security-methodology

name	security-methodology
description	Security research methodology — 5-phase workflow (intake → recon → enum → hunt → report). Routes to specialized technique modules. Use when the user asks to audit, penetration test, bug bounty, find vulnerabilities, exploit a target, or perform any security assessment.
argument-hint	<target or phase>
license	MIT
compatibility	Requires filesystem-based agent with bash, Python 3, and internet access.
allowed-tools	Bash Read Write Edit Glob Grep WebFetch WebSearch
metadata	{"user-invocable":"true","argument-hint":"<target-or-phase>"}

Security Research Methodology

Orchestration skill for security research. Routes to specialized technique modules based on target characteristics and attack surface signals.

Phase 1: Intake

Before any testing, confirm:

• In-scope targets (domains, IPs, endpoints)
• Out-of-scope restrictions
• Program rules (safe harbor, testing headers, payout tier)
• Timebox

Do not assume. If any field missing, ask.

Phase 2: Recon (Passive)

Zero packets to target. Sources: crt.sh, Wayback, GitHub dorks, Shodan, SecurityTrails, ASN mapping.

→ Load Passive Reconnaissance for technique details.

Phase 3: Enum (Active)

Port scan, service fingerprint, JS endpoint extraction, directory enumeration, virtual host discovery.

→ Load Active Enumeration for technique details. → If China vendor systems detected (Seeyon, Tongda, Weaver, Yonyou, Kingdee): load Vendor Fingerprints and Default Credentials.

Phase 4: Hunt

Match entry signals to attack modules:

Signal	Module	Primary Doc
HTTP/API/web app	/web-attacks	Web Attacks Index
Binary/ELF/PE, remote service crash	/binary-exploitation	Binary Index
Compiled binary, obfuscated code, firmware	/reverse-engineering	Reverse Index
RSA/AES/ECC/PRNG, encrypted data	/crypto-attacks	Crypto Index
PCAP, disk image, memory dump, stego	/forensics	Forensics Index
LLM agent, chatbot, ML model API	/ai-ml-security	AI/ML Index
Shell obtained, internal network	/post-exploitation	Post-Exploit Index
Suspicious binary, C2 traffic, script	/malware-analysis	Malware Index
Public information gathering, social media	/osint	OSINT Index
Encoding puzzle, sandbox jail, RF/SDR signal	/osint (no dedicated misc skill; docs in ../../10-misc/)	Misc Index

Payload discipline: Load payloads from Payload Library — do not generate from training memory. Bypass discipline: If payloads are blocked, load Bypass Toolkit.

Phase 5: Report

→ Load Evidence Discipline and Reporting. → Check Compliance before submitting.

When Stuck

• Don't know what to attack: Attack Prioritization
• Payloads being blocked: Bypass Toolkit
• Need real-world context: Attack Patterns

Priorities

• Auth bypass > Injection > SSRF > File read > XSS > Logic flaws
• Payloads from files, not from memory
• Evidence before conclusion: HTTP traces + screenshots