pwn 0.5.613 → 0.5.617

data/documentation/diagrams/web-application-testing.svg

@@ -0,0 +1,173 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- Generated by graphviz version 14.1.2 (0)
+ -->
+<!-- Title: PWN_Web Pages: 1 -->
+<svg width="1092pt" height="360pt"
+ viewBox="0.00 0.00 1092.00 360.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(43.2 317.2)">
+<title>PWN_Web</title>
+<polygon fill="#0f172a" stroke="none" points="-43.2,43.2 -43.2,-317.2 1048.7,-317.2 1048.7,43.2 -43.2,43.2"/>
+<text xml:space="preserve" text-anchor="start" x="388.38" y="-252" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">Web Application Testing</text>
+<text xml:space="preserve" text-anchor="start" x="342.25" y="-240.55" font-family="sans-Serif" font-size="11.00" fill="#94a3b8">TransparentBrowser → BurpSuite (preferred) → SAST → Reports</text>
+<g id="clust1" class="cluster">
+<title>cluster_drive</title>
+<path fill="#022c22" stroke="#047857" d="M164.75,-8C164.75,-8 287.5,-8 287.5,-8 293.5,-8 299.5,-14 299.5,-20 299.5,-20 299.5,-215 299.5,-215 299.5,-221 293.5,-227 287.5,-227 287.5,-227 164.75,-227 164.75,-227 158.75,-227 152.75,-221 152.75,-215 152.75,-215 152.75,-20 152.75,-20 152.75,-14 158.75,-8 164.75,-8"/>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-204" font-family="sans-Serif" font-size="20.00" fill="#a7f3d0">Drive Traffic</text>
+</g>
+<g id="clust2" class="cluster">
+<title>cluster_proxy</title>
+<path fill="#422006" stroke="#a16207" d="M467.75,-8C467.75,-8 605.25,-8 605.25,-8 611.25,-8 617.25,-14 617.25,-20 617.25,-20 617.25,-147 617.25,-147 617.25,-153 611.25,-159 605.25,-159 605.25,-159 467.75,-159 467.75,-159 461.75,-159 455.75,-153 455.75,-147 455.75,-147 455.75,-20 455.75,-20 455.75,-14 461.75,-8 467.75,-8"/>
+<text xml:space="preserve" text-anchor="middle" x="536.5" y="-136" font-family="sans-Serif" font-size="20.00" fill="#fde68a">Intercept + Scan</text>
+</g>
+<g id="clust3" class="cluster">
+<title>cluster_deep</title>
+<path fill="#2e1065" stroke="#6d28d9" d="M700.25,-8C700.25,-8 819,-8 819,-8 825,-8 831,-14 831,-20 831,-20 831,-215 831,-215 831,-221 825,-227 819,-227 819,-227 700.25,-227 700.25,-227 694.25,-227 688.25,-221 688.25,-215 688.25,-215 688.25,-20 688.25,-20 688.25,-14 694.25,-8 700.25,-8"/>
+<text xml:space="preserve" text-anchor="middle" x="759.62" y="-204" font-family="sans-Serif" font-size="20.00" fill="#ddd6fe">Deep Analysis</text>
+</g>
+<!-- Target -->
+<g id="node1" class="node">
+<title>Target</title>
+<path fill="#fda4af" stroke="#334155" stroke-width="1.3" d="M61.75,-120C61.75,-120 12,-120 12,-120 6,-120 0,-114 0,-108 0,-108 0,-96 0,-96 0,-90 6,-84 12,-84 12,-84 61.75,-84 61.75,-84 67.75,-84 73.75,-90 73.75,-96 73.75,-96 73.75,-108 73.75,-108 73.75,-114 67.75,-120 61.75,-120"/>
+<text xml:space="preserve" text-anchor="middle" x="36.88" y="-104.88" font-family="sans-Serif" font-size="10.00" fill="#0f172a">🌐 &#160;Web App</text>
+<text xml:space="preserve" text-anchor="middle" x="36.88" y="-92.12" font-family="sans-Serif" font-size="10.00" fill="#0f172a">URL / API</text>
+</g>
+<!-- TB -->
+<g id="node2" class="node">
+<title>TB</title>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M279.5,-188C279.5,-188 172.75,-188 172.75,-188 166.75,-188 160.75,-182 160.75,-176 160.75,-176 160.75,-164 160.75,-164 160.75,-158 166.75,-152 172.75,-152 172.75,-152 279.5,-152 279.5,-152 285.5,-152 291.5,-158 291.5,-164 291.5,-164 291.5,-176 291.5,-176 291.5,-182 285.5,-188 279.5,-188"/>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-172.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">TransparentBrowser</text>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-160.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">headless · watir · devtools</text>
+</g>
+<!-- Target&#45;&gt;TB -->
+<g id="edge1" class="edge">
+<title>Target&#45;&gt;TB</title>
+<path fill="none" stroke="#fb7185" stroke-width="1.3" d="M73.98,-115.11C99.69,-124.45 134.86,-137.22 164.8,-148.09"/>
+<polygon fill="#fb7185" stroke="#fb7185" stroke-width="1.3" points="163.59,-150.63 172.06,-150.73 165.5,-145.37 163.59,-150.63"/>
+</g>
+<!-- Spider -->
+<g id="node3" class="node">
+<title>Spider</title>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M255.12,-120C255.12,-120 197.12,-120 197.12,-120 191.12,-120 185.12,-114 185.12,-108 185.12,-108 185.12,-96 185.12,-96 185.12,-90 191.12,-84 197.12,-84 197.12,-84 255.12,-84 255.12,-84 261.12,-84 267.12,-90 267.12,-96 267.12,-96 267.12,-108 267.12,-108 267.12,-114 261.12,-120 255.12,-120"/>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-104.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Plugins::Spider</text>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-92.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">URI buster</text>
+</g>
+<!-- Target&#45;&gt;Spider -->
+<g id="edge2" class="edge">
+<title>Target&#45;&gt;Spider</title>
+<path fill="none" stroke="#fb7185" stroke-width="1.3" d="M73.98,-102C102.68,-102 143.15,-102 175,-102"/>
+<polygon fill="#fb7185" stroke="#fb7185" stroke-width="1.3" points="174.61,-104.8 182.61,-102 174.61,-99.2 174.61,-104.8"/>
+</g>
+<!-- WWW -->
+<g id="node4" class="node">
+<title>WWW</title>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M256.25,-52C256.25,-52 196,-52 196,-52 190,-52 184,-46 184,-40 184,-40 184,-28 184,-28 184,-22 190,-16 196,-16 196,-16 256.25,-16 256.25,-16 262.25,-16 268.25,-22 268.25,-28 268.25,-28 268.25,-40 268.25,-40 268.25,-46 262.25,-52 256.25,-52"/>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-36.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">PWN::WWW::*</text>
+<text xml:space="preserve" text-anchor="middle" x="226.12" y="-24.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">21 site drivers</text>
+</g>
+<!-- Target&#45;&gt;WWW -->
+<g id="edge3" class="edge">
+<title>Target&#45;&gt;WWW</title>
+<path fill="none" stroke="#fb7185" stroke-width="1.3" d="M73.98,-88.89C102.51,-78.53 142.69,-63.94 174.44,-52.41"/>
+<polygon fill="#fb7185" stroke="#fb7185" stroke-width="1.3" points="175.17,-55.12 181.73,-49.76 173.26,-49.86 175.17,-55.12"/>
+</g>
+<!-- Burp -->
+<g id="node5" class="node">
+<title>Burp</title>
+<path fill="#fcd34d" stroke="#334155" stroke-width="2" d="M584.5,-120C584.5,-120 487.5,-120 487.5,-120 481.5,-120 475.5,-114 475.5,-108 475.5,-108 475.5,-96 475.5,-96 475.5,-90 481.5,-84 487.5,-84 487.5,-84 584.5,-84 584.5,-84 590.5,-84 596.5,-90 596.5,-96 596.5,-96 596.5,-108 596.5,-108 596.5,-114 590.5,-120 584.5,-120"/>
+<text xml:space="preserve" text-anchor="middle" x="536" y="-104.88" font-family="sans-Serif" font-size="10.00" fill="#0f172a">BurpSuite &#160;⭐</text>
+<text xml:space="preserve" text-anchor="middle" x="536" y="-92.12" font-family="sans-Serif" font-size="10.00" fill="#0f172a">active · passive · REST</text>
+</g>
+<!-- TB&#45;&gt;Burp -->
+<g id="edge4" class="edge">
+<title>TB&#45;&gt;Burp</title>
+<path fill="none" stroke="#f59e0b" stroke-width="2" d="M292.04,-155.66C342.46,-144.53 412.3,-129.1 464.17,-117.65"/>
+<polygon fill="#f59e0b" stroke="#f59e0b" stroke-width="2" points="464.45,-120.45 471.66,-115.99 463.25,-114.98 464.45,-120.45"/>
+<text xml:space="preserve" text-anchor="middle" x="377.62" y="-148.01" font-family="sans-Serif" font-size="9.00" fill="#cbd5e1">proxy 127.0.0.1:8080</text>
+</g>
+<!-- Spider&#45;&gt;Burp -->
+<g id="edge5" class="edge">
+<title>Spider&#45;&gt;Burp</title>
+<path fill="none" stroke="#f59e0b" stroke-width="1.3" d="M267.69,-102C317.81,-102 403.89,-102 464.81,-102"/>
+<polygon fill="#f59e0b" stroke="#f59e0b" stroke-width="1.3" points="464.78,-104.8 472.78,-102 464.78,-99.2 464.78,-104.8"/>
+</g>
+<!-- Zap -->
+<g id="node6" class="node">
+<title>Zap</title>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M551.88,-52C551.88,-52 520.12,-52 520.12,-52 514.12,-52 508.12,-46 508.12,-40 508.12,-40 508.12,-28 508.12,-28 508.12,-22 514.12,-16 520.12,-16 520.12,-16 551.88,-16 551.88,-16 557.88,-16 563.88,-22 563.88,-28 563.88,-28 563.88,-40 563.88,-40 563.88,-46 557.88,-52 551.88,-52"/>
+<text xml:space="preserve" text-anchor="middle" x="536" y="-36.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Zaproxy</text>
+<text xml:space="preserve" text-anchor="middle" x="536" y="-24.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">(fallback)</text>
+</g>
+<!-- WWW&#45;&gt;Zap -->
+<g id="edge6" class="edge">
+<title>WWW&#45;&gt;Zap</title>
+<path fill="none" stroke="#f59e0b" stroke-width="1.3" d="M268.65,-34C329.03,-34 440.17,-34 497.94,-34"/>
+<polygon fill="#f59e0b" stroke="#f59e0b" stroke-width="1.3" points="497.77,-36.8 505.77,-34 497.77,-31.2 497.77,-36.8"/>
+</g>
+<!-- SAST -->
+<g id="node7" class="node">
+<title>SAST</title>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M795.25,-188C795.25,-188 723,-188 723,-188 717,-188 711,-182 711,-176 711,-176 711,-164 711,-164 711,-158 717,-152 723,-152 723,-152 795.25,-152 795.25,-152 801.25,-152 807.25,-158 807.25,-164 807.25,-164 807.25,-176 807.25,-176 807.25,-182 801.25,-188 795.25,-188"/>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-172.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">PWN::SAST</text>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-160.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">48 rules on source</text>
+</g>
+<!-- Burp&#45;&gt;SAST -->
+<g id="edge7" class="edge">
+<title>Burp&#45;&gt;SAST</title>
+<path fill="none" stroke="#a78bfa" stroke-width="1.3" d="M597.42,-120.58C629.78,-130.53 669.4,-142.72 701.21,-152.5"/>
+<polygon fill="#a78bfa" stroke="#a78bfa" stroke-width="1.3" points="700.03,-155.06 708.5,-154.74 701.68,-149.71 700.03,-155.06"/>
+</g>
+<!-- XSS -->
+<g id="node8" class="node">
+<title>XSS</title>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M805.38,-120C805.38,-120 712.88,-120 712.88,-120 706.88,-120 700.88,-114 700.88,-108 700.88,-108 700.88,-96 700.88,-96 700.88,-90 706.88,-84 712.88,-84 712.88,-84 805.38,-84 805.38,-84 811.38,-84 817.38,-90 817.38,-96 817.38,-96 817.38,-108 817.38,-108 817.38,-114 811.38,-120 805.38,-120"/>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-104.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">pwn_xss_dom_vectors</text>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-92.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">web_cache_deception</text>
+</g>
+<!-- Burp&#45;&gt;XSS -->
+<g id="edge8" class="edge">
+<title>Burp&#45;&gt;XSS</title>
+<path fill="none" stroke="#a78bfa" stroke-width="1.3" d="M597.42,-102C626.26,-102 660.87,-102 690.57,-102"/>
+<polygon fill="#a78bfa" stroke="#a78bfa" stroke-width="1.3" points="690.47,-104.8 698.47,-102 690.47,-99.2 690.47,-104.8"/>
+</g>
+<!-- API -->
+<g id="node9" class="node">
+<title>API</title>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M803.5,-52C803.5,-52 714.75,-52 714.75,-52 708.75,-52 702.75,-46 702.75,-40 702.75,-40 702.75,-28 702.75,-28 702.75,-22 708.75,-16 714.75,-16 714.75,-16 803.5,-16 803.5,-16 809.5,-16 815.5,-22 815.5,-28 815.5,-28 815.5,-40 815.5,-40 815.5,-46 809.5,-52 803.5,-52"/>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-36.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Plugins::OpenAPI</text>
+<text xml:space="preserve" text-anchor="middle" x="759.12" y="-24.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">GraphQL introspection</text>
+</g>
+<!-- Zap&#45;&gt;API -->
+<g id="edge9" class="edge">
+<title>Zap&#45;&gt;API</title>
+<path fill="none" stroke="#a78bfa" stroke-width="1.3" d="M564.11,-34C595.89,-34 649.65,-34 692.54,-34"/>
+<polygon fill="#a78bfa" stroke="#a78bfa" stroke-width="1.3" points="692.38,-36.8 700.38,-34 692.38,-31.2 692.38,-36.8"/>
+</g>
+<!-- Report -->
+<g id="node10" class="node">
+<title>Report</title>
+<path fill="#7dd3fc" stroke="#334155" stroke-width="1.3" d="M993.5,-120C993.5,-120 922,-120 922,-120 916,-120 910,-114 910,-108 910,-108 910,-96 910,-96 910,-90 916,-84 922,-84 922,-84 993.5,-84 993.5,-84 999.5,-84 1005.5,-90 1005.5,-96 1005.5,-96 1005.5,-108 1005.5,-108 1005.5,-114 999.5,-120 993.5,-120"/>
+<text xml:space="preserve" text-anchor="middle" x="957.75" y="-104.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">PWN::Reports</text>
+<text xml:space="preserve" text-anchor="middle" x="957.75" y="-92.5" font-family="sans-Serif" font-size="10.00" fill="#0f172a">DefectDojo import</text>
+</g>
+<!-- SAST&#45;&gt;Report -->
+<g id="edge10" class="edge">
+<title>SAST&#45;&gt;Report</title>
+<path fill="none" stroke="#38bdf8" stroke-width="1.3" d="M807.72,-153.54C835.62,-143.89 871.01,-131.65 900.31,-121.52"/>
+<polygon fill="#38bdf8" stroke="#38bdf8" stroke-width="1.3" points="901.09,-124.21 907.73,-118.95 899.26,-118.92 901.09,-124.21"/>
+</g>
+<!-- XSS&#45;&gt;Report -->
+<g id="edge11" class="edge">
+<title>XSS&#45;&gt;Report</title>
+<path fill="none" stroke="#38bdf8" stroke-width="1.3" d="M817.79,-102C843.71,-102 874.21,-102 900.03,-102"/>
+<polygon fill="#38bdf8" stroke="#38bdf8" stroke-width="1.3" points="899.7,-104.8 907.7,-102 899.7,-99.2 899.7,-104.8"/>
+</g>
+<!-- API&#45;&gt;Report -->
+<g id="edge12" class="edge">
+<title>API&#45;&gt;Report</title>
+<path fill="none" stroke="#38bdf8" stroke-width="1.3" d="M813.85,-52.58C840.6,-61.83 872.94,-73.02 900.08,-82.4"/>
+<polygon fill="#38bdf8" stroke="#38bdf8" stroke-width="1.3" points="899.11,-85.03 907.59,-85 900.95,-79.74 899.11,-85.03"/>
+</g>
+</g>
+</svg>

data/documentation/diagrams/zero-day-research-flow.svg

@@ -0,0 +1,153 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- Generated by graphviz version 14.1.2 (0)
+ -->
+<!-- Title: PWN_ZeroDay Pages: 1 -->
+<svg width="1064pt" height="309pt"
+ viewBox="0.00 0.00 1064.00 309.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(43.2 265.39)">
+<title>PWN_ZeroDay</title>
+<polygon fill="#0f172a" stroke="none" points="-43.2,43.2 -43.2,-265.39 1021.2,-265.39 1021.2,43.2 -43.2,43.2"/>
+<text xml:space="preserve" text-anchor="start" x="304.5" y="-200.19" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">Zero&#45;Day Research Lifecycle with PWN</text>
+<text xml:space="preserve" text-anchor="start" x="337.12" y="-188.74" font-family="sans-Serif" font-size="11.00" fill="#94a3b8">attack surface → hypothesis → prove → weaponise → disclose</text>
+<g id="clust1" class="cluster">
+<title>cluster_hyp</title>
+<path fill="#022c22" stroke="#047857" d="M210.5,-24.19C210.5,-24.19 312,-24.19 312,-24.19 318,-24.19 324,-30.19 324,-36.19 324,-36.19 324,-163.19 324,-163.19 324,-169.19 318,-175.19 312,-175.19 312,-175.19 210.5,-175.19 210.5,-175.19 204.5,-175.19 198.5,-169.19 198.5,-163.19 198.5,-163.19 198.5,-36.19 198.5,-36.19 198.5,-30.19 204.5,-24.19 210.5,-24.19"/>
+<text xml:space="preserve" text-anchor="middle" x="261.25" y="-152.19" font-family="sans-Serif" font-size="20.00" fill="#a7f3d0">Hypothesise</text>
+</g>
+<g id="clust2" class="cluster">
+<title>cluster_prove</title>
+<path fill="#422006" stroke="#a16207" d="M407,-24.19C407,-24.19 502.75,-24.19 502.75,-24.19 508.75,-24.19 514.75,-30.19 514.75,-36.19 514.75,-36.19 514.75,-163.19 514.75,-163.19 514.75,-169.19 508.75,-175.19 502.75,-175.19 502.75,-175.19 407,-175.19 407,-175.19 401,-175.19 395,-169.19 395,-163.19 395,-163.19 395,-36.19 395,-36.19 395,-30.19 401,-24.19 407,-24.19"/>
+<text xml:space="preserve" text-anchor="middle" x="454.88" y="-152.19" font-family="sans-Serif" font-size="20.00" fill="#fde68a">Prove</text>
+</g>
+<g id="clust3" class="cluster">
+<title>cluster_weapon</title>
+<path fill="#450a0a" stroke="#b91c1c" d="M674.75,-24.19C674.75,-24.19 767.25,-24.19 767.25,-24.19 773.25,-24.19 779.25,-30.19 779.25,-36.19 779.25,-36.19 779.25,-163.19 779.25,-163.19 779.25,-169.19 773.25,-175.19 767.25,-175.19 767.25,-175.19 674.75,-175.19 674.75,-175.19 668.75,-175.19 662.75,-169.19 662.75,-163.19 662.75,-163.19 662.75,-36.19 662.75,-36.19 662.75,-30.19 668.75,-24.19 674.75,-24.19"/>
+<text xml:space="preserve" text-anchor="middle" x="721" y="-152.19" font-family="sans-Serif" font-size="20.00" fill="#fecaca">Weaponise</text>
+</g>
+<g id="clust4" class="cluster">
+<title>cluster_disc</title>
+<path fill="#2e1065" stroke="#6d28d9" d="M862.25,-24.19C862.25,-24.19 958,-24.19 958,-24.19 964,-24.19 970,-30.19 970,-36.19 970,-36.19 970,-163.19 970,-163.19 970,-169.19 964,-175.19 958,-175.19 958,-175.19 862.25,-175.19 862.25,-175.19 856.25,-175.19 850.25,-169.19 850.25,-163.19 850.25,-163.19 850.25,-36.19 850.25,-36.19 850.25,-30.19 856.25,-24.19 862.25,-24.19"/>
+<text xml:space="preserve" text-anchor="middle" x="910.12" y="-152.19" font-family="sans-Serif" font-size="20.00" fill="#ddd6fe">Disclose</text>
+</g>
+<!-- Surface -->
+<g id="node1" class="node">
+<title>Surface</title>
+<path fill="#7dd3fc" stroke="#334155" stroke-width="1.3" d="M107.5,-101.19C107.5,-101.19 12,-101.19 12,-101.19 6,-101.19 0,-95.19 0,-89.19 0,-89.19 0,-77.19 0,-77.19 0,-71.19 6,-65.19 12,-65.19 12,-65.19 107.5,-65.19 107.5,-65.19 113.5,-65.19 119.5,-71.19 119.5,-77.19 119.5,-77.19 119.5,-89.19 119.5,-89.19 119.5,-95.19 113.5,-101.19 107.5,-101.19"/>
+<text xml:space="preserve" text-anchor="middle" x="59.75" y="-85.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Attack Surface</text>
+<text xml:space="preserve" text-anchor="middle" x="59.75" y="-73.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">OpenAPI · Shodan · Git</text>
+</g>
+<!-- SAST -->
+<g id="node2" class="node">
+<title>SAST</title>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M285.25,-136.19C285.25,-136.19 236.25,-136.19 236.25,-136.19 230.25,-136.19 224.25,-130.19 224.25,-124.19 224.25,-124.19 224.25,-112.19 224.25,-112.19 224.25,-106.19 230.25,-100.19 236.25,-100.19 236.25,-100.19 285.25,-100.19 285.25,-100.19 291.25,-100.19 297.25,-106.19 297.25,-112.19 297.25,-112.19 297.25,-124.19 297.25,-124.19 297.25,-130.19 291.25,-136.19 285.25,-136.19"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-120.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">PWN::SAST</text>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-108.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">taint patterns</text>
+</g>
+<!-- Surface&#45;&gt;SAST -->
+<g id="edge1" class="edge">
+<title>Surface&#45;&gt;SAST</title>
+<path fill="none" stroke="#38bdf8" stroke-width="1.3" d="M119.92,-93.59C150.05,-98.89 186.12,-105.24 214.08,-110.16"/>
+<polygon fill="#38bdf8" stroke="#38bdf8" stroke-width="1.3" points="213.3,-112.86 221.67,-111.49 214.27,-107.35 213.3,-112.86"/>
+</g>
+<!-- AI -->
+<g id="node3" class="node">
+<title>AI</title>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M291.25,-68.19C291.25,-68.19 230.25,-68.19 230.25,-68.19 224.25,-68.19 218.25,-62.19 218.25,-56.19 218.25,-56.19 218.25,-44.19 218.25,-44.19 218.25,-38.19 224.25,-32.19 230.25,-32.19 230.25,-32.19 291.25,-32.19 291.25,-32.19 297.25,-32.19 303.25,-38.19 303.25,-44.19 303.25,-44.19 303.25,-56.19 303.25,-56.19 303.25,-62.19 297.25,-68.19 291.25,-68.19"/>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-52.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">pwn&#45;ai</text>
+<text xml:space="preserve" text-anchor="middle" x="260.75" y="-40.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Agent::VulnGen</text>
+</g>
+<!-- Surface&#45;&gt;AI -->
+<g id="edge2" class="edge">
+<title>Surface&#45;&gt;AI</title>
+<path fill="none" stroke="#38bdf8" stroke-width="1.3" d="M119.92,-73.38C147.98,-68.72 181.19,-63.22 208.2,-58.74"/>
+<polygon fill="#38bdf8" stroke="#38bdf8" stroke-width="1.3" points="208.48,-61.53 215.91,-57.46 207.56,-56 208.48,-61.53"/>
+</g>
+<!-- Fuzz -->
+<g id="node4" class="node">
+<title>Fuzz</title>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M477.5,-136.19C477.5,-136.19 432.25,-136.19 432.25,-136.19 426.25,-136.19 420.25,-130.19 420.25,-124.19 420.25,-124.19 420.25,-112.19 420.25,-112.19 420.25,-106.19 426.25,-100.19 432.25,-100.19 432.25,-100.19 477.5,-100.19 477.5,-100.19 483.5,-100.19 489.5,-106.19 489.5,-112.19 489.5,-112.19 489.5,-124.19 489.5,-124.19 489.5,-130.19 483.5,-136.19 477.5,-136.19"/>
+<text xml:space="preserve" text-anchor="middle" x="454.88" y="-120.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Fuzz · Sock</text>
+<text xml:space="preserve" text-anchor="middle" x="454.88" y="-108.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Packet</text>
+</g>
+<!-- SAST&#45;&gt;Fuzz -->
+<g id="edge3" class="edge">
+<title>SAST&#45;&gt;Fuzz</title>
+<path fill="none" stroke="#f59e0b" stroke-width="1.3" d="M297.89,-118.19C329.74,-118.19 376.24,-118.19 410.18,-118.19"/>
+<polygon fill="#f59e0b" stroke="#f59e0b" stroke-width="1.3" points="409.87,-120.99 417.87,-118.19 409.87,-115.39 409.87,-120.99"/>
+</g>
+<!-- TB -->
+<g id="node5" class="node">
+<title>TB</title>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M494.75,-68.19C494.75,-68.19 415,-68.19 415,-68.19 409,-68.19 403,-62.19 403,-56.19 403,-56.19 403,-44.19 403,-44.19 403,-38.19 409,-32.19 415,-32.19 415,-32.19 494.75,-32.19 494.75,-32.19 500.75,-32.19 506.75,-38.19 506.75,-44.19 506.75,-44.19 506.75,-56.19 506.75,-56.19 506.75,-62.19 500.75,-68.19 494.75,-68.19"/>
+<text xml:space="preserve" text-anchor="middle" x="454.88" y="-52.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">TransparentBrowser</text>
+<text xml:space="preserve" text-anchor="middle" x="454.88" y="-40.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Burp replay</text>
+</g>
+<!-- AI&#45;&gt;TB -->
+<g id="edge4" class="edge">
+<title>AI&#45;&gt;TB</title>
+<path fill="none" stroke="#f59e0b" stroke-width="1.3" d="M303.44,-50.19C329.61,-50.19 363.82,-50.19 393,-50.19"/>
+<polygon fill="#f59e0b" stroke="#f59e0b" stroke-width="1.3" points="392.72,-52.99 400.72,-50.19 392.72,-47.39 392.72,-52.99"/>
+</g>
+<!-- Asm -->
+<g id="node6" class="node">
+<title>Asm</title>
+<path fill="#fda4af" stroke="#334155" stroke-width="1.3" d="M758.5,-136.19C758.5,-136.19 682.5,-136.19 682.5,-136.19 676.5,-136.19 670.5,-130.19 670.5,-124.19 670.5,-124.19 670.5,-112.19 670.5,-112.19 670.5,-106.19 676.5,-100.19 682.5,-100.19 682.5,-100.19 758.5,-100.19 758.5,-100.19 764.5,-100.19 770.5,-106.19 770.5,-112.19 770.5,-112.19 770.5,-124.19 770.5,-124.19 770.5,-130.19 764.5,-136.19 758.5,-136.19"/>
+<text xml:space="preserve" text-anchor="middle" x="720.5" y="-120.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Assembly</text>
+<text xml:space="preserve" text-anchor="middle" x="720.5" y="-108.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">pwn&#45;asm shellcode</text>
+</g>
+<!-- Fuzz&#45;&gt;Asm -->
+<g id="edge5" class="edge">
+<title>Fuzz&#45;&gt;Asm</title>
+<path fill="none" stroke="#fb7185" stroke-width="1.3" d="M490.07,-118.19C533.13,-118.19 607.81,-118.19 660.24,-118.19"/>
+<polygon fill="#fb7185" stroke="#fb7185" stroke-width="1.3" points="660.12,-120.99 668.12,-118.19 660.12,-115.39 660.12,-120.99"/>
+</g>
+<!-- MSF -->
+<g id="node7" class="node">
+<title>MSF</title>
+<path fill="#fda4af" stroke="#334155" stroke-width="1.3" d="M739,-68.19C739,-68.19 702,-68.19 702,-68.19 696,-68.19 690,-62.19 690,-56.19 690,-56.19 690,-44.19 690,-44.19 690,-38.19 696,-32.19 702,-32.19 702,-32.19 739,-32.19 739,-32.19 745,-32.19 751,-38.19 751,-44.19 751,-44.19 751,-56.19 751,-56.19 751,-62.19 745,-68.19 739,-68.19"/>
+<text xml:space="preserve" text-anchor="middle" x="720.5" y="-52.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Metasploit</text>
+<text xml:space="preserve" text-anchor="middle" x="720.5" y="-40.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">module</text>
+</g>
+<!-- TB&#45;&gt;MSF -->
+<g id="edge6" class="edge">
+<title>TB&#45;&gt;MSF</title>
+<path fill="none" stroke="#fb7185" stroke-width="1.3" d="M507.33,-50.19C557.76,-50.19 633.56,-50.19 679.6,-50.19"/>
+<polygon fill="#fb7185" stroke="#fb7185" stroke-width="1.3" points="679.54,-52.99 687.54,-50.19 679.54,-47.39 679.54,-52.99"/>
+</g>
+<!-- H1 -->
+<g id="node8" class="node">
+<title>H1</title>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M950,-136.19C950,-136.19 870.25,-136.19 870.25,-136.19 864.25,-136.19 858.25,-130.19 858.25,-124.19 858.25,-124.19 858.25,-112.19 858.25,-112.19 858.25,-106.19 864.25,-100.19 870.25,-100.19 870.25,-100.19 950,-100.19 950,-100.19 956,-100.19 962,-106.19 962,-112.19 962,-112.19 962,-124.19 962,-124.19 962,-130.19 956,-136.19 950,-136.19"/>
+<text xml:space="preserve" text-anchor="middle" x="910.12" y="-120.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">HackerOne</text>
+<text xml:space="preserve" text-anchor="middle" x="910.12" y="-108.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">BugCrowd · Synack</text>
+</g>
+<!-- Asm&#45;&gt;H1 -->
+<g id="edge7" class="edge">
+<title>Asm&#45;&gt;H1</title>
+<path fill="none" stroke="#a78bfa" stroke-width="1.3" d="M770.8,-118.19C794.47,-118.19 823.07,-118.19 848.11,-118.19"/>
+<polygon fill="#a78bfa" stroke="#a78bfa" stroke-width="1.3" points="847.9,-120.99 855.9,-118.19 847.9,-115.39 847.9,-120.99"/>
+</g>
+<!-- Rep -->
+<g id="node9" class="node">
+<title>Rep</title>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M939.88,-68.19C939.88,-68.19 880.38,-68.19 880.38,-68.19 874.38,-68.19 868.38,-62.19 868.38,-56.19 868.38,-56.19 868.38,-44.19 868.38,-44.19 868.38,-38.19 874.38,-32.19 880.38,-32.19 880.38,-32.19 939.88,-32.19 939.88,-32.19 945.88,-32.19 951.88,-38.19 951.88,-44.19 951.88,-44.19 951.88,-56.19 951.88,-56.19 951.88,-62.19 945.88,-68.19 939.88,-68.19"/>
+<text xml:space="preserve" text-anchor="middle" x="910.12" y="-52.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">Reports · Skills</text>
+<text xml:space="preserve" text-anchor="middle" x="910.12" y="-40.69" font-family="sans-Serif" font-size="10.00" fill="#0f172a">distill_skill</text>
+</g>
+<!-- MSF&#45;&gt;Rep -->
+<g id="edge8" class="edge">
+<title>MSF&#45;&gt;Rep</title>
+<path fill="none" stroke="#a78bfa" stroke-width="1.3" d="M751.65,-50.19C780.31,-50.19 823.98,-50.19 858.07,-50.19"/>
+<polygon fill="#a78bfa" stroke="#a78bfa" stroke-width="1.3" points="857.9,-52.99 865.9,-50.19 857.9,-47.39 857.9,-52.99"/>
+</g>
+<!-- Rep&#45;&gt;AI -->
+<g id="edge9" class="edge">
+<title>Rep&#45;&gt;AI</title>
+<path fill="none" stroke="#fbbf24" stroke-width="1.3" stroke-dasharray="5,2" d="M867.84,-36.49C842.58,-28.83 809.42,-20.07 779.25,-16.19 609.87,5.62 564.45,5.09 395,-16.19 367.6,-19.63 337.77,-26.9 313.29,-33.84"/>
+<polygon fill="#fbbf24" stroke="#fbbf24" stroke-width="1.3" points="312.63,-31.11 305.73,-36.03 314.19,-36.49 312.63,-31.11"/>
+<text xml:space="preserve" text-anchor="middle" x="588.75" y="-2.92" font-family="sans-Serif" font-size="9.00" fill="#cbd5e1">lesson → next hunt</text>
+</g>
+</g>
+</svg>

data/documentation/pwn-REPL.md

@@ -0,0 +1,33 @@
+# The pwn REPL
+
+The `pwn` command launches a Pry-based interactive Ruby shell with the entire `PWN` namespace pre-loaded.
+
+## Starting
+
+```bash
+pwn
+pwn[v0.5.613]:001 >>>
+```
+
+## Key Features
+
+- Direct access to every `PWN::` constant and plugin.
+- Tab completion for classes and methods.
+- Multi-line support.
+- Easy prototyping of security workflows.
+- `PWN.help` and inspection of any object.
+
+## Useful REPL Commands
+
+```
+pwn[v0.5.613]:001 >>> PWN::Plugins.constants.sort
+pwn[v0.5.613]:001 >>> PWN::Plugins::BurpSuite.methods(false).sort
+pwn[v0.5.613]:001 >>> PWN::SAST.constants
+pwn[v0.5.613]:001 >>> pwn-ai
+```
+
+See:
+- [pwn-ai Agent](pwn-ai-Agent.md) — the killer feature inside the REPL
+- [General Usage](General-PWN-Usage.md)
+
+[[Diagrams]]

data/documentation/pwn-ai-Agent.md

@@ -0,0 +1,43 @@
+# pwn-ai Autonomous Agent
+
+The most powerful way to use PWN is via the `pwn-ai` command inside the REPL.
+
+## Activation
+
+```bash
+pwn[v0.5.613]:001 >>> pwn-ai
+[*] pwn-ai agent TUI activated...
+>
+```
+
+## Capabilities
+
+- Natural language instruction of complex multi-step security tasks.
+- Full tool calling access to:
+  - All `PWN::Plugins` (BurpSuite preferred, TransparentBrowser, NmapIt, Shodan, Metasploit, etc.)
+  - `PWN::SAST`
+  - `PWN::Reports`
+  - Shell execution
+  - Memory recall / remember
+  - Skill usage and distillation
+  - Learning / introspection loop
+- Persistent context across interactions via memory and skills.
+
+## Tips
+
+- Use `SHIFT+ENTER` to insert newlines.
+- `ENTER` submits the prompt.
+- Type `back` or `exit` to return to normal REPL.
+- Example prompt:
+  ```
+  Scan https://target with NmapIt + TransparentBrowser (via BurpSuite), 
+  run relevant SAST if source present, exploit any findings, generate report.
+  ```
+
+## Self-Improvement
+
+Successful workflows can be distilled into reusable **Skills** (see [Skills-Memory-Learning](Skills-Memory-Learning.md)).
+
+See also [AI Integration](AI-Integration.md).
+
+[[Diagrams]]

data/git_commit.sh

@@ -37,7 +37,7 @@ if (( $# == 3 )); then
   fi
 
   # Generate RDoc JSONL for fine-tunning LLMs
-  echo "[TEMP] skipping rdoc for commit completion"
+  pwn_rdoc_to_jsonl --rdoc-root-dir '/opt/pwn/rdoc/PWN' --jsonl-results '/opt/pwn/third_party/pwn_rdoc.jsonl'
 
   # Tag for every 100 commits (i.e. 0.1.100, 0.1.200, etc)
   tag_this_version_bool=`ruby -r 'pwn' -e 'if (PWN::VERSION.split(".")[-1].to_i + 1) % 100 == 0; then print true; else print false; end'`

data/lib/pwn/ai/agent/assembly.rb

@@ -35,7 +35,7 @@ module PWN
             raise "ERROR: Unsupported type parameter value '#{type}'. Supported values are :opcodes_to_asm and :asm_to_opcodes."
           end
 
-          PWN::AI::Introspection.reflect_on(
+          PWN::AI::Agent::Introspection.reflect_on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true

data/lib/pwn/ai/agent/btc.rb

@@ -16,7 +16,7 @@ module PWN
 
           system_role_content = 'Provide a useful summary of this latest bitcoin block returned from a bitcoin node via getblockchaininfo.'
 
-          PWN::AI::Introspection.reflect_on(
+          PWN::AI::Agent::Introspection.reflect_on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true

data/lib/pwn/ai/agent/burp_suite.rb

@@ -50,7 +50,7 @@ module PWN
             Analyze provided HTTP request/response pairs methodically: Start with a high-level overview, then dive into specifics, flag potential issues with evidence from the traffic, and end with PoC if applicable. Be verbose in reasoning but concise in output. Prioritize high-severity findings. If data is incomplete, request clarifications.  If analyzing a JavaScript source map file (i.e. .js.map), focus on deobfuscating and identifying any potentially vulnerable code patterns, especially those that could lead to client-side vulnerabilities like DOM XSS, prototype pollution, or insecure deserialization. Look for patterns such as eval, document.write, innerHTML assignments, and event handlers that could be influenced by user input. Provide detailed analysis and PoCs if vulnerabilities are identified.
           '
 
-          PWN::AI::Introspection.reflect_on(
+          PWN::AI::Agent::Introspection.reflect_on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true