H-mmer/pentest-agents - الصفحة ٢

triage

Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

لغة النص الأصلي: الإنجليزية

validate

Validate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>

لغة النص الأصلي: الإنجليزية

analyze

Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>

لغة النص الأصلي: الإنجليزية

brain

Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.

لغة النص الأصلي: الإنجليزية

chain

Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)

لغة النص الأصلي: الإنجليزية

correlate

Run the finding correlation engine to discover attack chains from individual findings.

لغة النص الأصلي: الإنجليزية

cost

Show cost tracking and ROI for this engagement.

لغة النص الأصلي: الإنجليزية

dupcheck

Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type> e.g. /dupcheck XSS in search endpoint

لغة النص الأصلي: الإنجليزية

fullscan

Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.

لغة النص الأصلي: الإنجليزية

learn

Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

لغة النص الأصلي: الإنجليزية

mindmap

Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target>

لغة النص الأصلي: الإنجليزية

monitor

Monitor targets for changes. Usage: /monitor baseline (first run), /monitor check (detect changes), /monitor scope (check platform for scope updates)

لغة النص الأصلي: الإنجليزية

new

Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]

لغة النص الأصلي: الإنجليزية

pipeline

Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run /hunt or /autopilot after. Usage: /pipeline or /pipeline <target>

لغة النص الأصلي: الإنجليزية

quality

Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>

لغة النص الأصلي: الإنجليزية

quickscan

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

لغة النص الأصلي: الإنجليزية

remember

Log a finding or pattern to persistent brain memory. Auto-fills from session context. Usage: /remember

لغة النص الأصلي: الإنجليزية

resume

Resume a previous hunt. Shows hunt history, untested endpoints, memory-informed suggestions. Usage: /resume target.com

لغة النص الأصلي: الإنجليزية

sast

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score…

لغة النص الأصلي: الإنجليزية

status

Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate.

لغة النص الأصلي: الإنجليزية

surface

Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com

لغة النص الأصلي: الإنجليزية

sync

Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber

لغة النص الأصلي: الإنجليزية

triage

Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

لغة النص الأصلي: الإنجليزية

validate

Validate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>

لغة النص الأصلي: الإنجليزية

auth-tester

Authentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.

لغة النص الأصلي: الإنجليزية

brain

Central knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use AFTER any agent completes to record findings, exhausted vectors, and learned patterns. The brain prevents redundant work across…

لغة النص الأصلي: الإنجليزية

browser-agent

Browser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.

لغة النص الأصلي: الإنجليزية

browser-stealth-agent

Stealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture.…

لغة النص الأصلي: الإنجليزية

business-logic

Business Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role…

لغة النص الأصلي: الإنجليزية

chain-builder

Deep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.

لغة النص الأصلي: الإنجليزية

cloud-recon

Cloud misconfiguration scanner. Use for S3 bucket enumeration, Azure blob discovery, GCP storage checks, exposed cloud services, and cloud metadata analysis. Provide target domain or known cloud identifiers.

لغة النص الأصلي: الإنجليزية

config-auditor

Security header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS configuration assessment, cookie security, and server hardening checks. Provide target URL or list of URLs.

لغة النص الأصلي: الإنجليزية

correlator

Finding correlation engine. Use AFTER multiple agents have reported findings to discover attack chains. Combines individual findings into higher-impact chains (e.g., open redirect + CORS + SSRF = token theft). Run periodically or before final reporting.

لغة النص الأصلي: الإنجليزية

cors-hunter

CORS Misconfiguration specialist (H1 #58). Use for testing cross-origin resource sharing policies, origin reflection, null origin bypass, and credential-bearing cross-origin requests.

لغة النص الأصلي: الإنجليزية

csrf-hunter

CSRF specialist (H1 #57). Use for testing state-changing actions without proper token validation, SameSite cookie bypass, and CSRF in JSON/API endpoints.

لغة النص الأصلي: الإنجليزية

file-upload

File Upload vulnerability specialist (H1 #39). Use for testing upload restrictions, content-type bypass, extension filtering, path traversal in filenames, and web shell upload scenarios.

لغة النص الأصلي: الإنجليزية

graphql-audit

GraphQL API security specialist. Use for introspection analysis, query complexity attacks, injection testing, authorization bypass, and batching abuse on GraphQL endpoints.

لغة النص الأصلي: الإنجليزية

idor-hunter

IDOR / BOLA specialist (H1 #55, OWASP API1:2023). Use for testing insecure direct object references and broken object level authorization across web apps, APIs, GraphQL endpoints, multi-tenant SaaS, mobile, automotive/IoT, and AI inference servers.

لغة النص الأصلي: الإنجليزية

info-disclosure

Information Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive data: stack traces, debug endpoints, config files, environment variables, API keys, .git/.env exposure, Spring Actuator surfaces, source code leaks.…

لغة النص الأصلي: الإنجليزية

js-analyzer

JavaScript static analysis agent for client-side security review. Use for analyzing JS bundles, finding hardcoded secrets, tracing DOM XSS source-sink flows, identifying postMessage handlers, extracting API endpoints, and reviewing client-side access…

لغة النص الأصلي: الإنجليزية