Internal Recon

{
  "skill_name": "internal-recon",
  "evals": [
    {
      "id": 1,
      "name": "internal-port-service-value-mapping",
      "prompt": "内网扫描发现一台主机开放端口：88, 389, 445, 636, 3268, 53。仅凭这些端口你能判断这是什么角色的服务器？为什么？攻击价值有多高？",
      "expected_output": "这是域控(Domain Controller)。88=Kerberos, 389=LDAP, 636=LDAPS, 3268=Global Catalog, 53=DNS 都是 AD DC 的标志。攻击价值极高——拿到 DC 等于控制整个域",
      "expectations": [
        "域控|Domain Controller|DC",
        "88|Kerberos|认证服务",
        "389|LDAP|目录服务|636",
        "3268|Global Catalog|全局编录",
        "极高|最高价值|控制域|关键目标"
      ],
      "required_terms": [
        "LDAP",
        "Kerberos",
        "Global Catalog"
      ]
    },
    {
      "id": 2,
      "name": "internal-arp-passive-discovery",
      "prompt": "你进入内网但不想触发 IDS。主动 ping sweep 和 nmap SYN 扫描都可能被检测。有什么被动方式发现内网存活主机？",
      "expected_output": "1. ARP 被动监听（tcpdump/arp-scan passive）—— 内网 ARP 广播自然暴露存活主机 2. 监听 NBNS/LLMNR 广播 3. DNS zone transfer 尝试",
      "expectations": [
        "ARP|被动监听|广播|arp-scan",
        "NBNS|LLMNR|广播|NetBIOS",
        "被动|不触发|IDS|避免检测",
        "tcpdump|抓包|监听|嗅探",
        "DNS|zone transfer|区域传输"
      ],
      "required_terms": [
        "ARP",
        "NBNS",
        "LLMNR"
      ]
    },
    {
      "id": 3,
      "name": "internal-multi-nic-pivot",
      "prompt": "你拿到的内网主机执行 ip addr 发现有 2 张网卡：eth0: 10.0.1.50/24, eth1: 172.16.0.50/24。这意味着什么？下一步应该怎么做？",
      "expected_output": "双网卡意味着这台机器连接两个网段，是天然跳板(pivot point)。应该立即扫描 172.16.0.0/24 新网段，可能有新的攻击面。通过此机器做代理访问第二层网络",
      "expectations": [
        "双网卡|两个网段|跨网段|pivot",
        "跳板|pivot point|天然桥接",
        "172.16.0.0/24|新网段|扫描|发现",
        "代理|转发|通过此机器访问",
        "新攻击面|扩大范围|深入内网"
      ],
      "required_terms": [
        "172.16.0.0/24",
        "pivot"
      ]
    }
  ]
}

{
  "skill_id": "internal-recon",
  "recall_tests": [
    {
      "id": 1,
      "type": "keyword_positive",
      "description": "核心关键词",
      "keywords": [
        "internal recon",
        "内网",
        "侦察"
      ]
    },
    {
      "id": 2,
      "type": "keyword_positive",
      "description": "技术搜索",
      "keywords": [
        "存活探测",
        "端口扫描",
        "域控",
        "拓扑"
      ]
    },
    {
      "id": 3,
      "type": "keyword_negative",
      "description": "不应被外网recon召回",
      "keywords": [
        "subdomain",
        "fofa"
      ]
    }
  ],
  "llm_tests": [
    {
      "id": 1,
      "name": "internal-recon-scenario",
      "scenario": "已获取内网主机权限，需要进行内网信息收集。请搜索内网侦察方法论。",
      "max_rounds": 2,
      "expect_tool_calls": [
        {
          "tool": "list_skills",
          "keyword_contains": "internal|recon|内网|侦察|横向"
        },
        {
          "tool": "read_skill",
          "id": "internal-recon"
        }
      ]
    }
  ]
}