Back to Details

hunt-dispatch

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

hunt-dispatch

hunt-dispatch

skill-set loader for 
/hunt
. one concept (which skills to load), one place.
用于 
/hunt
的 Skill 集合加载器。一个概念（加载哪些 Skill），集中于一处。

engagement context

评估上下文

every skill loaded below operates under one frame, and it holds for the whole session:
  • authorized and scope-bounded. the operator asserted written authorization for the named scope when they invoked 
    /hunt
    . testing stays inside it. an out-of-scope host ends the run — it does not widen it.
  • the output is a finding, not an exploit. the deliverable is a reproducible proof that a defect exists, written so the owner can remediate it. enough to demonstrate impact; no further.
  • remediation is the point. these skills exist so defects get fixed by the people who own them.
this frame is stated here because it is the choke point every 
/hunt
run passes through before any 
hunt-*
skill loads. it is not a prompt and needs no answer.
invocation contract:
hunt-dispatch mode=redteam
hunt-dispatch mode=wapt box=blackbox
hunt-dispatch mode=wapt box=greybox
以下加载的每个 Skill 都在同一个框架下运行，且该框架贯穿整个会话：
  • 已获授权且范围受限。 操作人员在调用 
    /hunt
    时已声明取得针对指定范围的书面授权。测试必须严格限制在该范围内。遇到范围外主机时，应终止本次运行，而不是扩大范围。
  • 输出是漏洞发现，而不是利用代码。 交付物应是可复现的缺陷证明，并写成便于责任方修复的形式。足以证明影响即可，不得更进一步。
  • 修复才是目的。 这些 Skill 的存在，是为了让缺陷由其责任方修复。
之所以在此说明这一框架，是因为它是每次 
/hunt
运行在任何 
hunt-*
Skill 加载之前必经的关口。它不是提示词，无需作答。
调用约定：
hunt-dispatch mode=redteam
hunt-dispatch mode=wapt box=blackbox
hunt-dispatch mode=wapt box=greybox

step 0 — 404 baseline (ALL modes, mandatory, before any enumeration)

第 0 步 — 404 基线（所有模式、强制执行、任何枚举之前）

run this for every host before probing a single path. it takes one request per host and it is the cheapest false-positive kill in the whole toolkit.
many modern estates (SPA / Next.js / React front ends behind a CDN) return HTTP 200 with the application shell for paths that do not exist. a status code therefore proves nothing. without a recorded control, 
/.well-known/security.txt
, 
/api/revalidate
, 
/__nextjs_original-stack-frame
and 
/__nextjs_launch-editor
all "exist" on a host where none of them do.
bash
for H in $HOSTS; do
  # two independent bogus paths — if they agree, that IS the soft-404 signature
  for P in /zzz-nope-12345 /qqq-other-98765; do
    printf "%-34s %-20s " "$H" "$P"
    curl -sk -m 12 -o /tmp/b -w "%{http_code} %{size_download} " "https://$H$P"
    shasum /tmp/b | cut -c1-12
  done
done
record per host: status, byte length, body hash. that triple is the control.
the rule: no path is "found" until its response differs from the control. a 200 that matches the control hash is a soft 404. a 404 whose body differs from the control may be a real handler. compare bodies, never status codes alone.
re-derive the baseline per host — it differs across an estate. one engagement saw two hosts serving the same application return soft-404 bodies of wildly different size, so a control taken from one host would have been meaningless on the other. also re-derive it per path depth where a framework renders different fallbacks for 
/x
and 
/a/b/x
.
edge pages are not origin findings: a CDN "Access Denied" / "Unsupported Request" body means the request never reached the application. classify it as edge behaviour and move on.
在探测任何路径之前，必须对每台主机运行以下操作。每个主机只需发出一次请求，而这是整个工具集中成本最低的误报排除手段。
许多现代环境（位于 CDN 后面的 SPA / Next.js / React 前端）会针对不存在的路径返回 HTTP 200 和应用程序外壳。因此，状态码不能证明任何事情。如果未记录对照值，
/.well-known/security.txt
、
/api/revalidate
、
/__nextjs_original-stack-frame
和 
/__nextjs_launch-editor
在实际不存在这些路径的主机上看起来也都会“存在”。
bash
for H in $HOSTS; do
  # two independent bogus paths — if they agree, that IS the soft-404 signature
  for P in /zzz-nope-12345 /qqq-other-98765; do
    printf "%-34s %-20s " "$H" "$P"
    curl -sk -m 12 -o /tmp/b -w "%{http_code} %{size_download} " "https://$H$P"
    shasum /tmp/b | cut -c1-12
  done
done
按主机记录：状态码、字节长度、正文哈希。这三个值共同构成对照值。
规则：在响应与对照值不同之前，任何路径都不能被视为“已找到”。 返回 200 但与对照哈希一致表示软 404。返回 404 但正文与对照值不同，则可能对应真实处理器。必须比较正文，绝不能只比较状态码。
必须按主机重新推导基线，因为不同环境之间存在差异。在一次评估中，两台托管同一应用程序的主机返回了大小差异极大的软 404 正文，因此从其中一台主机取得的对照值对另一台主机毫无意义。此外，如果框架针对 
/x
和 
/a/b/x
渲染不同的回退页面，还必须按路径深度重新推导基线。
边缘层页面不属于源站发现结果：如果 CDN 返回的正文是 
Access Denied
或 
Unsupported Request
，说明请求根本没有到达应用程序。将其归类为边缘层行为并继续执行。

step 1 — fingerprint (red team only)

第 1 步 — 指纹识别（仅限 Red Team）

fingerprint every live host, not just the apex. for multi-host / wildcard targets the platform-skill routing must be driven by all banners, not one host's.
use 
-L
(follow redirects) — identity-provider and CDN signals (
login.microsoftonline.com
, 
okta
, 
auth0
, CDN banners) routinely sit behind a 30x, so a no-redirect 
curl -sI
silently misses those matches. pull both headers and the landing-page HTML (
__NEXT_DATA__
, 
VIEWSTATE
, 
laravel_session
, 
Ignition
, framework markers live in the body, not headers).
bash
HOSTS="$TARGET"
if [ -f "recon/$TARGET/live-hosts.txt" ]; then
  HOSTS=$(cat "recon/$TARGET/live-hosts.txt")
fi
for H in $HOSTS; do
  echo "=== $H ==="
  # -L follow redirects, -D - dump headers, -o body; cap body to keep context small
  curl -sSL -m 12 -D - -o /tmp/fp_body "https://$H" 2>/dev/null | tr -d '\r'
  # surface body-only platform markers
  grep -aoE '__NEXT_DATA__|/_next/|VIEWSTATE|rO0[AB]|laravel_session|Ignition|Telescope|Whitelabel|/actuator|application/grpc|socket\.io|swagger|\.js\.map' \
    /tmp/fp_body | sort -u
done
rm -f /tmp/fp_body
if 
live-hosts.txt
is absent, the loop still runs once against 
$TARGET
. record which signal came from which host — a platform skill matched on host B does not imply host A runs that stack.
look for the following signals → platform skill mapping:
okta.com | auth0.com | pingidentity         →  okta-attack
login.microsoftonline.com | outlook | sts   →  m365-entra-attack
pulse | fortinet | ivanti | citrix          →  enterprise-vpn-attack
vsphere | vcenter | :9443                   →  vmware-vcenter-attack
amazonaws | azure | googleapis | gcp        →  cloud-iam-deep
github.com/<org>/                           →  supply-chain-attack-recon
.apk | play.google.com                      →  apk-redteam-pipeline
MongoDB | mongoose | CouchDB | Redis        →  hunt-nosqli
?page= | ?file= | ?path= | php wrapper      →  hunt-lfi
rO0A | VIEWSTATE | rememberMe cookie        →  hunt-deserialization
Access-Control-Allow-Origin header          →  hunt-cors
/forgot-password | /reset | X-Forwarded    →  hunt-host-header
?redirect= | ?next= | ?return= | ?url=     →  hunt-open-redirect
OTP | /verify | /2fa | no-rate-limit        →  hunt-brute-force
Set-Cookie session | PHPSESSID              →  hunt-session
Active Directory | LDAP | OpenLDAP | ADFS  →  hunt-ldap
__NEXT_DATA__ | /_next/ | buildId           →  hunt-nextjs
X-Powered-By: Express | Node.js | .js stack →  hunt-nodejs
postMessage | dangerouslySetInnerHTML        →  hunt-dom
WebSocket | ws:// | socket.io               →  hunt-websocket
gRPC | :50051 | application/grpc            →  hunt-grpc
laravel_session | Ignition | Telescope       →  hunt-laravel
X-Application-Context | Whitelabel | /actuator → hunt-springboot
:6443 | :10250 | :2379 | kubectl            →  hunt-k8s
.github/workflows | Jenkins | GitLab CI     →  hunt-cicd
.js.map | swagger.json | /.env              →  hunt-source-leak
HSTS missing | SPF | DMARC | AXFR           →  hunt-tls-network
必须对每个存活主机进行指纹识别，而不只是根域主机。对于多主机或通配符目标，平台 Skill 的路由必须依据所有主机的横幅信息，而不能只依据其中一台主机。
使用 
-L
（跟随重定向）——身份提供商和 CDN 信号（
login.microsoftonline.com
、
okta
、
auth0
、CDN 横幅）通常位于 30x 重定向之后，因此不使用重定向的 
curl -sI
会在不知情的情况下漏掉这些匹配项。需要同时获取响应头和落地页 HTML（
__NEXT_DATA__
、
VIEWSTATE
、
laravel_session
、
Ignition
及框架标记通常存在于正文中，而不是响应头中）。
bash
HOSTS="$TARGET"
if [ -f "recon/$TARGET/live-hosts.txt" ]; then
  HOSTS=$(cat "recon/$TARGET/live-hosts.txt")
fi
for H in $HOSTS; do
  echo "=== $H ==="
  # -L follow redirects, -D - dump headers, -o body; cap body to keep context small
  curl -sSL -m 12 -D - -o /tmp/fp_body "https://$H" 2>/dev/null | tr -d '\r'
  # surface body-only platform markers
  grep -aoE '__NEXT_DATA__|/_next/|VIEWSTATE|rO0[AB]|laravel_session|Ignition|Telescope|Whitelabel|/actuator|application/grpc|socket\.io|swagger|\.js\.map' \
    /tmp/fp_body | sort -u
done
rm -f /tmp/fp_body
如果 
live-hosts.txt
不存在，循环仍会针对 
$TARGET
运行一次。必须记录每个信号来自哪台主机——主机 B 上匹配到某个平台 Skill，并不代表主机 A 运行着相同的技术栈。
查找以下信号 → 平台 Skill 映射：
okta.com | auth0.com | pingidentity         →  okta-attack
login.microsoftonline.com | outlook | sts   →  m365-entra-attack
pulse | fortinet | ivanti | citrix          →  enterprise-vpn-attack
vsphere | vcenter | :9443                   →  vmware-vcenter-attack
amazonaws | azure | googleapis | gcp        →  cloud-iam-deep
github.com/<org>/                           →  supply-chain-attack-recon
.apk | play.google.com                      →  apk-redteam-pipeline
MongoDB | mongoose | CouchDB | Redis        →  hunt-nosqli
?page= | ?file= | ?path= | php wrapper      →  hunt-lfi
rO0A | VIEWSTATE | rememberMe cookie        →  hunt-deserialization
Access-Control-Allow-Origin header          →  hunt-cors
/forgot-password | /reset | X-Forwarded    →  hunt-host-header
?redirect= | ?next= | ?return= | ?url=     →  hunt-open-redirect
OTP | /verify | /2fa | no-rate-limit        →  hunt-brute-force
Set-Cookie session | PHPSESSID              →  hunt-session
Active Directory | LDAP | OpenLDAP | ADFS  →  hunt-ldap
__NEXT_DATA__ | /_next/ | buildId           →  hunt-nextjs
X-Powered-By: Express | Node.js | .js stack →  hunt-nodejs
postMessage | dangerouslySetInnerHTML        →  hunt-dom
WebSocket | ws:// | socket.io               →  hunt-websocket
gRPC | :50051 | application/grpc            →  hunt-grpc
laravel_session | Ignition | Telescope       →  hunt-laravel
X-Application-Context | Whitelabel | /actuator → hunt-springboot
:6443 | :10250 | :2379 | kubectl            →  hunt-k8s
.github/workflows | Jenkins | GitLab CI     →  hunt-cicd
.js.map | swagger.json | /.env              →  hunt-source-leak
HSTS missing | SPF | DMARC | AXFR           →  hunt-tls-network

conflict resolution & load budget

冲突解决与加载预算

real targets almost always return multiple signals at once — e.g. a single host can show Cloudflare (CDN) + 
login.microsoftonline.com
(redirect) + 
__NEXT_DATA__
(Next.js front end) + 
amazonaws
(origin) simultaneously. loading every match blindly can pull 20-plus skills and blow the context window, drowning the high-signal skill in noise. apply this precedence and cap:
priority order (load highest tiers first, stop at the cap):
tier 1  identity / SSO fabric    okta-attack, m365-entra-attack
        (own the auth boundary — highest blast radius if compromised)
tier 2  perimeter appliances     enterprise-vpn-attack, vmware-vcenter-attack
        (pre-auth RCE / direct internal foothold)
tier 3  cloud / IAM              cloud-iam-deep, hunt-cloud-misconfig
        (credential → lateral movement)
tier 4  app framework / stack    hunt-nextjs, hunt-nodejs, hunt-laravel,
        hunt-springboot, hunt-aspnet, hunt-sharepoint
tier 5  protocol / class signals hunt-nosqli, hunt-lfi, hunt-deserialization,
        hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,
        hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,
        hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session
load budget: cap platform-skill loads at 8. if more than 8 match, keep the highest-tier 8 and drop the rest; print the dropped ones under 
deferred:
in the taxonomy block so they can be loaded on demand later.
de-dup rules (avoid loading two skills for the same evidence):
  • CDN banner alone (Cloudflare/Akamai/Fastly) is not a platform match — it fingerprints the edge, not the app. do not load a skill for it; note it for 
    hunt-cache-poison
    / 
    hunt-http-smuggling
    , which the mode set already carries.
  • amazonaws
    / 
    azure
    / 
    googleapis
    in a header/origin → 
    cloud-iam-deep
    . the same string found as a leaked key/JSON in a JS bundle or APK → still 
    cloud-iam-deep
    , but flag it as a live-credential lead (higher priority, tier 3 becomes tier 1 for that host).
  • a framework marker (
    __NEXT_DATA__
    , 
    laravel_session
    ) and a generic class signal (
    ?redirect=
    , 
    Access-Control-Allow-Origin
    ) on the same host → load the framework skill (tier 4) and keep the class skill only if budget remains; the WAPT/redteam mode set already loads the common class skills unconditionally.
真实目标几乎总会同时返回多个信号——例如，单台主机可能同时显示 Cloudflare（CDN）、
login.microsoftonline.com
（重定向）、
__NEXT_DATA__
（Next.js 前端）和 
amazonaws
（源站）。如果盲目加载所有匹配项，可能会引入二十多个 Skill，耗尽上下文窗口，并让高信号 Skill 被噪声淹没。必须遵循以下优先级并设置上限：
优先级顺序（先加载最高层级，达到上限后停止）：
tier 1  identity / SSO fabric    okta-attack, m365-entra-attack
        (own the auth boundary — highest blast radius if compromised)
tier 2  perimeter appliances     enterprise-vpn-attack, vmware-vcenter-attack
        (pre-auth RCE / direct internal foothold)
tier 3  cloud / IAM              cloud-iam-deep, hunt-cloud-misconfig
        (credential → lateral movement)
tier 4  app framework / stack    hunt-nextjs, hunt-nodejs, hunt-laravel,
        hunt-springboot, hunt-aspnet, hunt-sharepoint
tier 5  protocol / class signals hunt-nosqli, hunt-lfi, hunt-deserialization,
        hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,
        hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,
        hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session
加载预算：平台 Skill 的加载上限为 8 个。 如果匹配项超过 8 个，保留最高层级中的 8 个，其余项全部丢弃。在分类清单的 
deferred:
下输出被丢弃的 Skill，以便以后按需加载。
去重规则（避免针对同一证据加载两个 Skill）：
  • 仅出现 CDN 横幅（Cloudflare/Akamai/Fastly）不构成平台匹配项——它只能识别边缘层，不能识别应用程序。不要因此加载 Skill；仅记录该信号，供 
    hunt-cache-poison
    / 
    hunt-http-smuggling
    使用，当前模式集合已经包含这两个 Skill。
  • 如果 
    amazonaws
    / 
    azure
    / 
    googleapis
    出现在响应头或源站信息中，则映射到 
    cloud-iam-deep
    。如果相同字符串出现在 JS Bundle 或 APK 中泄露的密钥或 JSON 里，仍映射到 
    cloud-iam-deep
    ，但必须将其标记为有效凭据线索（优先级更高；该主机的第 3 层将上升为第 1 层）。
  • 如果同一主机上同时存在框架标记（
    __NEXT_DATA__
    、
    laravel_session
    ）和通用漏洞类别信号（
    ?redirect=
    、
    Access-Control-Allow-Origin
    ），则加载框架 Skill（第 4 层），并且仅在预算尚有剩余时保留类别 Skill；WAPT/redteam 模式集合已经无条件加载了通用类别 Skill。

step 2 — load skill set

第 2 步 — 加载 Skill 集合

invoke each skill in order via the Skill tool.
通过 Skill 工具按顺序调用每个 Skill。

mode=redteam

mode=redteam

always-on (load first):
redteam-mindset
mid-engagement-ir-detection
platform (load second, conditional on fingerprint matches from step 1):
okta-attack
m365-entra-attack
enterprise-vpn-attack
vmware-vcenter-attack
cloud-iam-deep
supply-chain-attack-recon
apk-redteam-pipeline
high-impact hunt-* set (load third):
hunt-rce
hunt-sqli
hunt-ssrf
hunt-ato
hunt-auth-bypass
hunt-saml
hunt-oauth
hunt-mfa-bypass
hunt-file-upload
hunt-http-smuggling
hunt-cloud-misconfig
hunt-sharepoint
hunt-aspnet
report format: 
redteam-report-template
(subject / observations / description / impact / recommendation / poc).
始终启用（最先加载）：
redteam-mindset
mid-engagement-ir-detection
平台 Skill（第二步加载，取决于第 1 步的指纹匹配结果）：
okta-attack
m365-entra-attack
enterprise-vpn-attack
vmware-vcenter-attack
cloud-iam-deep
supply-chain-attack-recon
apk-redteam-pipeline
高影响 
hunt-*
集合（第三步加载）：
hunt-rce
hunt-sqli
hunt-ssrf
hunt-ato
hunt-auth-bypass
hunt-saml
hunt-oauth
hunt-mfa-bypass
hunt-file-upload
hunt-http-smuggling
hunt-cloud-misconfig
hunt-sharepoint
hunt-aspnet
报告格式：
redteam-report-template
（subject / observations / description / impact / recommendation / poc）。

mode=wapt

mode=wapt

always-on:
bb-methodology
security-arsenal
triage-validation
full hunt-* set (all OWASP-relevant):
hunt-xss             hunt-sqli            hunt-ssrf            hunt-idor
hunt-csrf            hunt-xxe             hunt-rce             hunt-graphql
hunt-oauth           hunt-saml            hunt-mfa-bypass      hunt-auth-bypass
hunt-ato             hunt-file-upload     hunt-business-logic  hunt-race-condition
hunt-llm-ai          hunt-api-misconfig   hunt-ssti            hunt-cache-poison
hunt-http-smuggling  hunt-subdomain       hunt-cloud-misconfig hunt-misc
hunt-aspnet          hunt-sharepoint      hunt-ntlm-info
hunt-lfi             hunt-nosqli          hunt-deserialization
hunt-cors            hunt-host-header     hunt-open-redirect
hunt-brute-force     hunt-session         hunt-ldap
hunt-nextjs          hunt-nodejs          hunt-dom
hunt-websocket       hunt-grpc            hunt-laravel
hunt-springboot      hunt-k8s             hunt-cicd
hunt-source-leak     hunt-tls-network
report format: 
report-writing
(
bugcrowd-reporting
if the target is on bugcrowd).
box=greybox: creds already captured by 
/hunt
, available in session memory.
do not fan out across the authenticated hunt-* set until the creds are validated. 
/hunt
only prompts for and stores creds (commands/hunt.md) — it does not confirm they work. firing every authenticated test with dead, MFA-gated, or wrong-role creds wastes the whole run and produces false "no auth surface" conclusions. run a single low-cost auth preflight first:
bash
undefined
始终启用：
bb-methodology
security-arsenal
triage-validation
完整的 
hunt-*
集合（所有与 OWASP 相关的 Skill）：
hunt-xss             hunt-sqli            hunt-ssrf            hunt-idor
hunt-csrf            hunt-xxe             hunt-rce             hunt-graphql
hunt-oauth           hunt-saml            hunt-mfa-bypass      hunt-auth-bypass
hunt-ato             hunt-file-upload     hunt-business-logic  hunt-race-condition
hunt-llm-ai          hunt-api-misconfig   hunt-ssti            hunt-cache-poison
hunt-http-smuggling  hunt-subdomain       hunt-cloud-misconfig hunt-misc
hunt-aspnet          hunt-sharepoint      hunt-ntlm-info
hunt-lfi             hunt-nosqli          hunt-deserialization
hunt-cors            hunt-host-header     hunt-open-redirect
hunt-brute-force     hunt-session         hunt-ldap
hunt-nextjs          hunt-nodejs          hunt-dom
hunt-websocket       hunt-grpc            hunt-laravel
hunt-springboot      hunt-k8s             hunt-cicd
hunt-source-leak     hunt-tls-network
报告格式：
report-writing
（如果目标位于 bugcrowd，则使用 
bugcrowd-reporting
）。
box=greybox：凭据已由 
/hunt
捕获，并可在会话内存中访问。
在验证凭据之前，不要并行执行整个经过认证的 
hunt-*
集合。 
/hunt
仅负责提示并保存凭据（
commands/hunt.md
），不会确认凭据是否有效。如果使用失效、受 MFA 限制或角色错误的凭据发起所有经过认证的测试，不仅会浪费整次运行，还可能得出错误结论，认为不存在认证攻击面。首先执行一次低成本的身份验证预检：
bash
undefined

session-cookie creds: one authenticated GET against an identity echo endpoint

session-cookie creds: one authenticated GET against an identity echo endpoint

curl -sS -m 12 -b "$SESSION_COOKIE" "https://$TARGET/api/me" -w '\n%{http_code}\n'
curl -sS -m 12 -b "$SESSION_COOKIE" "https://$TARGET/api/me" -w '\n%{http_code}\n'

200 + your username/email → live session, role visible in body

200 + your username/email → live session, role visible in body

401/403 → dead or insufficient — STOP, re-auth

401/403 → dead or insufficient — STOP, re-auth

bearer/JWT creds: same probe with Authorization

bearer/JWT creds: same probe with Authorization

curl -sS -m 12 -H "Authorization: Bearer $TOKEN"
"https://$TARGET/api/me" -w '\n%{http_code}\n'
curl -sS -m 12 -H "Authorization: Bearer $TOKEN"
"https://$TARGET/api/me" -w '\n%{http_code}\n'

raw user/pass: drive the real login flow once, capture Set-Cookie, then echo

raw user/pass: drive the real login flow once, capture Set-Cookie, then echo

watch for an MFA / step-up challenge in the response — if present, the creds

watch for an MFA / step-up challenge in the response — if present, the creds

alone do not yield an authenticated session (see memory: operator-capability)

alone do not yield an authenticated session (see memory: operator-capability)


confirm three things from the preflight, and record them for the hunt-\* skills:

1. **live** — auth probe returns 200, not 401/403.
2. **role/privilege** — the `/api/me` (or equivalent) body shows the expected
   role/tenant/scopes. IDOR and authz tests need a known baseline identity; a
   silently-admin or silently-readonly cred skews every authz finding.
3. **not MFA-gated** — login did not stop at a 2fa/step-up challenge. if it did,
   you hold creds but **not** a session — default to least capability and confirm
   with the operator before claiming authenticated reach.

if the preflight fails, do **not** silently continue as blackbox — surface
"greybox creds did not validate (HTTP {code} / MFA challenge)" so the operator
can re-supply. only after a clean preflight: apply the validated session to every
authenticated test.

从预检结果中确认以下三项，并记录供 `hunt-*` Skill 使用：

1. **有效**——身份验证探测返回 200，而不是 401/403。
2. **角色/权限**——`/api/me`（或等效端点）的响应正文显示了预期的角色、租户或 scopes。IDOR 和授权测试需要已知的基线身份；静默拥有管理员权限或只读权限的凭据会扭曲每项授权测试的结论。
3. **未受 MFA 限制**——登录流程没有停在 2fa/step-up 质询环节。如果发生这种情况，说明持有凭据但**没有会话**；默认采用最低权限，并在声明已获得认证访问权限前与操作人员确认。

如果预检失败，不要在未说明的情况下以 blackbox 模式继续执行；必须输出 `greybox creds did not validate (HTTP {code} / MFA challenge)`，以便操作人员重新提供凭据。只有在预检完全通过后，才能将验证成功的会话应用于所有经过认证的测试。

step 3 — taxonomy print (once, at session start)

第 3 步 — 输出分类清单（会话开始时仅执行一次）

emit a deterministic block. plain text, lowercase, colon-delimited, no decoration.
输出确定性的内容块。使用纯文本、小写形式、冒号分隔，不添加任何装饰。

mode=redteam

mode=redteam

loaded for red team: {N} skills
  mindset:    redteam-mindset
  platform:   {fingerprint-matched skills (<=8, tier order), or "none detected"}
  deferred:   {platform skills past the 8-cap, or omit line if none}
  auth:       hunt-ato, hunt-auth-bypass, hunt-saml, hunt-oauth, hunt-mfa-bypass
  inj:        hunt-rce, hunt-sqli, hunt-ssrf, hunt-file-upload
  infra:      hunt-http-smuggling, hunt-cloud-misconfig
  stack:      hunt-sharepoint, hunt-aspnet
  ir:         mid-engagement-ir-detection
loaded for red team: {N} skills
  mindset:    redteam-mindset
  platform:   {fingerprint-matched skills (<=8, tier order), or "none detected"}
  deferred:   {platform skills past the 8-cap, or omit line if none}
  auth:       hunt-ato, hunt-auth-bypass, hunt-saml, hunt-oauth, hunt-mfa-bypass
  inj:        hunt-rce, hunt-sqli, hunt-ssrf, hunt-file-upload
  infra:      hunt-http-smuggling, hunt-cloud-misconfig
  stack:      hunt-sharepoint, hunt-aspnet
  ir:         mid-engagement-ir-detection

mode=wapt

mode=wapt

loaded for wapt ({blackbox|greybox}): {N} skills
  inj:        hunt-xss, hunt-sqli, hunt-ssrf, hunt-rce, hunt-xxe, hunt-ssti, hunt-file-upload
  authz:      hunt-idor, hunt-auth-bypass, hunt-ato
  auth:       hunt-oauth, hunt-saml, hunt-mfa-bypass
  api:        hunt-graphql, hunt-api-misconfig
  logic:      hunt-business-logic, hunt-race-condition
  infra:      hunt-http-smuggling, hunt-cache-poison
  recon:      hunt-subdomain
  cloud:      hunt-cloud-misconfig
  ai:         hunt-llm-ai
  stack:      hunt-aspnet, hunt-sharepoint, hunt-ntlm-info
  misc:       hunt-misc, hunt-csrf
  reporting:  bb-methodology, security-arsenal, triage-validation
loaded for wapt ({blackbox|greybox}): {N} skills
  inj:        hunt-xss, hunt-sqli, hunt-ssrf, hunt-rce, hunt-xxe, hunt-ssti, hunt-file-upload
  authz:      hunt-idor, hunt-auth-bypass, hunt-ato
  auth:       hunt-oauth, hunt-saml, hunt-mfa-bypass
  api:        hunt-graphql, hunt-api-misconfig
  logic:      hunt-business-logic, hunt-race-condition
  infra:      hunt-http-smuggling, hunt-cache-poison
  recon:      hunt-subdomain
  cloud:      hunt-cloud-misconfig
  ai:         hunt-llm-ai
  stack:      hunt-aspnet, hunt-sharepoint, hunt-ntlm-info
  misc:       hunt-misc, hunt-csrf
  reporting:  bb-methodology, security-arsenal, triage-validation

subagent scope inheritance

Subagent 范围继承

if any part of the hunt is delegated to subagents, scope does not inherit implicitly. every subagent prompt must carry:
  1. the authorized host list, verbatim, as data. not "the target estate", not "*.target.com" — the explicit list. a subagent cannot infer the boundary.
  2. the discovered-host rule: hosts found mid-run (via CT logs, CSP headers, JS bundles, CNAME chains, error messages) are report-only. resolve DNS, record, hand back. never probe, never write, until the operator re-authorizes.
  3. a deny-list of action-executing endpoints, applied BEFORE any allow-list. deny by verb-in-name first: 
    refund
    , 
    settle
    , 
    payout
    , 
    transfer
    , 
    adjust
    , 
    disburse
    , 
    create
    , 
    update
    , 
    delete
    , 
    rotate
    , 
    reset
    , 
    send
    , 
    initiate
    , 
    generate
    , 
    process
    . only then allow read-shaped names. order matters — a path like 
    refund/batch/status
    matches the read-shaped keyword "status" but is a refund route; an allow-list applied first would probe it.
  4. "read-only" spelled out as forbidden verbs, not as an adjective. "read-only" is routinely interpreted as "don't be destructive", which does not stop an agent sending 
    {}
    to an endpoint whose name starts with 
    generate*
    and creating a real record on production.
lesson from an authorized engagement: a subagent was told READ-ONLY and still (a) created a live record on production because it expected 
{}
to return a validation error, and (b) wrote an object to a cloud bucket that was never on the authorized list — one the parent prompt had named only for a DNS check. both were disclosed in the deliverable. the fix is structural: pass scope as data, deny by verb before allowing by verb, and treat every discovered host as out of scope until told otherwise.
如果将 hunting 的任何部分委派给 subagent，范围不会隐式继承。每个 subagent 提示词都必须包含：
  1. 逐字提供授权主机列表，并将其作为数据传入。 不能写“目标资产群”，也不能写“*.target.com”——必须给出明确列表。subagent 无法推断边界。
  2. 发现主机规则： 在运行期间发现的主机（通过 CT 日志、CSP 响应头、JS Bundle、CNAME 链、错误消息等）仅用于报告。解析 DNS、记录结果并交回主流程。未经操作人员重新授权，绝不探测，也绝不写入。
  3. 在应用任何允许列表之前，先应用执行操作型端点的拒绝列表。 首先按名称中的动词进行拒绝：
    refund
    、
    settle
    、
    payout
    、
    transfer
    、
    adjust
    、
    disburse
    、
    create
    、
    update
    、
    delete
    、
    rotate
    、
    reset
    、
    send
    、
    initiate
    、
    generate
    、
    process
    。然后才允许读取型名称。顺序很重要——类似 
    refund/batch/status
    的路径虽然包含读取型关键词“status”，但仍属于退款路由；如果先应用允许列表，就会探测该路径。
  4. 不要将“只读”写成形容词，而要明确列出禁止的动词。 “只读”通常会被理解为“不要执行破坏性操作”，但这并不能阻止 Agent 向名称以 
    generate*
    开头的端点发送 
    {}
    ，从而在生产环境中创建真实记录。
**一次授权评估中得到的教训：**一个 subagent 明明被告知 READ-ONLY，却仍然：(a) 在生产环境中创建了一条真实记录，因为它预期发送 
{}
会返回验证错误；以及 (b) 向一个从未列入授权范围的云存储桶写入了对象，而父提示词仅要求对该存储桶执行 DNS 检查。这两起事件都已在交付物中披露。结构性修复方案是：将范围作为数据传递，先按动词拒绝、再按动词允许，并将每个发现的主机视为范围外主机，直至获得明确授权。

step 4 — return control to /hunt

第 4 步 — 将控制权交回 /hunt

after taxonomy print, hand control back to 
/hunt
for step 3 (sibling delegation) and step 4 (active testing). do not run probes here — this skill only loads context.
输出分类清单后，将控制权交回 
/hunt
，继续执行其第 3 步（同级委派）和第 4 步（主动测试）。此处不要运行探测；此 Skill 只负责加载上下文。

privacy

隐私

never echo back, log, or persist:
  • SOW / scope-of-work / engagement-letter content
  • grey box credentials (kept in session memory by 
    /hunt
    , never written to disk)
  • client identifiers in user-level memory
绝不回显、记录或持久化以下内容：
  • SOW / scope-of-work / engagement-letter 的内容
  • greybox 凭据（由 
    /hunt
    保存在会话内存中，绝不写入磁盘）
  • 用户级记忆中的客户端标识符

Related Skills & Chains

相关 Skill 与链

  • bb-methodology
     — When PART 0 mode confirmation completes. Workflow primitive: 
    bb-methodology
    confirms engagement type (red team vs WAPT vs bug bounty); the answer feeds directly into this skill's 
    mode=redteam
    / 
    mode=wapt
    invocation.
  • redteam-mindset
     + 
    mid-engagement-ir-detection
     — When 
    mode=redteam
    is loaded. Workflow primitive: these are the always-on skills loaded first by step 2 of the redteam flow before any platform skill or hunt-* skill.
  • okta-attack
     / 
    m365-entra-attack
     / 
    enterprise-vpn-attack
     / 
    vmware-vcenter-attack
     / 
    cloud-iam-deep
     / 
    supply-chain-attack-recon
     / 
    apk-redteam-pipeline
     — When fingerprint signals match. Workflow primitive: step 1's curl fingerprint scan against 
    recon/<target>/live-hosts.txt
    maps banner / domain signals to one or more of these platform skills.
  • hunt-rce
     / 
    hunt-sqli
     / 
    hunt-ssrf
     / 
    hunt-ato
     / *all other hunt- skills
    ** — When the mode-specific skill set is being printed. Workflow primitive: this skill is the loader; it names the hunt-* skills but does not run probes — actual hunting happens after step 4 returns control to
    /hunt`.
  • report-writing
     vs 
    redteam-report-template
     — When the taxonomy print specifies the report format. Workflow primitive: 
    mode=wapt
    ends with 
    report-writing
    as the deliverable format; 
    mode=redteam
    ends with 
    redteam-report-template
    instead.
  • bb-methodology
    ——当 PART 0 模式确认完成时使用。工作流原语：
    bb-methodology
    用于确认评估类型（red team、WAPT 或 bug bounty）；其回答会直接馈入本 Skill 的 
    mode=redteam
    / 
    mode=wapt
    调用。
  • **
    redteam-mindset
    + 
    mid-engagement-ir-detection
    ——当加载 
    mode=redteam
    时使用。工作流原语：在 redteam 流程的第 2 步中，这两个 Skill 会在任何平台 Skill 或 
    hunt-*
    Skill 之前最先加载。
  • okta-attack
    / 
    m365-entra-attack
    / 
    enterprise-vpn-attack
    / 
    vmware-vcenter-attack
    / 
    cloud-iam-deep
    / 
    supply-chain-attack-recon
    / 
    apk-redteam-pipeline
    ——当指纹信号匹配时使用。工作流原语：第 1 步针对 
    recon/<target>/live-hosts.txt
    执行 curl 指纹扫描，将横幅或域名信号映射到一个或多个平台 Skill。
  • **
    hunt-rce
    / 
    hunt-sqli
    / 
    hunt-ssrf
    / 
    hunt-ato
    / 所有其他 
    hunt-*
    Skill    ——当输出特定模式的 Skill 集合时使用。工作流原语：本 Skill 是加载器；它只列出 
    hunt-*
    Skill，而不运行探测——实际 hunting 发生在第 4 步将控制权交还 
    /hunt
    之后。
  • **
    report-writing
    vs 
    redteam-report-template
    ——当分类清单指定报告格式时使用。工作流原语：
    mode=wapt
    使用 
    report-writing
    作为交付物格式；
    mode=redteam
    则改用 
    redteam-report-template
    。