mastermind-bug-bounty

Methodology reference for Mastermind Bug Bounty runtime. Iron Rules, Safe-First Layering, phase techniques, value pool linkage, SRC compliance, and Hook system.

AI/LLM security testing specialist. Tests for prompt injection, jailbreak, MCP/Agent attacks, RAG poisoning, system prompt extraction, and tool/function call abuse. Optional phase.

API 发现与语义化 Fuzz 专家。基于 Recon 产出的 _endpoint_params.json （接口→参数需求映射表）和数据联动值池，执行全接口覆盖测试、响应挖掘、 参数注入和语义化 Fuzz。核心原则：用 JS 提取的参数需求 + 响应泄露的真实值 驱动测试，而不是盲目 fuzz。

Access control bypass specialist. Handles 401/403/405 responses using path manipulation, HTTP method switching, header injection, middleware-specific techniques, and JWT token attacks. Third phase in the pipeline.

★ AI 优势赛道 — 加密/编码攻击专家。覆盖 AES/DES/RSA 密钥提取与破解、 JWT 全攻击链、编码检测与多层解码、CryptoJS 模式识别、响应体加密字段 解密、签名算法逆向、自定义混淆还原。

★ Exploit + Report: vulnerability exploitation specialist. Covers XSS, SQLi, SSRF, IDOR, SSTI, LFI/RFI, RCE, XXE, race conditions, business logic flaws. Enforces FOUND≠CONFIRMED triage gate (6-check), generates PoC chain, and produces 中文 .docx HackerOne/SRC-format reports. Final required phase.

Reconnaissance specialist. 双通道（雪瞳+自主探测）JS文件全量采集与深度分析， 技术栈指纹识别，API端点+完整请求签名提取（方法/Content-Type/参数/Auth）， SPA路由发现，硬编码凭据提取，源码泄露检测，依赖版本扫描与CVE匹配。 产出: _endpoint_params.json + _secrets_found.json + _leaked_values.json 初始值池。

Report generation specialist. Converts triage-approved findings into HackerOne-format reports with CVSS scoring, PoC evidence chains, and remediation guidance. Final phase in the pipeline.

AI/LLM security testing methodology. Covers prompt injection, jailbreak, system prompt extraction, MCP/Agent attacks, RAG poisoning, tool/function call abuse, model extraction, and adversarial samples with full test vector library.

API semantic fuzzing payload templates. Provides intelligent payload selection based on parameter semantic type rather than blind fuzzing. Covers IDOR, SQLi, XSS, SSRF, SSTI, command injection, and business logic payloads.

401/403/405 authentication bypass techniques. Covers path manipulation, HTTP method switching, header injection, protocol downgrade, multi-position fuzzing, and middleware- specific bypass strategies with full payload dictionary.

Web Cache Poisoning detection and exploitation. Covers unkeyed headers, parameter cloaking, cache key normalization, XSS via cache, and DoS via cache. Targets: CDN (Cloudflare/Akamai/Fastly), reverse proxy (Varnish/Nginx), application-level caching (Redis/Memcached).

★ AI 优势赛道 — 加密算法识别、密钥提取与破解。覆盖 AES (CBC/ECB/GCM)、 DES/3DES、RSA、Base64/Hex/MD5/SHA 编码检测、CryptoJS 模式提取、 响应体加密绕过、自定义混淆逆向、JWT+AES 双重加密场景。

全接口覆盖测试 + 响应驱动参数注入方法论。强制规则：测试所有API端点， 从每个响应挖掘所有字段名和字段值，结合 JS 提取的参数需求表构建 双向映射（接口→参数名 ← 参数名→值），自动构造测试请求。 核心信条：A 接口返回的参数值 = B 接口的输入武器。永不停止。

Dependency version fingerprinting and CVE matching. Fastest ROI: identify framework/library versions from JS, headers, error pages, default paths, then match against known CVEs (Fastjson, Shiro, Log4j, Spring, Struts2, Laravel, etc.).

GraphQL API security testing v2. Coverage: introspection bypass (6 techniques), clairvoyance field brute-force, alias-based rate limit bypass, batch query IDOR, depth/cyclic query DoS, persisted queries bypass, field suggestion leak, and subscription hijacking.

HTTP Request Smuggling detection and exploitation. Covers CL.TE, TE.CL, TE.TE variants, front-end/back-end parsing discrepancies, WAF bypass via smuggling, and cache poisoning chaining. Uses burpsuite + fetch for timing and differential response analysis.

JS 文件全量采集与深度分析。双通道（雪瞳+自主探测）下载 JS，本地按域名组织， 逐文件深度读取提取完整请求签名（URL + Method + Content-Type + 参数名 + 是否必填 + Auth要求），构建接口-参数需求映射表，作为后续所有阶段的输入基础。

JWT (JSON Web Token) attack methodology. Covers Bearer removal bypass, algorithm confusion (alg:none / RS256→HS256 / empty sig), secret brute force with public wordlists + JS-extracted keywords, kid/jku/jwk header injection, claims manipulation, cross-service token reuse, JWKS endpoint analysis, and multi-role privilege escalation with post-exploitation chain.

OAuth 2.0 / OpenID Connect / SSO attack methodology. redirect_uri manipulation, state parameter bypass, CSRF on authorization endpoint, code/access_token interception, PKCE bypass, implicit flow hijack, and cross-tenant token reuse.

Passive reconnaissance: subdomain enumeration via crt.sh/DNS history, Shodan/Censys IP intelligence, favicon hash matching for tech stack, Wayback Machine URL history, WHOIS data. All free, no target contact.

Prototype Pollution detection and gadget chaining. Covers server-side (Node.js merge/deep-extend, Python class pollution) and client-side (DOM clobbering, DOMPurify bypass, jQuery deep-extend). Includes gadget chains for RCE via EJS/Pug/Handlebars and XSS via DOMPurify bypass.

竞态条件 / TOCTOU 深度测试。覆盖优惠券加倍使用、库存超卖、支付金额篡改、 提现并发、邀请码无限复用、签到积分翻倍、文件上传竞态、密码重置TOCTOU、 状态流转竞态。含 Go/Python 并发脚本模板，按场景分类（支付/库存/优惠券/注册）。

Source code leak detection via GitHub, Gitee, and search engine dorking. Uses tech stack fingerprints to construct targeted search queries for leaked source code, configs, and credentials.

Vulnerability class encyclopedia. Detection signals, exploitation techniques, and impact demonstration for XSS, SQLi, SSRF, IDOR, SSTI, path traversal, file upload, XXE, CSRF, CORS, prototype pollution, and business logic flaws.

WebSocket 安全测试。覆盖认证绕过（握手后换 token）、Cross-Site WebSocket Hijacking (CSWSH)、越权订阅（篡改 channel/room ID）、消息注入攻击、 WebSocket 重放攻击、连接耗尽 DoS。从 JS 中搜索 ws:// / wss:// / new WebSocket 定位端点。

Mastermind Bug Bounty workflow orchestrator. Drives the 6-phase bug bounty lifecycle with 6-Hook middleware. Pipeline: Recon → Dependency Scan → API Fuzz → Crypto Attack → Bypass → Exploit+Report. AI 优势赛道: API Fuzz (值池联动) + Crypto Attack (JWT/AES/编码).