elementalsouls

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI…

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP…

Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape…

Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass…

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…

Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map…

Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.

Master orchestrator for AI-agent red-team assessments — enterprise copilots, DevOps/SRE agents, RAG assistants, coding/IDE agents, MCP/A2A tool servers, autonomous workflow agents. Load at the START of any agent test, when facing a new agent target, or when…

Cross-cutting techniques for getting a payload past input/output guardrails — safety classifiers, refusal training, moderation filters, DLP. Encoding/obfuscation, Unicode-tag/ASCII smuggling, low-resource-language, adversarial suffixes (GCG), payload…

Trust/supply-chain attacks on the MCP tool ecosystem an agent connects to — tool-description injection, rug-pull (tool mutates after approval), cross-server tool shadowing, line-jumping/name collision, confused-deputy via a malicious tool, token/consent…

Persistent poisoning of an AI agent's long-term memory / stored profile / writable knowledge — so injected content survives across sessions (and sometimes across users) and re-fires without re-injection. Covers direct memory-write injection, indirect…

Command/code injection in AI-agent tools — shell, Python/JS eval, SQL, SSRF via fetch tools. Covers separators, the newline bypass and the shell-vs-agent-extraction ambiguity that decides whether substitution fires, denylist bypass, the exit-code oracle, and…

Authorization bypass in AI-agent tools — role/persona claims, unverifiable named-credential exceptions, privilege fields inside attacker-supplied credential documents, privilege escalation via prompt injection, data-classification override, and…

Attacks specific to computer-use and browser agents — agents that see a screen/DOM and act by clicking, typing, and navigating (AI browsers like Comet/Atlas, ChatGPT Operator, Claude Computer-Use, RPA copilots). Covers indirect injection through rendered page…

MCP (Model Context Protocol) exposure in AI agents: direct resource access, tool enumeration, missing auth, session/Origin issues, protocol-level abuse, and the delegated-identity OAuth flows an MCP proxy runs — confused-deputy auth-code theft, token…

Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths,…

Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secret_scan.py and h1_reference.py helpers, run sync-skill-content.sh, run the smoke test. Use when asked to run, build, test, validate, or smoke-test claude-osint or…

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound…

Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine…

Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that…

FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned…

Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf…

Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains -> owned netblocks/ASN -> live assets — with attribution discipline, not just DNS breadth. The org-first…

Use when planning or fixing multi-step work, software or process: decide how much orchestration it needs, design it, build it on any runtime or none, and verify the build matches the design. SOFTWARE: multi-agent system, agent workflow, pipeline, batch job,…

Review code as an adversary from a separate, clean context, so the agent that wrote it does not grade its own homework. Use at levels 3 and 4 when a reviewer is part of the design, before merging or shipping anything a model wrote, when a review keeps…

Clean the always-loaded context before a long build, so the agent is not reasoning from stale facts or rules that no longer apply. Use when starting a long or iterative task, when an agent keeps making the same wrong assumption, when it cites a file, count,…

Break an execution loop by explaining the failure in text before touching code again. Use when stuck in a loop, guessing, or repeatedly failing tests — when the same file has been edited three or more times without the error changing, when fixes are being…