uphiago/recon-skills

# SAML SSO Attack Skill

SAML Single Sign-On attack methodology — IdP metadata analysis, XML Signature Wrapping (XSW), signature stripping, comment injection in NameID, and SSO timing-based user enumeration. Confirmed on TARGET_ORG_A (SimpleSAMLphp IdP, 79 XMLRPC methods on WordPress SP), TARGET_ORG_B (Ory Kratos + OIDC), and TARGET_ORG_C (ADFS WS-Trust exposed).

## When to Use

- Target uses SSO (redirects to `idp.`, `sso.`, `login.`, `auth.` subdomains).
- URL contains `SAMLRequest=` or `SAMLResponse=` parameter.
- Metadata endpoint accessible at `/saml2/idp/metadata.php` or `/FederationMetadata/2007-06/FederationMetadata.xml`.
- After `exchange-owa-attack` discovers ADFS.

## Prerequisites

- curl, python3.

# Cross-Attack Chains

An attack chain is a sequence of verified security behaviors in which each step
provides a prerequisite for the next. Several findings on the same target do
not form a chain unless the dependency between them is demonstrated.

## When to Use

- Two or more validated findings affect the same trust boundary.
- One finding exposes an identity, token, route, host, or capability needed by
  another.
- A report needs to distinguish standalone impact from compound impact.
- The next chain step cannot be tested safely and must be labeled inferred.

# WordPress Compromise Path Analysis

Use this skill to determine whether verified WordPress primitives actually
compose into administrative control or benign code-execution proof. It is a
chain gate, not a checklist for forcing escalation after a prerequisite fails.

## When to Use

- A plugin vulnerability has exact version and route evidence.
- An approved identity may have an unexpected WordPress capability.
- An upload or configuration write could reach executable handling.
- CORS, XML-RPC, staging, or source exposure may supply a missing prerequisite.

## Prerequisites

# Docker Privilege Escalation Skill

Docker container escape and privilege escalation — Docker socket abuse, volume mount host takeover, docker group root-equivalence, and prior-privilege-escalation detection. Docker group membership = instant root on the host via 5 distinct techniques. Confirmed on fitness-chain (Docker containers extracted, 12 image layers, privileged mode) and gov-finance-portal (Dockerfile + docker-compose.prod.yml exposed in GitLab).

## When to Use

- You have shell access to a Docker container (via webshell, SSH, or API exploit).
- `id` shows you're in the `docker` group or have access to `/var/run/docker.sock`.
- `docker ps` or `docker info` works from within the container.
- After `api-noauth-hunt` or `wordpress-full-compromise` achieves RCE in a container.
- Docker socket is mounted at `/var/run/docker.sock` (check: `ls -la /var/run/docker.sock`).

## Prerequisites

# Attack Patterns Reference

This catalog maps observed web and WordPress behavior to the skill that owns
its validation. Pattern IDs are navigation labels. They do not establish
exploitability, severity, prevalence, or a confirmed attack path.

## When to Use

- A recon result needs to be classified before focused testing.
- Several verified behaviors may form a candidate attack path.
- A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an
  owning validation procedure.

Do not use the catalog as a scanner finding list or a substitute for the

# Cross-Wave Delta Analysis Skill

Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.

## When to Use

- Running repeated recon on the same target set (Wave N+1 after Wave N).
- You want to know if a vulnerability was PATCHED since last wave.
- You want to know if a NEW surface appeared (new ports, new subdomains, new endpoints).
- After completing a deep recon wave — produce the delta report before next wave.
- Before reporting — confirm findings are still valid (not regressed).

## Prerequisites

# Google Dorks Catalog -- Exposed Configs & Secrets

## When to Use

- During **passive reconnaissance** (Phase 1) on every target
- After crt.sh subdomain enumeration
- Before any active scanning
- Validated against 100+ real targets

## High-Precision Dorks

### Critical Exposed Files

```

# Pentest Playbook Skill

7-phase master pentest pipeline covering the full lifecycle from passive reconnaissance to exploitation and reporting. Distilled from 100+ targets across government, healthtech, fintech, e-commerce, ISP, and SMB sectors. This is the "meta-playbook" — it tells you what to do at each stage of an engagement and which skills to load for each phase.

## When to Use

- Starting a new pentest engagement with an unknown target.
- You need the canonical workflow for any type of target.
- After surface recon — this playbook tells you what to do next.
- Training — understand the full lifecycle of a professional pentest.

## The 7-Phase Pipeline

| Phase | Name | Focus | Key Skills | Duration |

# External Web Recon Playbook

Use this playbook to turn an authorized root domain or asset list into a
prioritized map of web applications, APIs, authentication boundaries, and
testable security hypotheses.

```text
scope
  -> assets
  -> DNS and services
  -> routes and client code
  -> APIs and identities
  -> hypotheses
  -> focused validation

# Sector Recon Methodology Skill

Methodology for selecting non-regulated industry sectors with the highest WordPress vulnerability rates, compiling company domain lists, and running batch reconnaissance within authorized engagements. Distilled from surveying 600+ US company domains across 28 sectors under bug bounty and authorized testing programs.

## When to Use

- Planning a new recon campaign and need to choose sectors.
- Expanding from tested sectors into new ones.
- Building target lists from sector keywords via crt.sh.
- After `recon-playbook` Phase 0 — this skill provides the sector intelligence.
- Comparing your findings against baseline vulnerability rates per sector.

## Prerequisites

# 401/403 Bypass Techniques

A bypass candidate appears when two HTTP-processing layers (CDN, reverse proxy,
web server, framework) decide differently about the same request. The useful
signal is a change in routing or protected content, not a status code alone.

## When to Use

- A known route returns `401 Unauthorized` or `403 Forbidden`.
- A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
- Frontend and backend normalize paths, methods, or headers differently.
- IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
- Equivalent requests return different status, headers, or body, hinting at a routing differential.

# API No-Authentication Validation

Identify API operations that may be reachable without the authentication or
authorization required by their data and business function. Discovery is
read-only by default. Write validation uses synthetic records and requires
explicit authorization immediately before execution.

## When to Use

- Port scan reveals HTTP services on non-standard ports (3000, 5000, 8080-8085, 9000).
- Target has an API subdomain (api.target.com, backend.target.com).
- JavaScript bundles reference internal API endpoints.
- After `port-service-discovery` finds HTTP on unexpected ports.
- After `firebase-supabase-attack` identifies backend APIs.

# ASN Infrastructure Mapping

Map an organization's entire IP infrastructure by pivoting from domain to ASN (Autonomous System Number), extracting CIDR ranges, and discovering every hostname and service across all owned IP blocks. Includes TLD expansion to find sibling domains on different top-level domains with separate infrastructure.

## When to Use

- You have a target domain and want to discover EVERY IP owned by the organization.
- Passive subdomain enumeration found only a few hosts — the rest may be on sibling TLDs or different IP ranges.
- The target has a known ASN that can be expanded to full CIDR blocks.
- Services on non-standard ports are invisible to web-only recon.
- Acquired subsidiaries or international domains may sit on different ASNs with weaker security.

## Prerequisites

# Cache Attack Skill

Web Cache Poisoning (WCP) and Web Cache Deception (WCD) methodology. WCP poisons cached pages with malicious content served to other users. WCD tricks the cache into storing sensitive pages that the attacker can then read. Both techniques exploit CDN and reverse-proxy caching behavior on CloudFront, Cloudflare, Fastly, Varnish, and Nginx.

## When to Use

- Target uses a CDN (CloudFront, Cloudflare, Fastly) or reverse proxy (Varnish, Nginx cache).
- Headers show `X-Cache`, `Age`, `cf-cache-status`, or `X-Cache-Hits`.
- After surface recon finds no direct vulnerabilities — pivot to infrastructure layer.
- Target allows file extension manipulation in URL paths (.css, .json, .js).

## Prerequisites

- `terminal` with curl.

# CMS Detection

Identify the content management system, web framework, server software, and technology stack of every live host. Know which stack you're attacking before you attack it — a WordPress site needs different tests than a Laravel API or a Spring Boot microservice. Multi-CMS detection covers WordPress, Drupal, Joomla, Magento, Shopify, Wix, Squarespace, Laravel, Django, Express, Spring Boot, and more.

## When to Use

- You have a list of alive hosts and need to categorize them by technology.
- WordPress-specific tests produced false positives (the site uses Drupal).
- Need to identify which CMS version is running to match against known CVEs.
- A host returns generic 200 on all paths — technology detection tells you what it actually runs.
- Want to find sites running outdated versions of popular CMS platforms.

## Prerequisites

# CORS Credential WordPress Skill

Detect, confirm, and exploit CORS credential reflection on WordPress REST API endpoints. CORS misconfiguration is one of the most common critical findings in US SMB WordPress sites (~7-8% of all WP targets), enabling cross-origin data exfiltration with victim cookies. Documents 8 CORS variants and full browser PoC construction.

## When to Use

- After `wp-mass-recon` flags a target with `Access-Control-Allow-Credentials: true`.
- Testing any WordPress site's REST API for cross-origin data access.
- Building attack chains: CORS → user enumeration → spear-phishing → ATO.
- Validating whether a CORS finding is exploitable (not just present).

## Prerequisites

- curl and python3.

# Deep Invade Skill

Focused follow-up methodology for WordPress targets prioritized by
`wp-mass-recon`. It connects XML-RPC SSRF validation, exposed-log analysis,
plugin version review, JavaScript inspection, staging discovery, service
mapping, and API enumeration.

## When to Use

- `wp-mass-recon` scored a target >= 6 (CORS confirmed, XMLRPC open, source leaks found).
- You are assigned a single high-value target for deep assessment.
- After surface recon, you need to find the chain that leads to RCE or data breach.
- Multiple independent signals justify a deeper, target-specific follow-up.

# Email Security -- DMARC, SPF, DKIM

## When to Use

- During passive reconnaissance (Phase 1)
- After initial DNS enumeration
- DMARC p=none means the domain can be totally spoofed
- Critical for identifying phishing/business email compromise risks

## DMARC/SPF/DKIM Check Commands

```bash
# SPF
dig +short TXT $target | grep "v=spf1"

# Error Log Mining Skill

Discover and analyze exposed PHP `error_log` files for server paths, database
errors, SQL fragments, API-key candidates, email addresses, and internal
addresses. Collect a bounded sample and validate the sensitivity of its content
instead of inferring impact from file size or status.

## When to Use

- Running `deep-invade` Phase 2 on a high-value target.
- `skill_view(name='source-leak-hunt')` found an `error_log` file with HTTP 200.
- Target has PHP (WordPress, Laravel, custom PHP) with `display_errors` possibly enabled.
- You need server-side context (paths, DB structure) before attempting exploitation.

# Exchange/OWA Attack Skill

Exchange Outlook Web Access reconnaissance covering endpoint mapping, NTLM
Type-2 metadata, authentication controls, and version evidence. Password or
lockout testing requires explicit authorization and approved identities.

## When to Use

- Target has `owa.`, `mail.`, `webmail.`, `exchange.`, or `autodiscover.` subdomains.
- crt.sh reveals Exchange-related SAN names (`mail.domain.com`, `autodiscover.domain.com`).
- Port 443 returns NTLM `WWW-Authenticate: Negotiate` or `WWW-Authenticate: NTLM`.
- After `subdomain-enumeration` discovers mail-related hosts.
- After `port-service-discovery` finds HTTPS on port 443 with Exchange fingerprints.

# Firebase & Supabase Attack Skill

Exploit misconfigured Firebase (Firestore, Storage, Auth) and Supabase (REST API, Storage, Auth) backends. These BaaS platforms are the #1 source of massive data breaches in modern web apps when Row Level Security (RLS) is missing and API keys leak in JavaScript bundles. Confirmed on delivery-platform (204K WhatsApp conversations, 173K phone numbers), visa-processing-platform (64K users, 46K reports), fitness-chain (39K users, 5 Firebase projects, 21 credentials), dental-booking (9 clinics, 1,749 leads).

## When to Use

- JavaScript bundle analysis reveals Firebase config (`apiKey`, `projectId`) or Supabase URL + anon key.
- Target uses a modern SPA (React, Vue, Angular) with BaaS backend.
- After `js-secrets-extraction` finds Firebase/Supabase identifiers.
- After `source-leak-hunt` finds `.env` with `FIREBASE_*` or `SUPABASE_*` variables.

## Prerequisites

- `terminal` with curl, python3, jq.

# Flask/Werkzeug Debugger Exploitation

Flask applications with `debug=True` enable the Werkzeug debugger, which exposes stack traces and (optionally) an interactive Python console. The debugger runs at the same port as the Flask app and activates on any unhandled exception (HTTP 500).

## When to Use

- Port scan reveals an unknown HTTP service on a non-standard port (8080, 8081, 8084, 5000, 8000, etc.)
- An API endpoint returns HTTP 500 with a Flask/Werkzeug error page
- A `?__debugger__=yes` parameter appears in URL resources (CSS, JS, PNG)
[Credential-related source omitted]

## Prerequisites

- `terminal` with curl

# GitHub Secret Hunting

Scan public GitHub repositories for leaked API keys, tokens, passwords, and internal infrastructure details. Developers accidentally push secrets constantly — this skill uses targeted dorking, automated scanning tools, and real-time monitoring to find credentials before the developer notices and revokes them.

## When to Use

- Target has public repositories under an organization account.
- JS bundle analysis reveals internal service names — search GitHub for related config files.
- Need to find valid API keys for cloud services, payment gateways, or third-party integrations.
- The target uses CI/CD systems that may leak tokens in build logs or workflow files.
- Want real-time monitoring for new secret leaks from the target org.

## Prerequisites

# GitLab Public Recon Skill

Enumerate publicly accessible GitLab repositories to extract source code, credentials, internal IPs, CI/CD tokens, deployment configurations, and environment files. GitLab instances with registration enabled or public visibility expose the entire development infrastructure. Confirmed on gov-finance-portal (3 public repos, 461K CPFs, internal IP 10.11.82.75, CI/CD tokens), dev-agency (GitLab with SSL private keys), and fitness-chain (Firebase SA keys in repos).

## When to Use

- Target has a `gitlab.` subdomain or self-hosted GitLab instance.
- crt.sh reveals `gitlab.target.com` in certificates.
- After `subdomain-enumeration` discovers GitLab hosts.
- After `js-secrets-extraction` finds GitLab CI/CD references.
- Target is a government agency or large enterprise (common self-hosted GitLab users).

## Prerequisites

# Hardcoded Credential Hunt

Detect credentials baked into client-side code or HTML responses. Targets include master passwords in form `value` attributes, secret keys in inline scripts, API tokens in configuration endpoints, and plaintext credentials leaked through debug error pages. This class of vulnerability bypasses authentication entirely — no brute force required.

## When to Use

- An application serves HTML forms with pre-filled or hidden password fields.
- A configuration endpoint (`/api/config`, `/env`, `/settings`) returns JSON with credential-like strings.
- A debug/error page leaks application secrets in JavaScript variables.
- An unauthenticated API endpoint returns data that controls authentication (reset, exit registration, admin actions).
- JavaScript bundles contain string assignments matching password patterns.

## Prerequisites

# HTTP/2 Header Impersonation

Spoof HTTP/2 SETTINGS frames, pseudo-header ordering, and browser-specific HTTP headers to match real browsers at the protocol level. Targets the detection gap between TLS fingerprinting (ClientHello) and JavaScript fingerprinting — the HTTP/2 connection setup and header structure that anti-bot systems analyze. Matches Chrome, Firefox, Safari iOS, and OkHttp (Android) profiles with exact window sizes, header list limits, and header ordering.

## When to Use

- TLS fingerprint is correct but target still detects non-browser HTTP behavior.
- Target uses HTTP/2-specific detection (SETTINGS frame analysis, pseudo-header order).
- Need browser-accurate `sec-ch-ua`, `Accept`, `Accept-Encoding`, `Priority`, and `sec-fetch-*` headers.
- Mobile API endpoints require Android OkHttp header profiles.
- Combining with TLS impersonation for a complete network-level browser profile.

## Prerequisites

# Humanize Automation

Replace instant programmatic interactions with human-like mouse movements, keyboard typing, and scroll patterns. Patches Playwright's API at the class level — `page.click()`, `page.type()`, `page.fill()`, and Locator methods are automatically replaced with Bézier-curved mouse paths, per-character typing with mistypes, and multi-phase scroll acceleration. One flag (`humanize=True`) enables all behavioral patches. No code changes required.

## When to Use

- Target uses behavioral bot detection (mouse trajectory analysis, typing speed profiling).
- reCAPTCHA v3 scores are low (<0.3) despite correct browser fingerprint.
- Target times out or challenges after rapid form submissions.
- Need to simulate a real user browsing session for login or account creation.
- Target uses `requestAnimationFrame`-based mouse movement tracking.

## Prerequisites

# IoT Camera Recon Skill

IP camera assessment covering RTSP exposure, vendor configuration endpoints,
ONVIF service enumeration, authentication controls, and firmware
identification.

## When to Use

- `port-mass-scan` finds RTSP (554) or camera HTTP ports (80, 8010, 8011).
- Target is a physical security company, traffic management, or government surveillance.
- Shodan search reveals camera devices in the target's IP range.
- After `port-service-discovery` finds Axis/Hikvision/Dahua ONVIF services.

## Prerequisites

# JS Bundle & Source Map Analysis -- Secret Extraction

## When to Use

- **ALWAYS** after initial web enumeration
- When you find modern SPA (React, Angular, Vue)
- When target uses Firebase, Supabase, Auth0
- Higher yield than directory scanning on many targets

## Why Analyze JS Bundles

Modern JavaScript bundles (Webpack, Vite, esbuild) often contain:
- Hardcoded API keys and tokens
- Internal API URLs

# JWT Attack Skill

Complete JWT attack methodology — decode without verification, algorithm confusion (alg:none, RS256→HS256), weak secret brute force (hashcat/john/simple), kid injection, expired token reuse, and hardcoded JWT extraction from JS bundles. Confirmed on enterprise-portal (JWT-based sessions), fintech-processor (315 JWT tokens in Efí bank logs), fitness-chain (3 JWT sessions with 2027 expiry), delivery-platform (hardcoded JWTs in JS bundles), and gov-finance-portal (JWT secret leaked in Vite source).

## When to Use

[Credential-related source omitted]
- JavaScript bundles contain `eyJ...` token patterns.
- After `js-secrets-extraction` finds JWT tokens.
- After `api-noauth-hunt` needs token forging for auth bypass.
[Credential-related source omitted]

## Prerequisites

# Origin IP Discovery

Discover the real server IP behind CDN/WAF protections (Cloudflare, Akamai, Fastly). When the origin IP is found, the raw server is exposed without firewall rules, rate limiting, or application-layer filtering. Techniques include favicon hash fingerprinting across Shodan, historical DNS records from passive sources, SSL certificate SAN field matching, and Google Analytics ID cross-referencing.

## When to Use

- Target is behind Cloudflare/Akamai and returns 403 or CAPTCHA challenges on all requests.
- You need direct access to the origin to bypass WAF rules.
- Subdomain enumeration reveals internal/staging hosts on non-CDN IPs.
- The target uses a single favicon across all infrastructure.
- SSL certificates share the same organization name across IPs.

## Prerequisites

# PHPInfo → RCE Chain Skill

Evaluate exposed `phpinfo()` pages for configuration disclosure and the
prerequisites of a separate execution path. Enabled process functions do not
create RCE without an authorized code or file-execution primitive.

## When to Use

- `source-leak-hunt` flags a target with `info.php` or `phpinfo.php` exposed.
- You need to confirm whether RCE is possible before investing in upload vectors.
- Building an attack chain that requires code execution.
- Target has a file upload path (open registration + XMLRPC, contact form, profile image, etc.).

## Prerequisites

# Port Mass Scan Skill

High-speed port scanning methodology using RustScan for single hosts and Masscan for large IP ranges. RustScan provides 400x speedup over Nmap for 1000-port scans (3-10s vs 5-10min). Masscan handles /8 and /16 ranges that Nmap cannot. The ISP and government network examples below were from authorized infrastructure assessments with signed RoE.

## When to Use

- Authorized red team engagement with signed RoE covering the target IP range.
- Fast single-host port discovery before Nmap service enumeration.
- After `subdomain-enumeration` — scan resolved IPs for non-HTTP services.
- ISP-wide or /8 scanning without explicit written authorization is illegal in most jurisdictions. This skill exists for legitimate authorized engagements, not mass scanning.

## Prerequisites

- `terminal` with masscan, rustscan, and nmap installed.

# Port & Service Discovery Skill

Use scoped Nmap discovery to identify services adjacent to web applications,
including databases, remote administration, mail, caches, and non-standard API
ports. An open port is an observation; service identity and unauthorized access
require separate validation.

## When to Use

- Running `deep-invade` Phase 6 on a high-value target.
- After surface recon shows no exploitable web vulnerabilities — pivot to infrastructure.
- When the target is a SaaS with backend APIs on non-standard ports.
- After discovering a staging subdomain — check for database/admin ports.

# S3/MinIO Content-Type Override to Stored XSS

Exploit public cloud storage buckets (S3, MinIO, and compatible) by overriding the `Content-Type` response header via query parameters. When a target serves user-uploaded files from its own origin (e.g., `cdn.target.com` or `target.com/uploads/`), a successful override turns a stored HTML/JS payload into same-origin stored XSS — bypassing every upload-time validation the application performed.

## When to Use

- Target serves user-uploaded files (images, avatars, attachments) from a public bucket.
- Files are served under the target's own domain or subdomain (not a random storage domain).
- Upload validation appears solid (extension whitelist, magic byte check, forced Content-Type) — the override bypasses all of these at serve time, not upload time.
- The bucket URL responds to `?response-content-type=` with a changed Content-Type.
- The bucket returns an AWS SignatureDoesNotMatch error leaking the real bucket host and region.

## Prerequisites

# SCADA Hikvision ISAPI Enumeration

Enumerate Hikvision ISAPI (Intelligent Security Application Programming Interface) endpoints on industrial control and surveillance web interfaces. Hikvision devices and HikCentral Professional deployments expose a rich REST/XML API at predictable paths. While most endpoints require authentication (CAS session token, Basic auth, or Digest auth), unauthenticated enumeration reveals the device type, firmware baseline, available modules, and potential attack surface. JavaScript bundles often contain the full ISAPI route tree.

## When to Use

- A web interface on a non-standard port (443, 8443, 9443) loads a large JavaScript bundle with references to `/ISAPI/`, `Bumblebee`, or `Streaming/channels`.
- Port scan reveals RTSP (554), ONVIF (8899), or Hikvision-specific ports (8000, 9010).
- The server header or SSL certificate references Hikvision, HikCentral, iVMS, or Pyramid.
- A target has industrial/energy/infrastructure context where SCADA systems are likely.
- The web client loads `Common/common.js`, `Common/components.js`, or `Common/vendorGraph.js` from a relative path.

## Prerequisites

# Source Leak Hunt Skill

Mass scanning for exposed sensitive files (`.env`, `.git/config`, `wp-config.php.bak`, `debug.log`, `backup.sql`, `phpinfo.php`, `Dockerfile`, etc.) with content-based false positive filtering. Source leaks are the second most common finding (~7% of targets) after WordPress user enumeration.

## When to Use

- After `skill_view(name='wp-mass-recon')` confirms a target is alive.
- Broad scanning across a batch of domains.
- When probing for credential exposure that enables deeper access.
- Complementing `skill_view(name='js-secrets-extraction')` for client-side secrets.

## Prerequisites

- `terminal` with curl.

# Staging & Subdomain Hunt Skill

Discover staging, development, and internal subdomains through certificate transparency (crt.sh), DNS brute force, and web probing. Exploit the staging security gap — staging environments consistently have weaker security than production (no WAF, debug enabled, install pages accessible). Proven on 7 US targets where staging subdomains exposed phpinfo, WordPress install pages, and internal APIs not visible on production.

## When to Use

- Running `deep-invade` Phase 5 on a high-value target.
- Production target is well-secured (WAF, no leaks) — pivot to staging.
- Target has a large attack surface (e-commerce, SaaS, franchise model).
- You need additional entry points when the main site is hardened.
- After `subdomain-enumeration` produces a list of subdomains.

## Prerequisites

# Stealth Browser Launch

Launch a patched Chromium binary with C++ source-level fingerprint modifications that bypass anti-bot detection. The binary spoofs canvas, WebGL, audio, GPU, screen, WebRTC, network timing, and automation signals at the binary level — not via JavaScript injection or config patches that break with Chrome updates. Passes Cloudflare Turnstile, reCAPTCHA v3 (0.9 score), FingerprintJS, BrowserScan, and 30+ detection sites.

## When to Use

- Target blocks curl/httpx/nuclei with Cloudflare, Akamai, DataDome, or Kasada.
- Need full browser JavaScript execution for form submission, login, or XSS testing.
- Target returns 403 on all unauthenticated requests even with proper headers.
- Need to access reCAPTCHA-protected endpoints without solving CAPTCHAs.
- Running automated recon behind residential proxies — stealth browser prevents IP+UA correlation.

## Prerequisites

# Subdomain Enumeration Skill

Comprehensive subdomain discovery using certificate transparency logs (crt.sh), DNS brute force, and passive sources. The first step in any recon pipeline — you can't attack what you don't know exists. Subdomain enumeration consistently reveals staging environments, internal admin panels, API gateways, and forgotten WordPress installs that are softer targets than the production site.

## When to Use

- Starting recon on any target domain.
- Production site is well-secured — find softer entry points.
- After `skill_view(name='wp-mass-recon')` — enumerate subdomains for each WordPress target.
- Building a complete asset inventory for a target organization.

## Prerequisites

- `curl`, `httpx`, `dig`, `jq`, `dnsx`, and `subfinder`.

# Subdomain Takeover Detection

Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.

## When to Use

- Subdomain enumeration produces a large list — scan for lingering DNS records.
- Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
- A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
- The CNAME target is a service with user-registrable names.

## Prerequisites

- `terminal` with curl, dnsx, subfinder.

# TLS Fingerprint Impersonation

Spoof TLS ClientHello parameters — cipher suites, key exchange groups, signature algorithms, and extension order — to match real browsers at the JA3/JA4 fingerprint level. Uses patched rustls to rebuild the TLS layer with browser-identical configurations. Bypasses TLS fingerprinting detection (Cloudflare, Akamai, F5) that flags non-browser TLS stacks. Supports 20 browser profiles including Chrome 100-142, Firefox 128-144, Safari iOS 18, and OkHttp 3-5 (Android).

## When to Use

- Target returns 403/blocked on curl/httpx even with correct User-Agent headers.
- Cloudflare or Akamai is fingerprinting TLS ClientHello (JA3/JA4 mismatch with browser).
- API probing requires mobile-app impersonation (OkHttp fingerprint for Android).
- Need high-throughput HTTP requests that pass TLS fingerprint checks without running a full browser.
- Target shows different behavior based on TLS fingerprint (mobile vs desktop endpoints).

## Prerequisites

# Unauthenticated API Flow Hijack

Exploit API endpoints that implement a full business workflow (interview, application, checkout, onboarding) without requiring authentication at any step. Unlike simple data exposure, these flows allow an attacker to participate in — and manipulate — the application's core business logic: submitting forms, uploading files, completing transactions, and exporting data. The entire state machine is accessible without credentials.

## When to Use

- An API serves a multi-step workflow (start → step1 → step2 → ... → complete).
- No authentication token, session cookie, or API key is required at any step.
- The API returns session identifiers (UUIDs, tokens) that can be reused across steps.
- The workflow includes file upload, data submission, or export functionality.
- Error messages reveal the expected request format (validating that endpoints are live).

## Prerequisites

# Virtual Host Enumeration

Discover hidden virtual hosts on IP addresses by fuzzing the `Host` header. Many servers only respond to specific domain names and remain invisible to standard subdomain enumeration. VHOST fuzzing exposes internal services, development environments, and admin panels that share the same IP but answer to different hostnames.

## When to Use

- You have a list of target IPs from `skill_view(name='origin-ip-discovery')` or `skill_view(name='port-service-discovery')`.
- A server returns default/blank pages for unknown Host headers.
- Subdomain enumeration may have missed internal-only hostnames.
- SSL certificates on an IP list multiple domain names in the SAN field.
- You need to map internal services behind a reverse proxy.

## Prerequisites

# Visual Recon

Automatically screenshot every live host to triage hundreds of subdomains visually instead of manually opening each one. Combined with technology fingerprinting, this reveals technology stacks, default CMS install pages, admin panels, and misconfigured services at a glance. Process 500+ hosts in minutes and identify high-value targets by visual inspection.

## When to Use

- You have 100+ live subdomains and need to prioritize targets quickly.
- Manual browsing is too slow for bulk reconnaissance.
- Need to identify default install pages (WordPress setup, phpMyAdmin login, Jenkins dashboard).
- Want to compare visual fingerprints across subdomains (shared infrastructure).
- Target serves different content based on User-Agent or geolocation.

## Prerequisites

# Web Enumeration -- Sensitive Files, Path Traversal, vHost, Log Mining

## When to Use

- **ALWAYS** on every target -- first thing after port scan
- Success rate is high on neglected infrastructure
- One finding (.env, .git) often leads to full credential access

## Sensitive File Scanning (200+ Paths)

```python
import requests

base = "https://target.com"

# WordPress Plugin Hunt Skill

Discover installed WordPress plugins through REST API namespace probing, readme.txt version detection, and HTML/JS source analysis. Cross-reference discovered versions against known CVEs for exploitation. WordPress plugin vulnerabilities are one of the most reliable paths to RCE — confirmed CVEs include Elementor, Slider Revolution, ElementsKit, Gravity Forms, Jetpack, WooCommerce, and LiteSpeed Cache.

## When to Use

- WordPress confirmed on target (via `wp-mass-recon`).
- Running `deep-invade` Phase 3.
- You need an exploitation vector beyond CORS/XMLRPC.
- Target has a plugin-heavy WordPress site (e-commerce, page builder, forms).

## Prerequisites

- `terminal` with curl, python3.

# WP Mass Recon Skill

Batch WordPress vulnerability detection pipeline for scanning dozens to hundreds of domains in parallel. Detects WordPress presence, REST API user enumeration, CORS credential reflection, XMLRPC exposure, open registration, and sensitive file leaks in a single pass. Proven on 600+ US company domains across 28 sectors.

## When to Use

- You have an authorized target list from a bug bounty program, pentest engagement, or red team with signed RoE.
- Sector-wide recon within authorized scope.
- After `subfinder`/`crt.sh` produces a target list and you need to triage.
- You want maximum findings per minute with a parallelizable pipeline.

## Prerequisites

- `curl`, `httpx`, `python3`, and `jq`.

# WordPress Plugin REST API — Auth Bypass

WordPress plugins register custom REST API routes at `/wp-json/{namespace}/`. Many plugin developers forget to add permission callbacks, leaving state-changing endpoints (POST/PUT/PATCH/DELETE) accessible to unauthenticated users. This skill enumerates all plugin routes, identifies write endpoints missing auth, and exploits them for content publishing, settings modification, and data leakage.

## When to Use

- Target is a WordPress site with exposed users via `/wp-json/wp/v2/users`.
- You've found interesting plugin namespaces from `/wp-json/` but need to map their routes.
- Standard WordPress endpoints return 401 — but third-party plugin endpoints might not.
- You want to find hidden admin URLs, debug endpoints, or unauthenticated write operations.

## Prerequisites

- `python3` with `requests` library.

# XMLRPC Exploitation Skill

5-phase exploitation pipeline for WordPress XMLRPC endpoints. Covers bulk detection, method enumeration, SSRF via `pingback.ping`, amplified brute force via `system.multicall` (1000x amplification), and RCE via `wp.uploadFile` when open registration is present. XMLRPC is open on ~52% of WordPress targets found via wp-mass-recon.

## When to Use

- `wp-mass-recon` detected XMLRPC returning HTTP 200 on POST.
- Target has WordPress with open registration (chain: upload → webshell → RCE).
- Need a brute-force amplification vector for WordPress credentials.
- Probing for internal SSRF via `pingback.ping` to cloud metadata endpoints.

## Prerequisites

- `terminal` with curl.

# Zimbra Attack Skill

Zimbra Collaboration Suite attack surface — SOAP API user enumeration without authentication, version fingerprinting, UploadServlet path traversal (CVE-2022-37042), `/service/proxy` internal SSRF, and Admin console access. Confirmed on IGN Argentina (Zimbra 8.8.11, admin user confirmed, UploadServlet active), gov-finance-portal (Zimbra webmail, SOAP auth functional), and ITERJ (Zimbra webmail active).

## When to Use

- Target has `webmail.`, `mail.`, or `zimbra.` subdomains.
- Redirect to `/zimbra/` path on mail server.
- Server header or page title contains "Zimbra".
- After `subdomain-enumeration` discovers webmail hosts.
- Government, university, or enterprise targets (Zimbra is common in these sectors).

## Prerequisites

## When to use this skill

Trigger when:
- Recon surfaces 1+ mobile apps under the target's developer name (Play Store dev page)
- A web app hosts `*.apk` files directly (e.g. `Recruitz.apk` found on a subdomain during one engagement)
- APK package IDs leaked via stealer logs (e.g. `com.<brand>.app`, `com.<brand>.<sub-brand>` patterns in stealer dump format)
- Customer-facing app, dealer/partner portal, or employee mobile companion app is in scope
- Bug bounty program lists Android in scope

DO NOT use for:
- iOS-only targets (different pipeline — IPA reverse, MobSF, frida-ios-dump)
- React Native / Flutter web apps already covered by JS bundle analysis
- Server-side only assessments

# Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

## THE ONLY QUESTION THAT MATTERS

> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"**
>
> If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**

### Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason |
|---|---|

# Bug Bounty Methodology: Workflow + Mindset

Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest.

---

## PART 0: MODE CONFIRMATION (Before Anything Else)

**Confirm the engagement type before deciding what counts as a finding.** The same target produces a different report shape depending on which mode applies. Getting this wrong is the single biggest waste of time in this workflow — answer it explicitly before Phase 0.

| Engagement type | What counts as a finding | What gets rejected |
|---|---|---|
| **Bug bounty** (H1 / Bugcrowd / Intigriti / private VDP) | Impact-demonstrated bugs ONLY. Full chain to attacker-attainable harm. | Hygiene (EoL software alone, permissive CSP alone, stack traces, info disclosure without concrete impact, "best practice" violations) |
| **Red team** (external client engagement) | Hygiene findings + recon + IoCs + defensive-state observations are ALL deliverables | Nothing — even "no finding here" is reportable as a positive defensive observation |

# Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

## THE ONLY QUESTION THAT MATTERS

> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"**
>
> If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**

### Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason |
|---|---|

# BUGCROWD REPORTING — Program-Specific Tactics

> Companion to the generic `report-writing` skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.

This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the `report-writing` skill. For the 7-Question Gate before deciding to report at all, use `triage-validation`.

---

## 1. VRT Category Selection — Search & Fallback Strategy

Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node — pick wrong and the form auto-suggests a lower priority (often P4) when the actual impact is P3 or P2.

> Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., "No Rate Limiting on Form → Login" defaulting to P4) are the typical baseline at time of writing — always read the severity the *current* form actually auto-suggests for *this* program rather than assuming the value here.

# Cloud IAM Deep -- Cloud Functions, Storage, IAM Exploitation

## When to Use

- After finding Firebase API keys, Supabase keys, or GCP SA keys
- When a target uses serverless (Cloud Functions, Cloud Run)
- After finding S3 bucket names or MinIO instances
- One SA key can escalate to full cloud access

## Cloud Functions URL Patterns (GCP)

```
https://{REGION}-{PROJECT_ID}.cloudfunctions.net/{FUNCTION_NAME}
https://us-central1-{PROJECT_ID}.cloudfunctions.net/api/feed