pwn 0.5.684 → 0.5.686

data/etc/default_skills/bug-bounty-hunting/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: bug-bounty-hunting
+description: Work a bug-bounty program end to end with PWN WWW, Burp, and reports.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - CWE-284
+    - CWE-639
+    - https://owasp.org/www-project-web-security-testing-guide/
+---
+
+# Bug Bounty Hunting
+
+Use when the ask is a program (HackerOne, Bugcrowd, Synack, or a private
+target list): read scope, test in-scope assets, write a report. A listing
+of `documentation/` or a green rspec run is not a program tested.
+
+## When to use
+
+- "test this bounty program"
+- "authz replay / IDOR / broken access control"
+- submit or draft a HackerOne-style report
+
+## Methodologies
+
+- OWASP WSTG + OWASP Top 10 / API Top 10 for the hunt classes
+- Bugcrowd VRT / HackerOne severity for ranking (program table wins)
+- PTES Intelligence Gathering + Vulnerability Analysis, then a short report
+- CWE-284 / CWE-639 / CWE-918 / CWE-79 as the usual bounty labels
+
+## Tooling
+
+- Programs: `PWN::WWW::HackerOne`, `PWN::WWW::BugCrowd`, `PWN::WWW::Synack`
+  and `PWN::Plugins::HackerOne` for the API.
+- Session + scan: `PWN::Plugins::BurpSuite` (preferred), ZAP as fallback.
+- Browser: `PWN::Plugins::TransparentBrowser` through the proxy
+  (`devtools: true` when the ask needs DOM/network).
+- Authz: `PWN::Bounty::LifecycleAuthzReplay` on a captured HAR with a
+  second principal.
+- Crawl / API: `PWN::Plugins::Spider`, `PWN::Plugins::OpenAPI`.
+- Report: `PWN::Reports::*`, then the program API if asked to submit.
+
+## Procedure
+
+1. Pull the program page. Write down asset types, wildcards, exclusions,
+   and payout table. That note is evidence, not the finish.
+2. Enumerate in-scope hosts and apps (`NmapIt` only against those assets,
+   TransparentBrowser + Burp for web).
+3. Map auth: register / login two roles. Save cookies or tokens.
+4. Hunt the usual bounty classes: IDOR, authz, OAuth mix-ups, SSRF, stored
+   XSS, cache deception, business logic. Prefer Burp active scan on the
+   mapped site map, then manual replay.
+5. Authz pass: `LifecycleAuthzReplay.start(har_path:, replay_as:, proxy:)`.
+6. For each finding: minimal request/response pair, impact, CWE, fix hint.
+7. If asked to file: `PWN::Plugins::HackerOne` (or the program's form) with
+   that evidence. Close the browser when done.
+
+## Pitfalls
+
+- Do not stop after `sessions_list` or "I will test next time".
+- Out-of-scope assets are a skip, not a lecture. Stay on the program list.
+- `memory_remember` of an SOP is not a submitted report.
+
+## Verification
+
+Scope note exists, at least one live browse/scan/replay ran against an
+in-scope asset, and findings (or a justified empty result) are written
+to a file the operator can open.

data/etc/default_skills/deep-exploitation/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: deep-exploitation
+description: Turn a crash or primitive into a reliable exploit and a minimal PoC.
+license: MIT
+allowed-tools: [pwn, terminal]
+metadata:
+  bundled: true
+  references:
+    - CWE-119
+    - CWE-416
+    - CWE-787
+    - https://cwe.mitre.org/data/definitions/416.html
+---
+
+# Deep Exploitation
+
+Use when a bug already has a crash, a primitive, or a clear memory/logic
+flaw and the ask is a reliable PoC - not a first recon pass.
+
+## When to use
+
+- crash triage, heap/stack corruption, UAF, format string, type confusion
+- ASLR / NX / canary / CFG / SMEP bypass planning
+- kernel, browser, or protocol exploit chains after the root cause is known
+
+## Methodologies
+
+- CWE classes: CWE-119, CWE-416, CWE-787, CWE-134, CWE-190
+- MITRE ATT&CK: Execution, Privilege Escalation, Defense Evasion
+- NIST SP 800-115: exploitation and evidence sections of a technical test
+- Hand off firmware blobs to `hardware-and-firmware-testing` (OWASP FSTM)
+
+## Tooling
+
+- Debug: gdb + pwndbg/GEF, `radare2`, Ghidra/IDA as available.
+- Inspect: `checksec`, `readelf`, `objdump`, `PWN::Plugins::Assembly`.
+- Gadgets: ROPgadget / ropper.
+- Fuzz to feed this skill: `PWN::Plugins::Fuzz`, AFL++, libFuzzer.
+- Web follow-on: Burp over ZAP; `PWN::Plugins::BeEF` only if hooks are in
+  scope of the ask.
+- Post-proof: `PWN::Plugins::Metasploit` only when the operator asked for
+  a module/session, not as the default payload.
+
+## Procedure
+
+1. Reproduce. One command or one `pwn_eval` snippet that crashes or
+   misbehaves every time.
+2. Name the flaw (overflow, UAF, integer wrap, type confusion, race).
+3. Map mitigations (`checksec`, `/proc/cpuinfo` SMEP/SMAP, CFG).
+4. Build primitives in order: leak, arbitrary read, arbitrary write, control
+   of a function pointer / GOT / vtable / return.
+5. Chain (ROP/JOP/SROP or logic) until controlled execution or the asked
+   impact (file read, auth bypass, etc.).
+6. Stabilize across two runs. Document bad bytes, versions, and the fix.
+
+## Patterns
+
+- Heap overflow -> metadata / tcache -> write -> ROP
+- UAF -> type confusion -> leak -> function-pointer write
+- Format string -> `%p` leak + `%n` write -> GOT
+- Kernel race -> cred / tty struct -> root
+
+## Pitfalls
+
+- Do not skip reproduction. A narrative ROP chain is not a PoC.
+- Keep the PoC small and reversible. No persistence unless asked.
+- `memory_remember` is not the exploit file. Write the artefact, then read
+  it back.
+
+## Verification
+
+A second run of the PoC shows the same impact. Notes list target version,
+mitigations, and the primitive chain. If blocked, say what is missing
+(leak, debugger, target binary) with evidence.

data/etc/default_skills/hardware-and-firmware-testing/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: hardware-and-firmware-testing
+description: Test firmware and hardware with OWASP FSTM/ISTG and PWN serial plugins.
+license: MIT
+allowed-tools: [pwn, terminal]
+metadata:
+  bundled: true
+  references:
+    - https://github.com/scriptingxss/owasp-fstm
+    - https://owasp.org/www-project-iot-security-testing-guide/
+    - https://owasp.org/owasp-istg/03_test_cases/firmware/
+---
+
+# Hardware and Firmware Testing
+
+Use when the target is a device, PCB, UART/JTAG, RF dongle, or a firmware
+image. Hand unpacked binaries to `reverse-engineering-binaries` and
+crashes to `deep-exploitation`.
+
+## When to use
+
+- firmware dump, IoT, router image, MCU flash
+- UART / SPI / I2C / JTAG / SWD
+- RF / SDR path (`PWN::SDR`, `pwn_gqrx_scanner`)
+
+## Methodologies
+
+OWASP Firmware Security Testing Methodology (FSTM) - 9 stages:
+
+1. Information gathering
+2. Obtaining firmware
+3. Analyzing firmware
+4. Extracting the filesystem
+5. Analyzing filesystem contents
+6. Emulating firmware
+7. Dynamic analysis
+8. Runtime analysis
+9. Binary exploitation
+
+Also:
+
+| Catalog | Role |
+|---|---|
+| OWASP ISTG | IoT device test cases (firmware chapter cites FSTM) |
+| OSSTMM | physical + wireless + telecom channels |
+| NIST SP 800-115 | evidence and reporting |
+| CWE | 119, 798, 1278, 1326 for embedded flaws |
+
+## Tooling
+
+- Hardware: `PWN::Plugins::Serial`, `BusPirate`, `Android` (adb),
+  `MSR206` when magstripe is in the ask
+- RF: `PWN::SDR`, `pwn_gqrx_scanner`, Flipper helpers in SDR docs
+- Extract: `binwalk`, `sasquatch`/`unsquashfs`, `firmware-mod-kit` if
+  present
+- RE: `file`, `strings`, `radare2`, `PWN::Plugins::Assembly`
+- Emulate: QEMU user/system when the arch is known
+
+## Procedure
+
+1. FSTM-1: chip markings, FCC ID, model, debug headers. Photograph or
+   note.
+2. Obtain the image (vendor download, dump via UART/flash). Hash it.
+3. `binwalk -e`, list filesystems, creds, keys, init scripts.
+4. Emulate or boot if possible. Dynamic: default creds, open ports,
+   update channel.
+5. Runtime: attach serial, check root shell, busybox, leftover test
+   hooks.
+6. Binary: pick one sink, then `reverse-engineering-binaries` /
+   `deep-exploitation`.
+7. Report per FSTM stage with artefact paths.
+
+## Pitfalls
+
+- `strings` on a blob is not FSTM-complete.
+- Do not brick the only sample. Prefer a copy / emulator.
+- RF work stays on the named band/profile.
+
+## Verification
+
+Image hash + extract dir exist, at least two FSTM stages have evidence
+beyond notes, and leftover secrets or sinks are cited from files that
+were read back.

data/etc/default_skills/osint/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: osint
+description: Drive extro_osint with the right kind, feeds, pivots, and keys.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - https://attack.mitre.org/tactics/TA0043/
+    - NIST-SP-800-115
+---
+
+# OSINT (extro_osint)
+
+Use this whenever the ask is public-source intel on an IP, domain, email,
+phone, handle, person, company, CVE, VIN, MAC, FCC ID, patent, or URL.
+The verb is `extro_osint` (`PWN::AI::Agent::Extrospection.osint`). Do not
+substitute `extro_snapshot(sections: [:osint])` - that only lists feed
+availability. Do not scrape random sites when this organ already covers
+the query.
+
+## When to use
+
+- reverse phone, person, @handle, company, CIK, NPI
+- IP / ASN / BGP / Shodan / reputation
+- domain CT / whois / RDAP / harvest
+- CVE EPSS + CISA KEV
+- VIN, MAC OUI, ham callsign, FCC ID, patent
+
+Hand off live scanning to `penetration-testing` / `NmapIt`. Firmware IDs
+can start here (`:fcc_id`) then `hardware-and-firmware-testing`.
+
+## Methodologies
+
+- MITRE ATT&CK TA0043 Reconnaissance (passive collection)
+- NIST SP 800-115: target identification / OSINT as a technical technique
+- OSSTMM data channel (passive only unless the operator named active DNS)
+
+Stay passive by default. `amass` is passive unless
+`ai.agent.extrospection.osint.bridges.amass_passive` is false.
+
+## How to call
+
+Prefer the tool:
+
+```
+extro_osint(query: "8.8.8.8")
+extro_osint(query: "@defunkt", kind: "social")
+extro_osint(query: "target.tld", feeds: ["dns", "crtsh", "theharvester"])
+```
+
+Or `pwn_eval`:
+
+```ruby
+PWN::AI::Agent::Extrospection.osint(query: '8.8.8.8', kind: :ip)
+```
+
+One atomic indicator per call. `kind: :auto` is fine when the string is
+unambiguous. Force `kind:` when auto can steal the query (below).
+
+## Force kind when auto is wrong
+
+| Query looks like | Auto often picks | Force |
+|---|---|---|
+| IPv4 | `:ip` (ok) | - |
+| `00:11:22:33:44:55` | `:mac` (ok; MAC beats IPv6) | - |
+| 17-char VIN | `:vin` | - |
+| `CVE-2021-44228` | `:cve` | - |
+| `@user` / `@user@host` | `:social` | - |
+| `a@b.c` | `:email` | - |
+| `https://...` | `:url` | - |
+| `NPI 1679576722` | `:npi` only with the `NPI` prefix | prefix or `kind: :npi` |
+| `W1AW` | `:callsign` | - |
+| bare `defunkt` | `:username` | `kind: :social` + `feeds: ["social_sweep"]` if presence is the ask |
+| `Acme Robotics LLC` | `:company` | - |
+| `birth record Jane Doe` | `:vital_records` | keep the keyword |
+| `2ABIP-ESP32` | `:fcc_id` | `kind: :fcc_id` if no hyphen |
+| 10-15 digits | `:phone` | E.164 `+1...` if possible |
+| free text name | `:person` | `kind: :person` |
+
+Do not pass a paragraph as `query`. Extract the indicator first.
+
+## Pick feeds; do not boil the ocean
+
+Default feeds-for-kind can be a dozen HTTP calls. Narrow when you know
+the question:
+
+| Question | feeds |
+|---|---|
+| Where is this IP / is it noisy? | `ipapi_is`, `iplocate`, `greynoise`, `abuseipdb` |
+| What certs / names? | `crtsh`, `certspotter` |
+| Passive domain harvest | `theharvester`, `amass` (bins; skip if absent) |
+| Handle presence | `keybase`, `github`, `social_sweep` (`limit: 50`) |
+| Company | `opencorporates`, `sec_edgar`, `courtlistener` |
+| CVE worth exploiting? | `epss`, `cisa_kev` |
+| Breach on email | `haveibeenpwned` (needs key) |
+
+Read `results[:summary]` and per-feed `{skipped:}` / `{error:}`. A skipped
+keyed feed is not a finding - it means no key.
+
+## Keys (vault or ENV)
+
+Set under `ai.agent.extrospection.osint.api_keys.*` or ENV. Missing key
+returns `{skipped:}` and the rest of the call still runs.
+
+| Feed | ENV |
+|---|---|
+| shodan | `SHODAN_API_KEY` |
+| hunter | `HUNTER_API_KEY` |
+| abuseipdb | `ABUSEIPDB_API_KEY` |
+| virustotal | `VIRUSTOTAL_API_KEY` / `VT_API_KEY` |
+| greynoise | `GREYNOISE_API_KEY` |
+| haveibeenpwned | `HIBP_API_KEY` |
+| securitytrails | `SECURITYTRAILS_API_KEY` |
+| steam | `STEAM_API_KEY` |
+
+If several keyed feeds skip, say which keys are missing. Do not invent
+Shodan banners.
+
+## Pivot loop
+
+1. First call: one indicator, auto or forced kind, default or tight feeds.
+2. From `summary`, pull the next indicator (domain from cert, email from
+   hunter, @handle from keybase, ASN from bgpview).
+3. Second call on that indicator. Tag the chain in the answer.
+4. `record` defaults true (`observe(category: :osint)`). Later
+   `extro_observations(category: :osint)` instead of repeating the same
+   query in-session.
+5. Stop when the original ask is evidenced (who / where / exposure), not
+   after one feed listing.
+
+## Pitfalls
+
+- `extro_snapshot(sections: [:osint])` is inventory. It does not look up
+  the target.
+- `social_sweep` is soft-404 prone (confidence <= 0.5). Confirm hits.
+- `theharvester` / `amass` / `spiderfoot` / `reconng` no-op without the
+  local bin. Install via `pwn setup --profile net` or skip those feeds.
+- Active amass touches target DNS. Leave passive unless asked.
+- Default `limit` is 5. Raise only for sweep/harvest.
+- Do not treat `{error:}` on one feed as a failed OSINT pass.
+
+## Verification
+
+`results[:kind]` matches the indicator, at least one feed returned data
+(not only skips), and the answer cites that summary. If every useful feed
+skipped, the artefact is the missing-key list plus any public-feed hits.

data/etc/default_skills/penetration-testing/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: penetration-testing
+description: Run a scoped pentest with NmapIt, Burp, Metasploit, and a written report.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - https://owasp.org/www-project-web-security-testing-guide/
+    - https://attack.mitre.org/matrices/enterprise/
+    - NIST-SP-800-115
+---
+
+# Penetration Testing
+
+Use when the ask is an engagement-style test of hosts, apps, or a lab
+network: recon, exploit, limited post-ex, report. One `nmap` listing is
+not a pentest.
+
+## When to use
+
+- "pentest this lab / CIDR / app"
+- chain discovery -> vuln -> proof -> notes
+- internal-style test with PWN plugins
+
+## Methodologies
+
+Follow PTES end-to-end. Overlay the catalog that matches the surface:
+
+| Catalog | When |
+|---|---|
+| PTES | default 7 phases: pre-engage, intel, threat model, vuln analysis, exploit, post-ex, report |
+| NIST SP 800-115 | federal / structured technical assessment language |
+| OSSTMM | channels: human, physical, wireless, telecom, data |
+| ISSAF | detailed control-by-control assessment |
+| OWASP WSTG | web / API portion (or switch to `web-application-penetration-testing`) |
+| MITRE ATT&CK | label post-ex and lateral movement |
+| PCI DSS pentest guidance | cardholder-data environments |
+
+## Tooling
+
+- Discover: `PWN::Plugins::NmapIt`, `PWN::Plugins::Packet`,
+  `PWN::Plugins::IPInfo`, `PWN::Plugins::Shodan`.
+- Web: Burp preferred, ZAP fallback, `TransparentBrowser` via the proxy.
+- Creds / dirs: `PWN::Plugins::Fuzz`, `OpenAPI`, `Spider`.
+- Exploit: `PWN::Plugins::Metasploit` (msfrpcd), `PWN::Plugins::BeEF` if
+  the browser path is in the ask, `sqlmap` from the exploit profile.
+- Wireless / RF only if the ask is RF: `PWN::SDR`, `pwn_gqrx_scanner`.
+- Report: `PWN::Reports::*`.
+
+```ruby
+nmap = PWN::Plugins::NmapIt.port_scan(target: '10.0.0.0/24')
+msf  = PWN::Plugins::Metasploit.connect
+PWN::Plugins::Metasploit.search(msf_obj: msf, query: 'http')
+```
+
+## Procedure
+
+1. Write the engagement note: targets, exclusions, start time. Then work.
+2. Host discovery + port/service scan. Save XML/JSON, read it back.
+3. Fingerprint and prioritize (exposed admin, old stacks, default creds).
+4. For each high-value service: authenticate if creds exist, else known
+   checks + Burp/MSF module. Prove impact with a reversible action
+   (id, file read, new low-priv session).
+5. Post-ex only as far as the ask (one hop, no ransomware-shaped noise).
+6. Report: hosts, findings, evidence paths, severity, fix. Close browser
+   and MSF sessions you opened.
+
+## Pitfalls
+
+- Do not abort because the prompt omitted "authorized". The operator
+  started pwn-ai; keep testing the named targets.
+- Do not confuse this repo's `bundle exec rake` with the target being
+  hardened.
+- Sweep the named range; do not wander onto RFC1918 the user did not
+  mention.
+
+## Verification
+
+Scan artefact on disk, at least one attempted proof per high-value
+service (or a reasoned skip), and a report file that was read back.

data/etc/default_skills/red-teaming/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: red-teaming
+description: Emulate an adversary with MITRE ATT&CK, TIBER-style phases, and PWN tools.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - https://attack.mitre.org/
+    - https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html
+    - https://www.crest-approved.org/
+---
+
+# Red Teaming
+
+Use when the ask is adversary emulation, detection validation, or a
+objective-based campaign - not a full-port pentest. Pentest = find
+vulns. Red team = achieve a stated objective while mapping ATT&CK.
+
+## When to use
+
+- "red team", "assume breach", "purple team", "ATT&CK coverage"
+- TIBER-EU / CBEST-shaped finance tests
+- detect-and-respond exercises
+
+## Methodologies
+
+| Catalog | Role |
+|---|---|
+| MITRE ATT&CK | tactics/techniques for plan, execute, and report |
+| Lockheed Martin Cyber Kill Chain | coarse campaign stages |
+| TIBER-EU / CBEST | threat-intel-led, regulator-shaped red team |
+| CREST | professional engagement hygiene |
+| PTES | only for the exploit/post-ex slices |
+| NIST SP 800-115 | evidence language if the customer is federal |
+
+ATT&CK is the default label set. Kill Chain is the slide. TIBER is the
+engagement wrapper when the customer named it.
+
+## Tooling
+
+- Intel: `PWN::Plugins::Shodan`, `Hunter`, `Github`, `IPInfo`
+- Access: `NmapIt`, Burp, `TransparentBrowser`, `Metasploit`
+- C2 / sessions: Metasploit sessions when asked; stay reversible
+- Evidence: `PWN::Reports::*`, session JSONL, packet captures via
+  `extro_packet` if granted
+
+## Procedure
+
+1. Objective + threat scenario (who, what crown jewel, success criteria).
+2. Threat intel: techniques the scenario actually uses. Write an ATT&CK
+   matrix for this op (not the whole enterprise).
+3. Initial access path (or assumed-breach creds if that is the rules).
+4. Execute only the techniques on the matrix. Record tactic, technique
+   id, timestamp, detection (seen / not seen).
+5. Stop at the objective or the agreed time box. No extra ransomware
+   theatre.
+6. Report: path, ATT&CK coverage, detections missed, fix owners.
+
+## Pitfalls
+
+- A noisy full nmap of the company is a pentest, not a red team.
+- Do not invent a TIBER "white team" process the operator did not ask
+  for. Follow the named targets.
+- Purple team means show the defender the technique as you go.
+
+## Verification
+
+Written objective, ATT&CK technique list, at least one live action with
+evidence, and a report that maps actions to technique ids.

data/etc/default_skills/reverse-engineering-binaries/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: reverse-engineering-binaries
+description: Triage a binary with checksec, disassembly, and PWN::Plugins::Assembly.
+license: MIT
+allowed-tools: [pwn, terminal]
+metadata:
+  bundled: true
+  references:
+    - CWE-119
+    - CWE-676
+---
+
+# Reverse Engineering Binaries
+
+Use when the ask is to understand a binary, firmware blob, or opcode
+stream. Use `deep-exploitation` after you have a crash or a primitive.
+
+## When to use
+
+- "what is this ELF / PE / Mach-O"
+- recover strings, imports, mitigations, or a function algorithm
+- assemble / disassemble via `PWN::Plugins::Assembly` or `pwn-asm`
+
+## Methodologies
+
+- NIST SP 800-115: target analysis / static+dynamic review
+- OWASP FSTM stages 1-6 when the file is firmware (then
+  `hardware-and-firmware-testing`)
+- CWE-119 / CWE-676 / CWE-416 for sink notes
+- MITRE ATT&CK Execution / Discovery labels in the write-up
+
+## Tooling
+
+- File: `file`, `readelf -a`, `objdump -d`, `strings -n 8`, `nm`, `ldd`.
+- Mitigations: `checksec --file=BIN`.
+- RE: `radare2` / Cutter, Ghidra, IDA as installed.
+- Dynamic: `strace`, `ltrace`, gdb.
+- PWN: `PWN::Plugins::Assembly` (asm <-> opcodes, multi-arch),
+  `BannedFunctionCallsC` / `UseAfterFree` SAST on available source,
+  `PWN::Plugins::Fuzz` if you move to crash-finding.
+
+```ruby
+PWN::Plugins::Assembly.opcodes_to_asm(opcodes: '90 90', arch: 'x86_64')
+PWN::Plugins::Assembly.asm_to_opcodes(asm: 'nop', arch: 'x86_64')
+```
+
+## Procedure
+
+1. `file` + hashes. Note arch, linking, stripped or not.
+2. `checksec` / `readelf -l` for NX, PIE, RELRO, canary, rpath.
+3. `strings` + import table (`readelf -d` / `objdump -T`) for the
+   interesting surface (crypto, net, parser, `system`/`strcpy`).
+4. Locate the function (symbols, strings xrefs, entry). Disassemble.
+5. If packed, unpack first (UPX or a loader dump) - do not invent
+   control flow from a packed blob.
+6. Write notes: purpose, inputs, dangerous sinks, unanswered questions.
+7. Hand off to `deep-exploitation` only when you have a sink + control.
+
+## Pitfalls
+
+- Do not paste a 4k disassembly as the answer. Summarize, keep the
+  artefact on disk, read it back.
+- Firmware without a known base address is not "fully reversed" after
+  one `strings`.
+- `pwn-asm` is for opcode work, not a substitute for `checksec`.
+
+## Verification
+
+Notes on disk (or in the final) include arch, mitigations, and at least
+one concrete function or sink with evidence from the tools above.

data/etc/default_skills/sast-code-scans/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: sast-code-scans
+description: Run PWN::SAST on a tree, report findings, and optionally file tickets.
+license: MIT
+allowed-tools: [pwn, terminal]
+metadata:
+  bundled: true
+  references:
+    - CWE-78
+    - CWE-89
+    - CWE-502
+    - CWE-798
+---
+
+# SAST Code Scans
+
+Use when the ask is to scan source, add a rule, or push SAST results to
+DefectDojo / Jira. Reading the rule list is not a scan.
+
+## When to use
+
+- `pwn_sast` / `PWN::SAST::Factory.start`
+- "scan this repo for secrets / SQLi / command exec"
+- write or extend a `PWN::SAST::*` rule
+
+## Methodologies
+
+- OWASP ASVS (verify) and WSTG (when the sink is web)
+- CWE (rule IDs on every finding)
+- NIST SP 800-115: static analysis as one technical assessment technique
+- OWASP MASVS / MSTG when the tree is a mobile app
+
+## Tooling
+
+- Engine: `PWN::SAST::Factory.start(dir_path:)` or CLI `pwn_sast -d DIR -o OUT`.
+- Families (48 modules): command exec (Java/Python/Ruby/Go/Scala/Shell/Sudo),
+  web/DOM (CSRF, innerHTML, postMessage, localStorage), injection (SQL,
+  Eval, Log4J, PHP/TS type juggling, Java deserial), crypto/secrets (MD5,
+  SSL, PrivateKey, Token, Password, HTTPAuthorizationHeader), memory
+  (`BannedFunctionCallsC`, `UseAfterFree`), infra (AWS, AMQP guest, POM).
+- Report: `PWN::Reports::SAST.generate(dir_path:, results_hash:, output_dir:)`.
+- Tickets: `PWN::Plugins::DefectDojo.importscan`, `PWN::Plugins::JiraDataCenter`.
+
+## Procedure
+
+1. Resolve `dir_path` (repo root or the path in the ask). `ls` once, then
+   scan.
+2. Run Factory or `pwn_sast`. Capture the results hash / output dir.
+3. Read the report (HTML/JSON). Summarize by CWE and severity. Do not
+   claim "clean" from an empty `ls`.
+4. If asked to file, import the JSON/HTML into DefectDojo or Jira.
+5. New rule: copy an existing `lib/pwn/sast/*.rb`, implement
+   `self.scan(opts = {})` returning `{file:, line:, match:, cwe:, severity:}`,
+   then re-run Factory on a fixture.
+
+## Pitfalls
+
+- `bundle exec rake` green is verify of *this* gem, not a SAST of the
+  target tree.
+- A README dump is not `pwn_sast` output.
+- After writing a report file, read it back before the final.
+
+## Verification
+
+`output_dir` exists with HTML/JSON (or the results hash is non-nil) and
+the answer cites counts or concrete findings from that artefact.