| name | recon-playbook |
| description | Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus. Use when the user asks "how do I hunt for X", "give me a methodology / checklist for X", "what should I test on a <tech> target", or wants a recon plan grounded in real disclosed bugs (e.g. SSRF, IDOR, rate-limit, cache deception, subdomain takeover, OAuth). |
recon-playbook
Turn the disclosed-report corpus into an actionable hunting playbook for a given
vuln class or target type.
Workflow
-
Gather precedent. Use the shared search helper to pull the relevant reports:
python3 .claude/skills/_lib/search_reports.py "<vuln class or tech>" --full --limit 30
Run a few variations (synonyms, related techniques). Read the highest-signal
reports in full when their Steps To Reproduce look detailed.
-
Extract patterns across the reports:
- Where the bug lived (endpoint shapes, parameters, headers, features).
- The exact trigger / payload / bypass that worked.
- Pre-conditions and the variations attackers tried before one worked.
- How impact was escalated.
-
Produce a playbook with these sections:
- Where to look — concrete endpoints, params, headers, features to probe.
- Test cases / payloads — ordered from quickest to most involved, with the
actual payloads/requests seen in reports.
- Bypass tricks — encodings, parser quirks, allowlist evasions that worked.
- Escalation — how to turn a weak signal into demonstrable impact.
- Tooling — what to use (Burp, ffuf, nuclei, custom scripts) per step.
- Precedent — bullet list of
#<id> — <title> the playbook draws from, each
with its reports/<file> path so the user can read the original.
Rules
- Ground every checklist item in at least one real report; cite the ID.
- Order the checklist by effort-to-payoff (cheap, high-signal checks first).
- Keep payloads copy-pasteable. Note pre-conditions explicitly.
- If the corpus has thin coverage for the class, say so and supplement with general
knowledge clearly labeled as not-from-corpus.
