file (PEM-encoded) used for authenticating against scanned hosts
-ck, -client-key string client key file (PEM-encoded) used for authenticating against scanned hosts
-ca, -client-ca string client certificate authority file (PEM-encoded) used for authenticating against scanned hosts
-sml, -show-match-line show match lines for file templates, works with extractors only
-ztls use ztls library with autofallback to standard one for tls13 [Deprecated] autofallback to ztls is enabled by default
-sni string tls sni hostname to use (default: input domain name)
-dka, -dialer-keep-alive value keep-alive duration for network requests.
-lfa, -allow-local-file-access allows file (payload) access anywhere on the system
-lna, -restrict-local-network-access blocks connections to the local / private network
-i, -interface string network interface to use for network scan
-at, -attack-type string type of payload combinations to perform (batteringram,pitchfork,clusterbomb)
-sip, -source-ip string source ip address to use for network scan
-rsr, -response-size-read int max response size to read in bytes
-rss, -response-size-save int max response size to read in bytes (default 1048576)
-reset reset removes all nuclei configuration and data files (including nuclei-templates)
-tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization
-hae, -http-api-endpoint string experimental http api endpoint
INTERACTSH:
-iserver, -interactsh-server string interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
-itoken, -interactsh-token string authentication token for self-hosted interactsh server
-interactions-cache-size int number of requests to keep in the interactions cache (default 5000)
-interactions-eviction int number of seconds to wait before evicting requests from cache (default 60)
-interactions-poll-duration int number of seconds to wait before each interaction poll request (default 5)
-interactions-cooldown-period int extra time for interaction polling before exiting (default 5)
-ni, -no-interactsh disable interactsh server for OAST testing, exclude OAST based templates
FUZZING:
-ft, -fuzzing-type string overrides fuzzing type set in template (replace, prefix, postfix, infix)
-fm, -fuzzing-mode string overrides fuzzing mode set in template (multiple, single)
-fuzz enable loading fuzzing templates (Deprecated: use -dast instead)
-dast enable / run dast (fuzz) nuclei templates
-dts, -dast-server enable dast server mode (live fuzzing)
-dtr, -dast-report write dast scan report to file
-dtst, -dast-server-token string dast server token (optional)
-dtsa, -dast-server-address string dast server address (default "localhost:9055")
-dfp, -display-fuzz-points display fuzz points in the output for debugging
-fuzz-param-frequency int frequency of uninteresting parameters for fuzzing before skipping (default 10)
-fa, -fuzz-aggression string fuzzing aggression level controls payload count for fuzz (low, medium, high) (default "low")
-cs, -fuzz-scope string[] in scope url regex to be followed by fuzzer
-cos, -fuzz-out-scope string[] out of scope url regex to be excluded by fuzzer
UNCOVER:
-uc, -uncover enable uncover engine
-uq, -uncover-query string[] uncover search query
-ue, -uncover-engine string[] uncover search engine (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow,google,odin,binaryedge) (default shodan)
-uf, -uncover-field string uncover fields to return (ip,port,host) (default "ip:port")
-ul, -uncover-limit int uncover results to return (default 100)
-ur, -uncover-ratelimit int override ratelimit of engines with unknown ratelimit (default 60 req/min) (default 60)
RATE-LIMIT:
-rl, -rate-limit int maximum number of requests to send per second (default 150)
-rld, -rate-limit-duration value maximum number of requests to send per second (default 1s)
-rlm, -rate-limit-minute int maximum number of requests to send per minute (DEPRECATED)
-bs, -bulk-size int maximum number of hosts to be analyzed in parallel per template (default 25)
-c, -concurrency int maximum number of templates to be executed in parallel (default 25)
-hbs, -headless-bulk-size int maximum number of headless hosts to be analyzed in parallel per template (default 10)
-headc, -headless-concurrency int maximum number of headless templates to be executed in parallel (default 10)
-jsc, -js-concurrency int maximum number of javascript runtimes to be executed in parallel (default 120)
-pc, -payload-concurrency int max payload concurrency for each template (default 25)
-prc, -probe-concurrency int http probe concurrency with httpx (default 50)
OPTIMIZATIONS:
-timeout int time to wait in seconds before timeout (default 10)
-retries int number of times to retry a failed request (default 1)
-ldp, -leave-default-ports leave default HTTP/HTTPS ports (eg. host:80,host:443)
-mhe, -max-host-error int max errors for a host before skipping from scan (default 30)
-te, -track-error string[] adds given error to max-host-error watchlist (standard, file)
-nmhe, -no-mhe disable skipping host from scan based on errors
-project use a project folder to avoid sending same request multiple times
-project-path string set a specific project path (default "/tmp")
-spm, -stop-at-first-match stop processing HTTP requests after the first match (may break template/workflow logic)
-stream stream mode - start elaborating without sorting the input
-ss, -scan-strategy value strategy to use while scanning(auto/host-spray/template-spray) (default auto)
-irt, -input-read-timeout value timeout on input read (default 3m0s)
-nh, -no-httpx disable httpx probing for non-url input
-no-stdin disable stdin processing
HEADLESS:
-headless enable templates that require headless browser support (root user on Linux will disable sandbox)
-page-timeout int seconds to wait for each page in headless mode (default 20)
-sb, -show-browser show the browser on the screen when running templates with headless mode
-ho, -headless-options string[] start headless chrome with additional options
-sc, -system-chrome use local installed Chrome browser instead of nuclei installed
-lha, -list-headless-action list available headless actions
DEBUG:
-debug show all requests and responses
-dreq, -debug-req show all sent requests
-dresp, -debug-resp show all received responses
-p, -proxy string[] list of http/socks5 proxy to use (comma separated or file input)
-pi, -proxy-internal proxy all internal requests
-ldf, -list-dsl-function list all supported DSL function signatures
-tlog, -trace-log string file to write sent requests trace log
-elog, -error-log string file to write sent requests error log
-version show nuclei version
-hm, -hang-monitor enable nuclei hang monitoring
-v, -verbose show verbose output
-profile-mem string generate memory (heap) profile & trace files
-vv display templates loaded for scan
-svd, -show-var-dump show variables dump for debugging
-vdl, -var-dump-limit int limit the number of characters displayed in var dump (default 255)
-ep, -enable-pprof enable pprof debugging server
-tv, -templates-version shows the version of the installed nuclei-templates
-hc, -health-check run diagnostic check up
UPDATE:
-up, -update update nuclei engine to the latest released version
-ut, -update-templates update nuclei-templates to latest released version
-ud, -update-template-dir string custom directory to install / update nuclei-templates
-duc, -disable-update-check disable automatic nuclei/templates update check
STATISTICS:
-stats display statistics about the running scan
-sj, -stats-json display statistics in JSONL(ines) format
-si, -stats-interval int number of seconds to wait between showing a statistics update (default 5)
-mp, -metrics-port int port to expose nuclei metrics on (default 9092)
-hps, -http-stats enable http status capturing (experimental)
CLOUD:
-auth configure projectdiscovery cloud (pdcp) api key (default true)
-tid, -team-id string upload scan results to given team id (optional) (default "none")
-cup, -cloud-upload upload scan results to pdcp dashboard [DEPRECATED use -dashboard]
-sid, -scan-id string upload scan results to existing scan id (optional)
-sname, -scan-name string scan name to set (optional)
-pd, -dashboard upload / view nuclei results in projectdiscovery cloud (pdcp) UI dashboard
-pdu, -dashboard-upload string upload / view nuclei results file (jsonl) in projectdiscovery cloud (pdcp) UI dashboard
AUTHENTICATION:
-sf, -secret-file string[] path to config file containing secrets for nuclei authenticated scan
-ps, -prefetch-secrets prefetch secrets from the secrets file
EXAMPLES:
Run nuclei on single host:
$ nuclei -target example.com
Run nuclei with specific template directories:
$ nuclei -target example.com -t http/cves/ -t ssl
Run nuclei against a list of hosts:
$ nuclei -list hosts.txt
Run nuclei with a JSON output:
$ nuclei -target example.com -json-export output.json
Run nuclei with sorted Markdown outputs (with environment variables):
$ MARKDOWN_EXPORT_SORT_MODE=template nuclei -target example.com -markdown-export nuclei_report/
Additional documentation is available at: https://docs.nuclei.sh/getting-started/running
```

9
nucleo/saber/conocimiento/README.md
View file

@ -10,6 +10,15 @@ con los comandos que se usan de verdad. Usan marcadores como `TU_IP` en vez de
direcciones reales; están limpios de datos personales (sin hosts, credenciales,
rutas ni referencias privadas).
`06 - Cheatsheets/Comandos de herramientas.md` reúne las invocaciones más usadas
de las herramientas que no traen man page (ffuf, sqlmap, la suite impacket,
netexec, hydra, evil-winrm...). `09 - Manuales/` va un paso más allá: es la salida
de `--help` de esas mismas herramientas, cosechada con `../manuales.py` de la
propia herramienta instalada y limpia de rutas. Entre las dos cosas —la
invocación común y la referencia completa de opciones— el modelo tiene el manual
que la man page no da. Si instalas una herramienta más, corre `manuales.py` y
manda el `.md` nuevo: es un buen commit.
Es la parte del RAG que SÍ se publica: el conocimiento genérico. Los apuntes
personales del usuario (su `saber.jsonl`, su diario) no se suben —ver
[../../../PRIVACIDAD.md](../../../PRIVACIDAD.md)—; este pack los complementa, y en

101
nucleo/saber/indexa.py
View file

@ -36,6 +36,10 @@ import sys
AQUI = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
COFRE = os.path.expanduser("~/COFRE")
INDICE = os.path.join(AQUI, "datos", "saber.jsonl")
# El indice PUBLICO y portable: solo glosario + pack de conocimiento, sin nada de
# la maquina (ni COFRE, ni man pages, ni servidores). Se commitea con vectores ya
# calculados para que un clon recien hecho consulte al instante, sin reindexar.
INDICE_PUBLICO = os.path.join(AQUI, "datos", "saber-publico.jsonl")
# Los perfiles que se indexan. Cada uno es una carpeta de ~/COFRE.
PERFILES = ["PENTESTERS", "PHISHERS", "REVERSERS", "PROTECTORS", "HARD-WARERS",
@ -145,6 +149,66 @@ def trocea(ruta):
yield buffer.strip()
def _conocimiento():
"""El pack de metodologia y manuales que viene con el repo (conocimiento/)."""
fragmentos = []
base_con = os.path.join(os.path.dirname(os.path.abspath(__file__)), "conocimiento")
if not os.path.isdir(base_con):
return fragmentos
for raiz, _, ficheros in os.walk(base_con):
m = re.match(r"^\d{2}\s*-\s*(.+)$", os.path.basename(raiz))
tema = m.group(1).strip().lower() if m else ""
for fich in ficheros:
if not fich.endswith(".md"):
continue
for trozo in trocea(os.path.join(raiz, fich)):
fragmentos.append({
"tipo": "metodologia", "herramienta": fich[:-3],
"perfil": "PENTESTERS", "tema": tema,
"fichero": os.path.join("conocimiento", os.path.relpath(
os.path.join(raiz, fich), base_con)),
"texto": trozo})
return fragmentos
def _guarda_indice(todo, ruta):
"""Calcula los vectores de las entradas y las escribe a un indice jsonl."""
print(" cargando el modelo de embeddings...", flush=True)
from model2vec import StaticModel
modelo = StaticModel.from_pretrained("minishlab/potion-multilingual-128M")
print(" calculando vectores...", flush=True)
vectores = modelo.encode([e["texto"] for e in todo], show_progress_bar=False)
os.makedirs(os.path.dirname(ruta), exist_ok=True)
with open(ruta, "w", encoding="utf-8") as f:
for entrada, vec in zip(todo, vectores):
entrada["v"] = [round(float(x), 5) for x in vec]
f.write(json.dumps(entrada, ensure_ascii=False) + "\n")
print(f" indice guardado: {ruta} ({os.path.getsize(ruta)//1024} KB)")
def construye_publico(solo_cuenta=False):
"""El indice PORTABLE que se sube al repo: glosario + pack de conocimiento.
Nada de la maquina —ni COFRE, ni man pages, ni servidores SSH—, asi que es
100 % publico y vale igual en cualquier equipo. Un clon lo usa tal cual hasta
que corre su propio indexa.py; asi el trabajo de indexar el pack no se repite.
"""
try:
from saber import glosario
except ImportError:
import glosario
glo = list(glosario.entradas())
con = _conocimiento()
todo = glo + con
print(f" glosario {len(glo)} + conocimiento {len(con)} = {len(todo)} entradas publicas")
if solo_cuenta:
return 0
_guarda_indice(todo, INDICE_PUBLICO)
return 0
def construye(solo_cuenta=False, solo_cofre=False):
fichas, fragmentos = [], []
@ -195,23 +259,8 @@ def construye(solo_cuenta=False, solo_cofre=False):
# esta scrubeado, asi que un clon recien hecho —sin apuntes propios de COFRE—
# ya sabe de pentesting. En la maquina del usuario se solapa con sus apuntes
# y el deduplicado de busca lo colapsa.
conocimiento = []
base_con = os.path.join(os.path.dirname(os.path.abspath(__file__)), "conocimiento")
if os.path.isdir(base_con):
for raiz, _, ficheros in os.walk(base_con):
m = re.match(r"^\d{2}\s*-\s*(.+)$", os.path.basename(raiz))
tema = m.group(1).strip().lower() if m else ""
for fich in ficheros:
if not fich.endswith(".md"):
continue
for trozo in trocea(os.path.join(raiz, fich)):
conocimiento.append({
"tipo": "metodologia", "herramienta": fich[:-3],
"perfil": "PENTESTERS", "tema": tema,
"fichero": os.path.join("conocimiento", os.path.relpath(
os.path.join(raiz, fich), base_con)),
"texto": trozo})
print(f" CONOCIMIENTO {len(conocimiento):5d} fragmentos (pack del repo)")
conocimiento = _conocimiento()
print(f" CONOCIMIENTO {len(conocimiento):5d} fragmentos (pack del repo)")
todo = fichas + fragmentos + sistema + conocimiento
print(f"\n total: {len(fichas)} fichas + {len(fragmentos)} apuntes + "
@ -219,19 +268,7 @@ def construye(solo_cuenta=False, solo_cofre=False):
if solo_cuenta:
return 0
print(" cargando el modelo de embeddings...", flush=True)
from model2vec import StaticModel
modelo = StaticModel.from_pretrained("minishlab/potion-multilingual-128M")
print(" calculando vectores...", flush=True)
vectores = modelo.encode([e["texto"] for e in todo], show_progress_bar=False)
os.makedirs(os.path.dirname(INDICE), exist_ok=True)
with open(INDICE, "w", encoding="utf-8") as f:
for entrada, vec in zip(todo, vectores):
entrada["v"] = [round(float(x), 5) for x in vec]
f.write(json.dumps(entrada, ensure_ascii=False) + "\n")
print(f" indice guardado: {INDICE} ({os.path.getsize(INDICE)//1024} KB)")
_guarda_indice(todo, INDICE)
return 0
@ -246,7 +283,11 @@ def main() -> int:
help="di que encontrarias, sin indexar")
p.add_argument("--solo-cofre", action="store_true",
help="indexar solo COFRE, sin la documentacion del sistema")
p.add_argument("--publico", action="store_true",
help="construir el indice portable (glosario + conocimiento) que se sube al repo")
a = p.parse_args()
if a.publico:
return construye_publico(solo_cuenta=a.cuenta)
return construye(solo_cuenta=a.cuenta, solo_cofre=a.solo_cofre)

139
nucleo/saber/manuales.py Normal file
View file

@ -0,0 +1,139 @@
#!/usr/bin/env python3
"""Cosecha el manual de las herramientas que no traen man page.
./manuales.py regenera conocimiento/09 - Manuales/
./manuales.py --lista di que herramientas cosecharia y cuales estan
Muchas herramientas de pentesting (ffuf, sqlmap, la suite impacket, netexec...)
no instalan man page: su "manual" es lo que sueltan con --help. Este script lo
captura, lo limpia de rutas y datos de la maquina, y lo escribe como markdown en
el pack de conocimiento, donde indexa.py lo recoge como todo lo demas.
Solo cosecha lo que ESTA instalado en la maquina. El resultado (los .md) se
commitea, asi que crece con lo que cada quien tenga: quien instale una
herramienta mas, regenera y manda el .md nuevo. Es el complemento verificado del
cheatsheet escrito a mano (que da las invocaciones comunes; esto da la lista
completa de opciones).
"""
import argparse
import os
import re
import shutil
import subprocess
import sys
AQUI = os.path.dirname(os.path.abspath(__file__))
DESTINO = os.path.join(AQUI, "conocimiento", "09 - Manuales")
# Las herramientas cuyo manual vale la pena y que no suelen traer man page.
# (comando, [argumentos para pedir la ayuda]). Se prueban en orden hasta que una
# devuelva algo con sustancia.
CATALOGO = [
("ffuf", ["-h"]),
("feroxbuster", ["--help"]),
("gobuster", ["--help"]),
("sqlmap", ["-hh"]),
("nuclei", ["-h"]),
("hydra", ["-h"]),
("netexec", ["--help"]),
("crackmapexec", ["--help"]),
("evil-winrm", ["--help"]),
("john", []), # john sin args ya imprime el uso
("hashcat", ["--help"]),
("wpscan", ["--help"]),
("nikto", ["-Help"]),
("smbmap", ["-h"]),
("enum4linux-ng", ["-h"]),
("wfuzz", ["-h"]),
("dirsearch", ["-h"]),
("responder", ["-h"]),
("chisel", ["--help"]),
("ligolo-proxy", ["-h"]),
("bloodhound-python", ["-h"]),
("certipy", ["-h"]),
("kerbrute", ["-h"]),
# La suite impacket: cada binario es una herramienta.
("impacket-secretsdump", ["-h"]),
("impacket-GetUserSPNs", ["-h"]),
("impacket-GetNPUsers", ["-h"]),
("impacket-getTGT", ["-h"]),
("impacket-psexec", ["-h"]),
("impacket-wmiexec", ["-h"]),
("impacket-smbexec", ["-h"]),
("impacket-smbserver", ["-h"]),
("impacket-mssqlclient", ["-h"]),
("impacket-ntlmrelayx", ["-h"]),
]
ANSI = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
CASA = re.compile(re.escape(os.path.expanduser("~")))
USUARIO = re.compile(re.escape(os.environ.get("USER", "\0nadie\0")))
def limpia(texto):
"""Quita colores y cualquier rastro de la maquina de esta cosecha."""
texto = ANSI.sub("", texto)
texto = CASA.sub("~", texto) # /home/quien-sea -> ~
texto = USUARIO.sub("usuario", texto) # el login real -> generico
texto = re.sub(r"[ \t]+\n", "\n", texto) # espacios al final de linea
texto = re.sub(r"\n{3,}", "\n\n", texto) # como mucho una linea en blanco
return texto.strip()
def ayuda(cmd, args):
"""La salida de ayuda de una herramienta, o None si no dice nada util."""
if not shutil.which(cmd):
return None
for intento in (args, ["--help"], ["-h"], []):
try:
r = subprocess.run([cmd, *intento], capture_output=True, text=True,
timeout=15, errors="ignore")
except (subprocess.TimeoutExpired, OSError):
continue
salida = (r.stdout or "") + (r.stderr or "")
salida = limpia(salida)
if len(salida) >= 120: # menos que esto no es un manual
return salida
return None
def escribe(cmd, texto):
md = (f"# {cmd} — manual\n\n"
f"Salida de `{cmd} {'--help' if not cmd.startswith('impacket') else '-h'}`, "
f"capturada de la propia herramienta. Referencia completa de opciones "
f"(las invocaciones del dia a dia estan en el cheatsheet de comandos).\n\n"
f"```\n{texto}\n```\n")
os.makedirs(DESTINO, exist_ok=True)
ruta = os.path.join(DESTINO, f"{cmd}.md")
with open(ruta, "w", encoding="utf-8") as f:
f.write(md)
return ruta
def main():
p = argparse.ArgumentParser()
p.add_argument("--lista", action="store_true",
help="di que cosecharia y que hay instalado, sin escribir")
a = p.parse_args()
if a.lista:
for cmd, _ in CATALOGO:
hay = "instalada" if shutil.which(cmd) else "-"
print(f" {cmd:26s} {hay}")
return 0
hechos = faltan = 0
for cmd, args in CATALOGO:
texto = ayuda(cmd, args)
if texto is None:
faltan += 1
continue
ruta = escribe(cmd, texto)
print(f" {cmd:26s} -> {os.path.relpath(ruta, AQUI)} ({len(texto)} car.)")
hechos += 1
print(f"\n {hechos} manuales cosechados, {faltan} no instalados en esta maquina")
return 0
if __name__ == "__main__":
sys.exit(main())