| name | blackbox-web-audit |
| description | Authorized black-box web/API audit WITHOUT test accounts — unauth probing discipline, unauth-IDOR rounds using leaked IDs, JS-bundle-first attack surface mapping, non-destructive gates, and local report delivery conventions (no zip, follow sibling example folder). Use when asked to audit/pentest a target where you hold no credentials, and when writing the local report deliverable afterwards. |
Black-Box Web Audit Without Credentials
Class workflow for authorized audits where you have NO test account (operator-requested or VDP scope). Complements the manually-authored bb-methodology (5-phase workflow) and bug-bounty-reporting-workflow (validation standard) — load those too; this skill adds the no-credentials specifics they lack.
Hard Constraints (non-destructive discipline)
- GET-only on anything state-changing-adjacent. Shutdown/reset/redeem endpoints: probe with GET even if the app uses POST; NEVER send the real state-changing verb on production (a
POST /api/version/shutdown was deliberately never sent).
- Fake IDs for write-path probes. Create-order/payment endpoints tested only with nonexistent UUIDs; expect-and-document 401.
- Credentials are always fake for rate-limit/login tests. A quarantine of your own IP after 429 is evidence the control works — record it as such.
- Embedded keys found in bundles get tested live against their real API before any claim (Firebase:
identitytoolkit.googleapis.com/v1/accounts:createAuthUri?key= → 400 "API key not valid" = revoked, informational only).
Pre-Flight: Authorization Check
Before any probing, check for a public bug bounty program (HackerOne/Bugcrowd/Intigriti) and /.well-known/security.txt on apex + www. If NEITHER exists, downgrade to passive/non-intrusive observation only (CT logs, header analysis, unauth GETs) and state that explicitly in the report's legal-notes section — findings from active testing of a no-program target are unreportable and create liability.
