hack

어떤 스킬인가요?

>-

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

# Blue-Team Execution

Use with `SKILL.md` role routing. Goal: shorten real-attacker dwell time, not zero the queue.

## Triage loop

```
Ingest alert / hunt clue
  → enrich (asset, account, intel, history, process/network context)
  → prioritize (business impact, not the product's severity string)
  → single event or chain
  → expand same user / host / IP / token inside the time window
  → conclude: TP / benign TP / FP / insufficient evidence (escalate)
  → reversible containment (if needed)
  → eradicate and recover
  → detection and logging improvements
  → retro
```

Do not treat the product's Critical as business Critical. Look at the asset and the data first.

## Minimum enrichment before a human stares at a raw alert

Missing these → send it back; do not put a person on the raw alert:

- Asset owner, business importance, production or not
- Account type (human / service / shared / abandoned)
- Same-entity similar events in ~24h
- Intel hit or not (and intel quality)
- Process tree, parent, network destination, login source
- Overlap with a change/release window

Titles like "Suspicious PowerShell" with no context go back to detection engineering, not into a case.

## Investigation expansion

Allowed and expected adjacent range:

- Same identity on IdP, mail, VPN, cloud console, code platform
- Same host: process, file, registry/config, network
- Same egress IP / API token / session
- 30–90 minute core window; lengthen if the dwell hypothesis requires it
- Adjacent systems with no logs: record as a coverage gap; do not pretend they are invisible

Write the query so someone else can reproduce the same conclusion.

For host memory and packet evidence, load [memory-forensics-volatility](../memory-forensics-volatility/SKILL.md) and [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md).

## How to label conclusions

| Label | Meaning | Action |
|---|---|---|
| True positive TP | Malicious or clear policy violation, evidenced | Contain + eradicate + improve detection |
| Benign true positive | Rule fired correctly on admin script / release | Add suppression or shrink scope; do not kill the rule in anger |
| False positive FP | Rule semantics are wrong | Fix the rule, record the FP profile |
| Insufficient evidence | Cannot confirm or deny yet | Escalate or keep collecting; write which logs are missing |
| Duplicate | Already handled in another case | Merge; not a new win |

Do not close because "it looks like an admin". Admins get stolen too.

## Containment

Priority from reversible to irreversible:

1. Isolate a NIC / revoke one session / disable one key
2. Block one hash / one egress / one rule
3. Disable one account
4. Segment a network, bulk block
5. Rebuild, mass password reset, image wipe

Step 4 and above require: approver, blast radius, forensic snapshot, rollback path.

Clearing logs, formatting, or overwriting key files is not containment. It is destroying evidence.

Preserve first:

- Volatile evidence (memory, sessions, login state)
- Host and identity timeline
- Original alerts and queries
- Malware object hashes and chain of custody

## Detection-engineering lifecycle

```
Threat hypothesis → ATT&CK map → confirm telemetry exists
  → write the rule (strict first) → known-good / known-bad tests
  → retro 7–30 days for FP → owner and retirement condition
  → production → measure → tune / merge / retire
```

Rules are code: in Git, reviewed, rollbackable. Do not hand-edit production SIEM rules with no history.

Quality gate (fail → do not ship):

- Maps to a concrete ATT&CK technique, not a product feature name
- At least one expected TP fixture
- FP profile exists
- Log-source health dependency (source down should alert, not go silent)
- Has an owner

Broad rules only when a strict rule cannot cover and suppression conditions exist.

Six months with no fire: check log source, field changes, time parsing, permissions first — then maybe assume the environment is clean.

Rule template: [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md) § Detection-rule template.

## Hunting

Hunting is not browsing a SIEM. One hunt needs:

- Hypothesis (if X exists, we should see Y)
- Data source and time window
- Query
- How hits split
- Covered / not covered, whether or not a human was hit

Paths from red team or external reports become hunt hypotheses first, then rules.

## Incident response (document-driven)

Follow an approved playbook. Do not invent phase names. Common skeleton:

1. Prepare (contacts, privileges, evidence location)
2. Identify (what it is, who it affects)
3. Contain (reversible first)
4. Eradicate
5. Recover
6. Lessons (detection gap, process gap, owner, how to verify)

Every step gets a timeline with timezones.

A retro that did not change detection or process did not happen.

## New log source / middleware / SaaS

Before rules ship, deliver:

- Field dictionary
- Which ATT&CK techniques become detectable
- Known FPs
- Owner
- Retention
- Retirement condition
- Source health check

No field dictionary → no bulk rules on the new source.

## Metrics

Watch these, not close-rate:

- FP rate and rules analysts ignore
- Priority ATT&CK coverage (tested detections / priority techniques)
- Data-source coverage
- MTTD / MTTR against attacker tempo, not internal SLA cosmetics
- Whether containment was reversible and whether it destroyed evidence
- Retro action-item close rate

## Purple-team loop

- Red-team results must be rewritten as detection gaps
- Blue hunt hypotheses must be rewritten as rules or log requirements
- Controlled exercises prove the rule actually fires — "the logic looks like it would" is not proof

# Code Audit

Use with `SKILL.md` §3 R6. The core is taint paths and missing controls, not a report of dangerous function names.

## Phases (parallelizable; do not skip the mental model)

0. **Map**: language, framework, build, module boundaries, real entry points, where authn/authz actually land.
1. **Mental model**: trust boundaries, data-to-storage paths, permission checkpoints, developer security assumptions, first-party vs dependency. If these are unclear, do not daydream across the whole repo.
2. **Historical variants**: read fix commits of similar CVEs, extract the pattern, search the repo; check whether the fix blocked only one entry.
3. **Sink reverse**: list dangerous operations, walk parameters upward, mark filters, evaluate bypass.
4. **Framework specialty**: audit framework features this repo actually uses (mass assignment, expressions, annotation authz, ORM dynamic concat, template engines). Do not scan a language encyclopedia.
5. **Deep**: unlocked read-check-write, payment and state machines, hardcoded keys, dependency defects, reverted security fixes.
6. **Verify**: every finding must answer: is input controllable, can the filter be bypassed, preconditions, impact, can it be proven non-destructively. If not, label hypothesis.

Large repos: sink-driven first. Few entries and many dangerous points: also sink-driven. Object-level IDOR: missing-control-driven first.

After the path is real, load the matching deep topic skill for the sink class (SQLi, SSTI, deserialization, SSRF, and so on).

## Dual track plus missing controls

### A. Sink → Source (usual for humans)

1. List sinks by class
2. See whether parameters are concatenated, deserialized, or built into command/path/URL/template
3. Walk callers upward until an entry or an uncontrollable constant
4. On a sanitizer: prove it works for *this* payload class, or keep walking
5. No controllable source → drop the item

### B. Source → Sink

1. Take user-controllable fields from the entry
2. Follow assignment, wrapping, serialization, cross-service calls
3. See which sink it lands in
4. Across services, mark message contracts, gateway headers, and internal RPC as propagation edges

### C. Missing controls (bugs grep will not find)

Not a "dangerous function" — a check that should exist and does not:

- Horizontal/vertical IDOR
- Unauthenticated admin / debug / internal endpoints exposed
- Batch endpoints that validate only the first ID
- Hidden in the UI, unchecked on the server
- Workflow state client-controlled

Build an object × action matrix (read, change, delete, approve, export). For each cell, does the server enforce "current subject + object ownership"?

## Sink index (index only, not an exploit manual)

| Class | Look for |
|---|---|
| Command exec | User-controllable args, whether a shell is involved |
| SQL / query concat | Real parameterization; ORM dynamic concat, sort field, table name |
| Deserialization | Type allow-list, source, filter bypass |
| File I/O | Root constraint, symlinks, archive paths |
| SSRF | Protocol, redirects, intranet, cloud metadata |
| Template render | User content entering the engine |
| Path / expression injection | SpEL, OGNL, EL, JSTL |
| Authz decision points | Which role/tenant a negative condition missed |
| Crypto and keys | Key source, hardcoded, home-rolled crypto |

Framework fit matters. If the tool or model does not know this framework's sources/sinks, whole classes go missing. For a homegrown framework, hand-add entries and dangerous wrappers first, then trace.

## When a sanitizer counts

All of the following must hold:

- It sits on every Source→Sink path; no bypass
- Semantics match this bug class (HTML escape does not save SQL)
- Not undone by double-decode, split-and-rejoin, or encoding tricks
- Failure is deny, not "best-effort clean and continue"

If it only works for some inputs, write the bypass condition. "There is a filter" is not "fixed".

## Anti-hallucination

Every file path, symbol, and line number in the report must have been read. If not, do not write it.

Forbidden:

- Inventing a "theoretically reachable" call chain
- Treating a dangerous function in a dependency as called by the product
- Filing test code, dead code, or intranet-only CLI as externally hittable
- Critical RCE with no reproduction path

Prefer a miss over a fake chain for count.

## When source is incomplete

Common on red-team partial leaks:

- Identify the framework, then scan sinks
- Decompiled jar/war still walks sink → source
- Missing dependency → label "assuming caller is / is not controllable"; do not pretend completeness
- Config, routes, and hidden endpoints in leaked code beat deep algorithm bugs

## Deliverable

Each code finding at minimum:

- Source location
- Sink location
- Propagation summary (file / function / key variables)
- Sanitizer present or not, and why it fails
- How an external request hits this path
- Impact (what can be read, executed, or IDOR'd)
- Fix (parameterize, allow-list, server-side authz, retire the endpoint)

Missing-control bugs use an authz matrix instead of a taint graph.

Finding template: [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md).

# Evidence and Report Standard

Shared by red and blue. Read this before writing a conclusion.

## Minimum evidence block

Any "confirmed" vulnerability, intrusion, or risk must be reproducible by someone who was not in the room.

```
Title
Location (URL / host / repo path / rule name / event ID)
Time (with timezone)
Preconditions
Step-by-step repro or step-by-step query
Observed result (redacted response, command output, or raw event)
Impact (what control was obtained / what harm was done)
Non-destructive proof (what was done, what was not)
Residual risk
Fix or detection recommendation
Evidence attachment names
```

Missing repro or query → "hypothesis" or "insufficient evidence" only.

Working directory: `assets/` for inventories and script excerpts, `evidence/` for requests and diffs, `reports/` for confirmed items only. Process notes are not official findings.

## Readability

- Screenshots include address bar, key parameters, time, result; red box plus one sentence when needed
- Requests and responses strip cookies, tokens, ID numbers, full secrets
- Command output keeps the few lines that prove privilege — not a full junk screen
- Queries are complete and copyable; filters, index, and time window are explicit
- Timezones are consistent; cross-zone systems note the conversion on the timeline

## How to write secrets

| May write | Must not write |
|---|---|
| Secret type, last four, fingerprint | Full secret, full cookie |
| Permission scope, whether liveness was verified | A connection string that can log in directly |
| File path and commit | Unredacted ID numbers, phones, mail bodies |

Full secrets go only in the authorizing party's agreed vault, with expiry.

## Red-team report structure

1. Decision summary: deepest impact layer reached, what to fix now
2. Attack-chain narrative (by time, not by CVE number)
3. Confirmed findings (finding template below)
4. Uncovered and time-box limits
5. Detection gaps (for blue)
6. Appendix: raw scanner output, compliance items

Do not put a Nessus/Nuclei export in the body.

## Blue-team case structure

1. One-sentence conclusion
2. Impact scope (users, hosts, data, business)
3. Timeline
4. Queries and raw event excerpts
5. Containment done and how to roll it back
6. Eradication / recovery
7. Detection and logging improvements
8. Open questions

## Severity (impact first)

Use the impact ladder; CVSS is a cross-check only:

- Critical: production high privilege or bulk sensitive data already held or immediately reachable, or an intrusion in progress
- High: auth bypass, object-level IDOR to core data, live cloud key, stable path to a host
- Medium: extra conditions needed but the path is real
- Low: isolated config issue
- Info: a clue that helps later testing; not harm by itself

Unexploitable theory is not High. High requires the exploit conditions in writing.

## Immediate notify

Do not wait for close-out when:

- Production data can be read or changed without authorization
- Live cloud key / domain-admin equivalent
- Signs of an intrusion in progress
- Testing accidentally affected the business (lockout, outage)

Notify: time, asset, confirmed impact, suggested immediate action, what we stopped.

## Two write-to-disk gates

### Session-attribution gate

Before writing "anonymous" or "unauthorized with no identity", ask: did the breaking request carry a session?

- Session present → IDOR or auth issue: "used the current session to reach someone else's object"
- Still works with credentials stripped → then write unauthenticated
- Tested with a session, then stripped the cookie in the report to label anonymous = forbidden

### Secret liveness gate

Copying a string is not a finding. Private keys, access keys, connection strings, JWTs, sessions usable as someone else, must satisfy both:

1. Fake rejected, real accepted by production
2. One non-impacting read-only call returns identity or an object list

Fail the gate → clue only. Placeholders, expired values, fake and real getting the same error, frontend salts used to encrypt a phone number — not results.

## Do not file as results

A half-chain; weak password that never issued a session; connection string with host and no creds; secret that failed the liveness gate; self-only CSRF; missing security headers; expired cert with no exploit path; HTTP 200 JSON; same-role-readable or public ops data; unauthenticated SMS send with no account takeover or password change. If unsure, do not file.

Medium, high, and critical: write to disk as soon as confirmed. Do not batch until the end. Same type on the same URL in the same task: do not file twice.

## Voice

- Say what was achieved, not brochure tone, not an "attacker" performance
- Impact is the real privilege surface this door opens, not how many shots this test fired
- Do not invent destructive actions that were not performed; a can-change / can-delete surface may be described, marked as not executed
- Repro steps keep only the requests needed to break; comparisons and copied parameters sit in the step that uses them — no empty extra steps

---

## Finding template

Copy and fill. Delete inapplicable rows; do not leave filler.

~~~~md
## [ID] Title (impact in one sentence)

- Severity: critical / high / medium / low / info
- Status: confirmed / hypothesis / insufficient evidence
- Impact-ladder position: cloud/domain-admin equivalent | host or service privilege | service-account abuse | auth bypass or IDOR | chainable misconfig | isolated medium | compliance
- Asset:
- Environment: prod / staging / test / unknown
- Found at (timezone):
- Found how: red-team test / code audit / source leak / blue triage / hunt
- Did the break carry a session: yes / no (session present → do not write "anonymous unauthorized")
- Title register: anonymous unauthenticated (no session, reached someone else) / IDOR (session, someone else's object) / auth takeover / other
- Secret liveness gate: n/a / not passed (clue) / passed (fake-vs-real + identity or list)
- Matrix ticks: unauth / IDOR / injection / SSRF / exec / logic / upload chain / other; no entry → N/A + reason

### Problem
(Three to six sentences. What the attacker can do now, whom it harms.)

### Location
- URL / host / account / resource ID:
- Code: `path:line` symbol
- Config: effective file path
- Related commit / image / pipeline:

### Preconditions
- Account required:
- Role:
- Network position:
- Other:

### Repro or query
1.
2.
3.

### Diff
- Baseline:
- After probe:
- Subject or fields that changed:

### Observation
```
(redacted response, command output, or raw event)
```

### Taint or control path (code audit)
- Source:
- Propagation:
- Sink:
- Sanitizer: none / present but failed (why) / effective (if effective, do not file as confirmed)
- Authz-matrix gap:

### Source-leak clues (if applicable)
- Leak shape:
- History mined:
- Secret type and fingerprint:
- Read-only verified:
- Next-hop assets:

### Impact
- Control proven:
- Possible but unverified (hypothesis):
- Data or systems involved:

### Non-destructive statement
- Did:
- Did not:

### Remediation
1. Immediate:
2. Root:
3. How to verify the fix:

### Detection (for blue)
- Telemetry that should have been visible:
- Suggested rule hypothesis:
- Why existing rules missed it:

### Attachments
- Screenshot / request / query-export filenames:
~~~~

---

## Detection-rule template

Fill completely before production. Fail the quality gate → do not deploy.

```md
## Rule name

- Status: draft / test / prod / retired
- Owner:
- Created:
- Last tuned:
- ATT&CK: Txxxx (sub-technique too)
- Severity: by business impact, not the product default
- Mode: strict / broad (broad needs a reason)

### Hypothesis
If the attacker does ________, we should see ________ in ________.

### Data source
- Product and index:
- Key fields:
- Field-dictionary link:
- Source health check:
- Retention:

### Logic
(Pseudocode or Sigma-style. Intent, not an unportable private GUI screenshot as the only truth.)

### Known TP fixture
- Source: red team / hunt / historical case / controlled exercise
- How to fire:
- Last hit:

### FP profile
- Expected benign fires:
- Suppression:
- Retro window and result (7–30 days):
- FP rate:

### Investigation hints
1. Look first at:
2. Then expand to:
3. When to label benign TP:
4. When to contain immediately:

### Containment suggestions
- Reversible actions:
- Actions that need approval:

### Retirement
- When to merge, shrink, or take offline:
- On six-month silence, check what first:

### Coverage gap
- What this rule explicitly cannot catch:
- Logs needed but not yet ingested:
```

---

## Pattern-card template

Only for techniques recognizable on another system of the same shape. Site-specific paths, campaign IDs, and dead endpoints are not cards. Medium findings go in the report, not on a card.

```md
## Recognize
(Framework / parameter shape / business surface. Not a vendor, product, or path.)

## Where to hit
(A method, not the only entry. Say whether a session is required.)

## What counts as success
(Must answer: whose what appeared beyond baseline. HTTP 200 alone is forbidden.)

## False points
(When this shape is not a bug. This run not breaking through does not retire the technique.)

## Do not stop at
(Common half-chain endpoints, and where the chain must go)
```

# Red-Team Execution

Use with `SKILL.md` §§2–3. How to pick targets, expand scope, and close out. Exploit recipes live in deep topic skills.

## Before kickoff

- Written authorization, RoE, in/out-of-scope lists, banned techniques, data handling, emergency contact, stop conditions
- Confirm IPs / domains actually belong to the authorizing party — do not trust a spoken CIDR alone
- Create the evidence directory and a change log (scope expansion, high-severity finds, pauses)
- Agree the immediate-notify threshold for high-severity finds

No authorization letter or equivalent approval → stop.

## Impact ladder

Report and daily triage use this ladder, not scanner scores:

1. Cloud / domain-admin equivalent
2. Host shell or high-privilege service
3. Abuseable service account / role
4. Auth bypass, object-level IDOR, secret read
5. Chainable misconfiguration
6. Isolated medium
7. Pure compliance (security headers, banner, CVE with no path)

Layer 7 may go in an appendix. It is not a primary result.

## Engagement loop

See field features first, then open the matching check class (`SKILL.md` §3 and `TEST_MATRIX.md`). Opening one class is not firing only that shot. Unlisted field surfaces still get tested.

```
Authorization and scope → passive recon → attack-surface inventory → priority path
    → minimal proof → follow clues / request expansion
    → freeze evidence → notify high-severity immediately → attack-chain narrative
    → clean test artifacts (non-destructive) → hand detection gaps to blue
```

Recon answers what the system already exposes. Do not open with exploitation.

## Per-site loop

Do not empty-scan a site.

1. **Portrait** (3–5 sentences): who uses it, core objects, where money/power/state live, what an unauthenticated caller can touch.
2. **Inventory**: capture real requests. Scripts record more than paths: signing salts, ciphertext identifiers, hidden routes, hardcoded demo accounts. Write "none" if absent. If scripts fail to download, use captured traffic and inline page content — do not idle.
3. **Find the business surface**: if the open page is login, follow redirect params, `baseURL`, 302, and same-brand `api` / `admin` / `gateway` to the business host or local gateway. Dig unauthenticated against business APIs, not login HTML. Do not audit someone else's SSO page; follow it back to this product's business surface.
4. **Classify the response**: a full sentence "please log in" with no business fields → N/A the injection class. `list` / `total` / business fields (even `total=0`) → differential surface. Errors, timeouts, and length diffs are also differential surfaces. An empty list is not "please log in".
5. **Same-family login codes**: unauthenticated exceptions already probed, remaining business endpoints all return the same login code → stop injection. If the inventory still has issue-session / reset / rebind / ticket-swap, finish those auth endpoints before marking this round done.
6. **With a session, walk the object graph immediately**: list → detail → attachment / export / approval; swap identifiers at each layer. Do not keep throwing quotes at business endpoints after you are in.
7. **Minimum to change sites**: portrait exists, inventory exists, matrix ticked or N/A+reason per entry, confirmed medium on an object either chained up or falsified. A thin shell can be falsified at a glance — do not pad time with the full matrix.

Username/password boxes are not injection surfaces. Extra tenant/module fields on the login API are.

## Scope-expansion protocol

Clues you may follow (still same authorized org, not banned by RoE):

- Adjacent subdomains, historical DNS, staging/preview, docs sites, monitoring and debug entry points
- Forgotten admin ports, object storage, CI artifacts, container registries
- Source leaks, secret leaks, employee public repos
- Auth, SSO, VPN, bastion shared with the target

Actions:

1. Record asset, how found, time
2. Confirm ownership (whose cert, whose page, whose org account)
3. Write the expansion reason
4. Shallow probe first (alive, fingerprint, is there an entry); request depth only if valuable
5. No exploit, no password spray, no intrusive scan before approval

Missing boundary assets is negligence. Expanding without a record is a violation.

Do not fill progress with a new search while live surfaces on the current cluster are unfinished. Identifiers, download URLs, and internal hosts in responses go onto this site's queue. A login page is a shell — find the post-login business host first.

## Non-destructive proof whitelist

Prefer these to prove impact:

- Identity: current user, roles, permission list
- Read-only enumerate: object list, bucket list, repo list, mail metadata
- Config read: can you see the secret-management page, pipeline variable names
- Request-level: an unauthorized endpoint returned an object it should not
- File-level: path plus a redacted fragment of a sensitive file

When a write is required:

- Identifiable test object (clear prefix)
- Single row, deletable, notified in advance
- Record the rollback method immediately
- IDOR write proof: create your own test object, delete it after; do not alter other people's business rows
- Do not log out a user-provided session

## Password and auth testing

- Read lockout, MFA, CAPTCHA, rate limit first
- Unknown threshold → do not spray
- Default passwords, test accounts, and example passwords in docs beat blind spraying
- Login-form weak passwords are not mandatory; middleware default creds and hardcoded demo accounts are keys
- On lockout: stop and notify; do not "try a few more"

## Middleware audit (document-driven)

Build a live checklist before touching anything. Every row needs a result and evidence.

| Field | Write |
|---|---|
| Component and exact version | Not just "Nginx" |
| Official docs / baseline link | The version you compared against |
| Effective config path | Main + includes + env vars |
| Exposure | Port, protocol, admin plane, extra protocols (e.g. AJP) |
| Auth mode | Anonymous / password / mTLS / ACL / cloud IAM |
| Default creds and debug entry | Still on? Who can reach it? |
| Plugins / modules / extensions | Extra surface |
| TLS and listener split | Internal and external listeners mixed? |
| Known version defects | Only those for this version and verifiable |
| Logs and audit | Logs shipped off-box? Can local root unilaterally delete evidence? |
| Deviation from official recommendation | One deviation per row |

Minimum:

- Admin plane not naked on the internet
- Auth before network-trust
- Transport encryption; backup keys separated from data
- Audit logs leave the host

The process record is itself a deliverable. Do not invent checklist items or sinks from memory.

Then load [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for service/port technique detail.

## Close-out

- Recover test accounts, test objects, temporary privileges
- High-severity finds already synced immediately
- The report is an attack chain; the appendix is the inventory
- Paths the red team used that blue did not see → detection gaps for blue
- State clearly: this is a time-box snapshot, and what was not covered

---
name: hack
description: >-
  Entry P0 primary router and operating doctrine for HackSkills. Use when the
  task involves web application testing, API security assessment, recon,
  vulnerability triage, exploit path planning, authorized pentest, code audit,
  source-leak mining, middleware audit, SOC triage, detection engineering,
  incident response, or choosing the right next category skill before any deep
  topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计,
  源码泄露, SRC. Enforce impact-first testing, finish the current asset cluster
  before expanding, follow half-chains to real control, and require live
  verification of secrets.
---

# HACKING SKILLS / HackSkills

## Overview

This is the **master quality gate and technical router** for authorized bug bounty, web/API security, pentest, code audit, source-leak work, and (when the task is blue) SOC / detection / IR.

It does not replace specialized techniques. It makes the agent:

1. Pass the start gate (authorization, role, scope, success definition)
2. Spend effort on paths that reach real control
3. Route by observed behavior to the correct category / deep topic skill
4. Prefer structured methodology over baseline-model memory and scanner dumps

This file is a quality gate, not a capability ceiling. Surfaces not listed here stay in play if field evidence exists.

This file is not an exploit cookbook. Weaponized details live in deep topic skills and are used only on authorized targets.

Load on demand:

- Red-team execution → [RED_TEAM.md](./RED_TEAM.md)
- Test matrix and effort → [TEST_MATRIX.md](./TEST_MATRIX.md)
- Blue-team execution → [BLUE_TEAM.md](./BLUE_TEAM.md)
- Code audit → [CODE_AUDIT.md](./CODE_AUDIT.md)
- Source leak → [SOURCE_LEAK.md](./SOURCE_LEAK.md)
- Evidence and report → [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md)

## 0. Task Start Gate

Complete in order. Stop if any item is missing:

1. **Authorization**: written auth, RoE, scope, prohibitions, contact, emergency stop. No authorization → refuse.
2. **Role**: red-team test / code audit / source leak / middleware audit / blue triage / detection engineering / IR. Parallel work is allowed; there is only one primary role.
3. **Scope mode**:
   - User gave a fixed URL / system / repo → **locked scope**: follow same-product hosts, gateways, API domains, and same-host extra paths that the business flow naturally exposes. Do not scan unrelated brand lines.
   - User gave an org name and asked to find boundary assets → **exploratory scope**: finish the current asset cluster before opening the next. Do not search many seeds shallowly.
4. **Success definition**: what "done" means for this task. Scanner-finished, report-emitted, and ticket-closed are not success.
5. **Destruction boundary**: list actions that must never happen.
6. **Working directory** before any test: `assets/` (URLs, API inventory, script excerpts), `evidence/` (requests, diffs, screenshots), `reports/` (confirmed findings only).
7. **Questions**: if scope is unclear, ask only the 1–3 technical blockers (target, stack, whether an account exists). Do not use "should I continue" as a way to stop. Missing a second account → degrade to what is testable; do not idle waiting for account B.

Do not expand onto unauthorized assets.

## 1. Hard Constraints

- Stay in scope. Out-of-scope clues: record, then request expansion. No silent expansion.
- No destructive testing or destructive containment: delete other people's business data, DROP/TRUNCATE, bulk config change, encrypt/ransom-like actions, unbounded DoS, wipe logs, wipe images.
- Write-ops that prove access: create only identifiable test objects, delete that one object immediately. Do not change other people's orders, addresses, passwords, roles, or bindings. No charge, stock wipe, or account lock.
- Do not log out, revoke, or deactivate a session the user provided. If password/binding change is required to prove impact, revert immediately; if revert fails, stop at the response — do not brick the account.
- Do not cause irreversible damage to prove a break. Prefer read-only, copy, or low-privilege proof.
- Evidence must be readable and reproducible. A conclusion without repro steps is a hypothesis.
- Do not fabricate PoCs, logs, or exploit chains. If path, file, query, and screenshot do not line up, downgrade or withdraw.
- Copied secrets are clues until they pass the **liveness gate**: production accepts the real value (rejects a fake), and one read-only call returns identity or an object list.
- A finding reached with a session is not "anonymous unauthorized". Anonymous only if the break had no login state.
- For internal users, assume false positive or mistake until the timeline proves otherwise.
- If a security control blocks real work, it will be bypassed. Remediation must include a usable safe path.

## 2. Role Routing

| User intent | Primary flow | Load |
|---|---|---|
| Pentest / red team / foothold / SRC | §§3–5 | [RED_TEAM.md](./RED_TEAM.md), [TEST_MATRIX.md](./TEST_MATRIX.md) |
| Code audit / whitebox / find sinks | §3 R6 | [CODE_AUDIT.md](./CODE_AUDIT.md) |
| Source leak / Git leak / secret leak | §3 R5 | [SOURCE_LEAK.md](./SOURCE_LEAK.md), [insecure-source-code-management](../insecure-source-code-management/SKILL.md) |
| Middleware / gateway / component audit | §3 R7 | [RED_TEAM.md](./RED_TEAM.md) middleware section, [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) |
| Alert triage / SOC / hunting | Blue quality gate | [BLUE_TEAM.md](./BLUE_TEAM.md) |
| Detection rules | Blue B6 | [BLUE_TEAM.md](./BLUE_TEAM.md), template in [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md) |
| IR / forensics / containment | Blue B7 | [BLUE_TEAM.md](./BLUE_TEAM.md), [memory-forensics-volatility](../memory-forensics-volatility/SKILL.md), [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) |
| Write the report | §6 | [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md) |

When a task crosses red and blue, freeze evidence for the current phase before switching role.

## 3. Operating Model

### Step 1: Draw the surface from the application

With a URL or an application in hand, map the surface first: [attack-surface-mapping](../attack-surface-mapping/SKILL.md). Portrait, business plane, JS/traffic inventory (keys not just paths), response classes, object graph. Do not scan into a blank portrait. Do not open with directory brute or payload spray.

### Step 2: Route by observed behavior

| Signal | First direction | Load |
|---|---|---|
| Input reflects into HTML / JS | XSS / SSTI | [injection-checking](../injection-checking/SKILL.md) |
| Server fetches a URL / hostname | SSRF | [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) |
| Accepts XML / Office / SVG | XXE | [xxe-xml-external-entity](../xxe-xml-external-entity/SKILL.md) |
| Path, filename, or download is controllable | Path Traversal / LFI | [path-traversal-lfi](../path-traversal-lfi/SKILL.md) |
| Many object IDs in APIs | IDOR / BOLA / BFLA | [auth-sec](../auth-sec/SKILL.md), [idor-broken-object-authorization](../idor-broken-object-authorization/SKILL.md) |
| Login, reset, 2FA, sessions | Auth bypass / JWT / OAuth | [auth-sec](../auth-sec/SKILL.md) |
| Multi-step money, coupons, inventory, approval | Business logic / race | [business-logic-vuln](../business-logic-vuln/SKILL.md) |
| MongoDB / JSON query syntax | NoSQL | [nosql-injection](../nosql-injection/SKILL.md) |
| CLI tools, image processing, importers | Command injection | [cmdi-command-injection](../cmdi-command-injection/SKILL.md) |
| HTTP parse / front-back framing mismatch | Request smuggling | [request-smuggling](../request-smuggling/SKILL.md) |
| Node JSON / controllable `__proto__` | Prototype pollution | [prototype-pollution](../prototype-pollution/SKILL.md) |
| PHP weak compare / `0e` hash | Type juggling | [type-juggling](../type-juggling/SKILL.md) |
| Repeated param names / WAF-app parse mismatch | HPP | [http-parameter-pollution](../http-parameter-pollution/SKILL.md) |
| One-time coupon / inventory / reset / invite | Race | [race-condition](../race-condition/SKILL.md) |
| XML/XSLT templates | XSLT | [xslt-injection](../xslt-injection/SKILL.md) |
| `.git` / `.svn` / `.env` / backups / public buckets | Source leak | [SOURCE_LEAK.md](./SOURCE_LEAK.md) |
| CSV/Excel export | CSV formula | [csv-formula-injection](../csv-formula-injection/SKILL.md) |
| WebSocket upgrade | WebSocket | [websocket-security](../websocket-security/SKILL.md) |
| Internal package names | Dependency confusion | [dependency-confusion](../dependency-confusion/SKILL.md) |
| Business API returns 401/403 | Path / method / header bypass | [401-403-bypass-techniques](../401-403-bypass-techniques/SKILL.md) |
| Public middleware admin / default ports | Default creds, debug, version defects | [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) |
| Chat assistant with command tools | Does the tool actually execute | [llm-prompt-injection](../llm-prompt-injection/SKILL.md) |
| File upload / preview / convert | Upload chain — do not stop at store+download | [upload-insecure-files](../upload-insecure-files/SKILL.md) |
| GraphQL / OAuth JWT / gateway | Matching specialty; tick done or write N/A | [api-sec](../api-sec/SKILL.md), [jwt-oauth-token-attacks](../jwt-oauth-token-attacks/SKILL.md) |

Opening one check class does not mean firing only that one shot. Walk the rest of the matrix.

### Step 3: Spend effort in this order

Full pass/fail rules: [TEST_MATRIX.md](./TEST_MATRIX.md). Default order:

1. Unauthenticated access to another user, tenant, or subject
2. Auth takeover (issue session, reset, rebind, swap ticket) — in-session or password change counts
3. Swap object identifiers (any field name: `id` / `userId` / `tenantId` / `fileKey` / `openid` / ciphertext PK)
4. With a session, walk the object graph: list → detail → attachment/export/approval, then writes and business logic
5. Injection / SSRF / XSS / command or template execution only on surfaces that show a **diff**
6. Salts, hardcoded keys, demo accounts in pages and scripts

**Do not stop on a half-chain.** Upload that stores, OTP that sends, or a copied secret string is not done. Confirmed medium on an object: follow it to write / cross-user / takeover / execution before changing targets.

A full "please log in" with no business fields is not an injection surface. Empty list, error, and timeout are not "please log in".

Finish the current asset cluster before expanding.

### R1. Impact, not compliance

Shortest path to influential control first. Each candidate: can the attacker harm a real user or system *now*? The report narrative is the attack chain; CVSS is an appendix. Tenant-admin "allowed in role" is still a finding if it reaches platform admin, other tenants, or other users. Rank findings with the impact ladder in [RED_TEAM.md](./RED_TEAM.md); layer 7 (pure compliance) is appendix-only.

### R5. Source leak: mine the clue to the end

Do not stop at "`.git` exposed" or "repo is public". [SOURCE_LEAK.md](./SOURCE_LEAK.md): full tree plus history → inventory secrets and hidden surface → live-verify still-valid secrets with minimal read-only calls → treat the leak as a new attack-surface list.

### R6. Code audit: sink→source, or source forward

[CODE_AUDIT.md](./CODE_AUDIT.md). No complete taint path, or sanitizer proven effective → do not file as confirmed.

### R7. Middleware audit is document-driven

Read official docs for the exact major version, build a checklist, leave a trace per item. A middleware conclusion with no comparison table is unfinished.

### Blue quality gate (when the primary role is blue)

Success is shorter dwell time, not close-rate. Details: [BLUE_TEAM.md](./BLUE_TEAM.md).

- **B1.** Ask first whether this loses data, privilege, or the business *now*. One high-confidence event plus a timeline beats a hundred context-free alerts.
- **B2.** Alert fatigue is the main risk. Enrich before a human; every rule has an owner, FP profile, retro window, and retirement condition. Six months silent → check the log source first.
- **B3.** Containment defaults to reversible. Preserve evidence, then contain, then eradicate. Wiping logs is not containment.
- **B4.** Conclusions need a reproducible query, timezone, asset/user/src IP, raw excerpt, and a label (TP / benign TP / FP / insufficient evidence).
- **B5.** Expand the same user, host, IP, token, hash inside the window. Intel, IOCs, and leak samples entering a case are handled at source-leak severity.
- **B6.** Detection engineering walks backward from the behavior that must be caught. Strict high-confidence rules first. Quality gate in [BLUE_TEAM.md](./BLUE_TEAM.md).
- **B7.** IR follows an approved playbook. New log sources get a field dictionary, coverage map, known FPs, owner, and retirement bar before rules ship.

## 4. Core Skill Map

If the full repository is present, prefer these together. Previously separate mini skills (payload-selection, brute-selection) were merged back into their main skills.

- [Attack Surface Mapping](../attack-surface-mapping/SKILL.md) · [Recon and Methodology](../recon-and-methodology/SKILL.md)
- [XSS](../xss-cross-site-scripting/SKILL.md) · [SQLi](../sqli-sql-injection/SKILL.md) · [SSRF](../ssrf-server-side-request-forgery/SKILL.md) · [XXE](../xxe-xml-external-entity/SKILL.md) · [SSTI](../ssti-server-side-template-injection/SKILL.md)
- [IDOR](../idor-broken-object-authorization/SKILL.md) · [CMDi](../cmdi-command-injection/SKILL.md) · [Path Traversal / LFI](../path-traversal-lfi/SKILL.md) · [CSRF](../csrf-cross-site-request-forgery/SKILL.md)
- [API Security Router](../api-sec/SKILL.md) · [JWT / OAuth](../jwt-oauth-token-attacks/SKILL.md) · [OAuth / OIDC](../oauth-oidc-misconfiguration/SKILL.md) · [SAML](../saml-sso-assertion-attacks/SKILL.md) · [Auth Bypass](../authbypass-authentication-flaws/SKILL.md)
- [Business Logic](../business-logic-vulnerabilities/SKILL.md) · [Upload](../upload-insecure-files/SKILL.md) · [NoSQL](../nosql-injection/SKILL.md) · [Request Smuggling](../request-smuggling/SKILL.md)
- [Prototype Pollution](../prototype-pollution/SKILL.md) · [Type Juggling](../type-juggling/SKILL.md) · [HPP](../http-parameter-pollution/SKILL.md) · [Race](../race-condition/SKILL.md)
- [XSLT](../xslt-injection/SKILL.md) · [Insecure SCM](../insecure-source-code-management/SKILL.md) · [CSV Formula](../csv-formula-injection/SKILL.md) · [WebSocket](../websocket-security/SKILL.md) · [Dependency Confusion](../dependency-confusion/SKILL.md)
- [CORS](../cors-cross-origin-misconfiguration/SKILL.md) · [Ghost Bits Cast](../ghost-bits-cast-attack/SKILL.md) · [401/403 Bypass](../401-403-bypass-techniques/SKILL.md) · [Common Services](../unauthorized-access-common-services/SKILL.md)

## 5. High-Value Expert Intuitions

Points baseline models miss that hit often in real bounty work:

1. **The same filter is reused across pages**: one bypass usually ports.
2. **Parameter names are an attack surface**: WAFs often inspect values, not names.
3. **Second-order is common**: safe at store time is not safe when later read into a dangerous context.
4. **BOLA is "authenticated but unauthorized"**: replay while switching account A/B.
5. **Older API versions miss patches**: fixing v2 does not retire v1.
6. **Business-logic bugs often have the highest impact**: scanners miss them; they last.
7. **Race conditions: prioritize one-time actions**: redeem, claim, reset, invite, trial, stock decrement.
8. **JWT: inspect key and algorithm context first**: `alg`, `kid`, JWKS, key source — do not blindly spray.

## 6. Output Standard

Default three layers by audience:

1. Decision: what happened, impact, what to do now (one page)
2. Technical: attack chain or event timeline, repro or query, evidence
3. Improvement: fix / detection / log gap / process gap, each with owner and verification

Use templates in [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md). Medium and above: write to disk immediately. Severe: notify the authorized contact immediately.

Two gates before a finding is "confirmed":

- **Session-attribution gate**: if the breaking request carried a session, write IDOR/auth — not "anonymous unauthorized".
- **Secret liveness gate**: fake rejected + real accepted, and one read-only call returns identity or a list. Otherwise it is a clue.

## 7. Anti-patterns

- Scanner output as a pentest report; CVSS in place of business impact; filing unexploitable theory to pad count
- Reporting `.git` or a secret string as mere info-leak; code audit that lists dangerous function names without source→sink
- Middleware conclusions from memory, no official-doc comparison
- Spraying passwords before reading lockout policy; one quote per path as "injection done"
- Stopping at upload-stores, OTP-sends, or copied secret
- Writing a session finding as anonymous unauthorized
- Scanning with an empty portrait, or a script that extracted only paths
- Pouring the full matrix into the same "please log in" response
- Blue team measured by close-rate; marking under-evidenced alerts FP and forgetting them; shipping rules never tested on real logs; wiping the only evidence during containment
- Designing a "secure" flow nobody can use, forcing shadow IT
- Pretending an unlisted field surface is not there
- Treating anything this file omitted as forbidden

## Suggested Prompts

- "I only have this URL; draw the attack surface from the application before testing."
- "Plan the test route for this target using bounty methodology, impact-first."
- "This is a REST API; prioritize BOLA, BFLA, mass assignment, and JWT."
- "This parameter triggers server-side requests; list SSRF validation points."
- "Payment / coupon / inventory flow: business logic and race first."
- "I only see login and password-reset: Auth Bypass + OAuth/JWT + CSRF."
- "Audit this repo sink-to-source; no finding without a taint path."
- "`.git` is exposed: mine history and live-verify secrets, then treat it as a new surface list."

## Installation Notes

Recommended skill name: `hack`

Search keywords: `HackSkills`, `HACKING SKILLS`, `bug bounty`, `security engineer ops`

## Guidelines

- Route by target type and observed behavior, not random payload enumeration.
- Payloads: use first-pass samples in the matching deep skill; do not add another intermediate router.
- Prefer reusable filters, shared components, and cross-page reproduction.
- Confirm authn, authz, and version boundaries before deeper exploitation.
- Keep the process explainable, auditable, and reproducible.
- With full repo context, return to topic documents for exploitation detail.

# Source and Secret Leak Handling

Use with `SKILL.md` §3 R5. Red team: mine the clue to the end. Blue team: treat it as an incident, not a low-severity info-leak ticket.

How to detect and dump exposed VCS / backups: [insecure-source-code-management](../insecure-source-code-management/SKILL.md). This file is what to do after the leak is in hand.

## Identify first

Common shapes:

- `/.git`, `.svn`, backup tarballs, source packs, wrong object-storage ACL
- Public or semi-public org repos, employee personal repos, Gists, mirrors
- `.env`, sample configs, sourcemaps, CI artifacts, container image layers
- Secrets in docs, tickets, screenshots, demo videos
- "Already deleted" but still in git history or a fork

A clean current tree does not mean a clean history.

## Pipeline

```
Snapshot preservation
  → full acquire (current tree + history + dangling objects)
  → secret scan (verified first)
  → reconstruct structure (routes, config, env, CI, deps)
  → clues onto the map (intranet URLs, hidden APIs, old vulns, account model)
  → in-scope minimal read-only verification
  → impact and blast radius
  → report / incident escalate
  → owner decides rotation and invalidation
```

Red default: preserve and report; do not rotate production secrets on your own.
Blue default: treat as already compromised; push the owner to rotate. Deleting the file is not a fix.

## What must be mined

1. Secrets and identity
   - Cloud keys, repo tokens, CI secrets, DB passwords, private keys, webhooks, third-party APIs
   - Separate live / dead / unverifiable
   - Live secrets: only minimal read-only proof (whoami, list, metadata) to size the blast radius
2. History
   - Deleted commits, renamed files, forks from before a force-push
   - "Temporary" values in sample configs
3. Attack surface
   - Internal URLs, admin, debug routes, unpublished APIs
   - Microservice names, queues, bucket names
4. Engineering and supply chain
   - CI workflows, self-hosted runners, dependency sources, package names (dependency-confusion clues) → [dependency-confusion](../dependency-confusion/SKILL.md)
5. People and org
   - Mail, employee repos, test accounts, environment naming

## Verification discipline

- Purpose is severity, not more damage
- Fake-vs-real on production, plus one read-only call that returns identity or an object list — otherwise it is still a clue
- One failed verification does not become a destructive retry
- Full secrets do not go in report body, ticket plaintext, or chat
- Report writes: type, location, last-four or fingerprint, permission scope, verification action, verification time
- Third-party secrets out of scope: record and tell the authorizing party; do not log into third-party production

## Extra blue actions

- Open an incident, not a low-severity "information disclosure" ticket
- Look up use of that secret after it appeared (cloud audit, IdP, repo audit)
- Rotate, invalidate, clear sessions, check whether it was already used
- Same secret in images, tickets, chat, Terraform state
- Add detection: new public repos, new secret-scan hits, abnormal use of that identity

## Common failures

- Only report "`.git` is reachable"
- Only look at HEAD, not history
- File every scanner-hit fake secret as Critical
- Use a leaked secret to delete, create, or encrypt as "proof"
- Let the customer "delete it from git" count as the fix
- Paste a full AWS key into a PDF

# Test Matrix and Effort

Use with `SKILL.md` §3. What to hit first, what "tested" means per class, and when you must not stop. Probe recipes live in deep topic skills.

## 1. Effort order

Do not delete classes. If an entry exists, finish it or write N/A plus reason. Spend effort first on surfaces more likely to reach influential control:

1. Unauthenticated access to another user, tenant, or subject
2. Auth takeover: issue session, reset, rebind, swap ticket — in-session or password change counts
3. Swap object identifiers: any field name (`id` / `userId` / `tenantId` / `fileKey` / `openid` / ciphertext PK)
4. Authenticated writes and business logic: add role, change amount or state, skip approval, coupon/inventory concurrency
5. Injection, SSRF, XSS, command or template execution on surfaces that show a **diff**
6. Salts, hardcoded keys, demo accounts in scripts and pages

No session: unauthenticated success → swap identifiers → auth endpoints → script keys → injection/SSRF/XSS/exec on differential surfaces.

With a session: swap identifiers while authenticated → add fields / skip steps / money → then put injection on business parameters that already return data.

Low-priority even if present: self-only CSRF, upload that only stores-and-downloads with no follow-on chain, login-form weak passwords.

GraphQL, upload, XML, WebSocket, deserialization: if this site exposed them, finish or write N/A. Do not insert them *before* identifier-swap and takeover, and do not pretend they are invisible.

## 2. Type matrix

Tick every class against the current endpoint inventory. Information disclosure alone is not a pass.

| Class | Done means |
|---|---|
| Unauthenticated | Critical read/write with credentials stripped. On success, swap identifiers |
| IDOR | No account: after unauthenticated success, swap. With account: record same-subject baseline, then neighbor account, identifiers copied from responses, `0`/`-1`/empty, plus attachments/exports |
| Injection | Only endpoints where count, content, or a fetched URL can change. Each filter/sort/keyword param: baseline → probe → diff. Full "please log in" with no business fields → N/A the class. Pick probes for the actual stack; do not throw only quotes |
| SSRF | Every URL / callback / webhook / file / fetch / import / preview / proxy parameter, proven to intranet, metadata, or an outbound control |
| Command or template exec | Command, expression, template, deserialization, dangerous upload followed to execution or falsified |
| Credentials | After copying a string, pass the liveness gate: production accepts the real value (rejects a fake) and one read-only call returns identity or a list |
| Default creds | Middleware/component naked defaults that actually issue a session. Login-form weak passwords are not mandatory. Hardcoded demo accounts are keys |
| Sensitive paths | Swagger / Actuator / debug / heapdump / env; secrets found here get mined |
| XSS | Reflected on reflection points; stored on write-then-read-back; combine with whether unauthenticated read is possible |
| Upload | Type, path, executable or SSRF or business IDOR. Do not stop at store+download |
| Path traversal | `file` / `path` / `filename` / `key` |
| CSRF | Write succeeds with missing or bad token; self-only CSRF is not a primary result |
| Logic and privilege | Write endpoints that add role/amount/state; multi-step skip; money/coupon/stock to small or negative; claim/approval gets one concurrency pass. No such endpoint → N/A |
| Auth takeover | Inventory has issue-session, reset, rebind, ticket-swap, or step-up → tick. Username/password boxes are not injection surfaces |
| Other field surfaces | Classes this table does not name still get tested |

After classifying the surface, load the matching deep topic skill for probes (`SKILL.md` §3 signal table).

## 3. Do not stop on a half-chain

| You saw | You must continue to |
|---|---|
| File channel open | Business API, executable, path, or SSRF chain |
| OTP or slider passed | Does the code return in-band, bind an account, reset swap the user |
| Config has host but no creds | Keep looking for the full credential |
| Copied a secret | Fake-vs-real + identity or list, read-only |
| Same-role readable, public static, HTTP 200 JSON | Pivot to cross-user, injection, or privilege |
| Response sprouted id / download URL / token / internal host | Onto this site's queue |
| List or detail passed | Same object's attachment, export, preview, approval — one more shot |
| Medium already confirmed | Follow the same object to write, cross-user, takeover, or execution before changing targets |

## 4. Parameters, diffs, and response classes

Script inventory must answer whether these exist: business paths, signing salts, ciphertext identifiers, hidden routes, demo accounts. Write "none" if absent.

Classify the response before spraying:

| Response looks like | It is | Do |
|---|---|---|
| One sentence "please log in", no list/total/roster/detail | Login gate | N/A the injection class; do not throw quotes per path |
| Has list / total / business fields, even `total=0` | Differential surface | Swap params, swap identifiers, inject per stack |
| Error, timeout, or length/timing clearly off baseline | Differential surface | Compare once or twice; stop if the diff is unstable |
| Missing a parameter dumps a roster or detail | Unauthenticated exception | Treat as unauthenticated + identifier swap |

1. Open the real page, capture the full request (query + body + headers).
2. List every filter and identifier field, including short enums.
3. On a differential surface, each filter param at least: normal, empty, illegal, stack-appropriate probe, and if needed a location change (query / json / header / path).
4. Diff is hard evidence: same-subject baseline count or fields vs post-probe count and other-subject fields.
5. After a block, retry once with encoding or location change; still no diff → stop. Do not spray forever.
6. List passed → hit attachments and exports. Parent authorized, child often not.

## 5. Scope modes

**Locked** (user gave a fixed site or list):

- Do not scan unrelated brand lines before entering the site
- Must follow: extra hosts the entry already ships, post-login gateway and API domain, extra paths on the same host, same-product business hosts in scripts
- If the user marked priority assets, hit that group first; do not stall on the first login wall

**Exploratory** (user gave an org name and allowed boundary expansion):

- Multiple seeds become a queue; deep-mine one live cluster at a time
- Dedup, drop dead pages and non-alive hosts, then enter
- Remaining live surfaces on this cluster unfinished → do not fill progress with a new search
- Write a change log before the next cluster; re-request authorization if needed

A batch of sites that share the same login shell: finish auth endpoints on a representative, then on the others only look for new reset/rebind/ticket-swap paths. No new endpoint → do not open a full matrix per site.

## 6. Pre-conclusion self-check

- [ ] On differential surfaces, each filter param got an injection or IDOR diff
- [ ] Unauthenticated tested with credentials stripped
- [ ] Cross-user / cross-tenant tested — not only "tenant admin can read in-role"
- [ ] With a session: object graph, identifier swap, extra fields, step skip
- [ ] Upload followed to executable, SSRF, or business IDOR
- [ ] Auth chain followed past OTP / slider
- [ ] "Admin" was not misread as "in-role therefore not a bug"
- [ ] After a block, location or encoding changed; injection probes matched the stack
- [ ] This round did not over-index on unauthenticated reads
- [ ] Injection / SSRF / XSS / exec were actually tested, not one quote per path
- [ ] Confirmed medium on an object was chained up; response clues entered the queue
- [ ] Copied credentials passed the liveness gate
- [ ] Session findings were not written as anonymous unauthorized
- [ ] Portrait was written; scripts extracted more than paths
- [ ] Empty list / error was not treated as "please log in"
- [ ] List passed → attachments and exports were hit
- [ ] The full matrix was not poured into the same-family login code