@gpzhang2001/sharpkit-skills 0.2.1

package/skills/protocols/graphql.md

@@ -0,0 +1,276 @@
+---
+name: graphql
+description: GraphQL security testing covering introspection, resolver injection, batching attacks, and authorization bypass
+---
+
+# GraphQL
+
+Security testing for GraphQL APIs. Focus on resolver-level authorization, field/edge access control, batching abuse, and federation trust boundaries.
+
+## Attack Surface
+
+**Operations**
+- Queries, mutations, subscriptions
+- Persisted queries / Automatic Persisted Queries (APQ)
+
+**Transports**
+- HTTP POST/GET with `application/json` or `application/graphql`
+- WebSocket: graphql-ws, graphql-transport-ws protocols
+- Multipart for file uploads
+
+**Schema Features**
+- Introspection (`__schema`, `__type`)
+- Directives: `@defer`, `@stream`, custom auth directives (@auth, @private)
+- Custom scalars: Upload, JSON, DateTime
+- Relay: global node IDs, connections/cursors, interfaces/unions
+
+**Architecture**
+- Federation (Apollo, GraphQL Mesh): `_service`, `_entities`
+- Gateway vs subgraph authorization boundaries
+
+## Reconnaissance
+
+**Endpoint Discovery**
+```
+POST /graphql         {"query":"{__typename}"}
+POST /api/graphql     {"query":"{__typename}"}
+POST /v1/graphql      {"query":"{__typename}"}
+POST /gql             {"query":"{__typename}"}
+GET  /graphql?query={__typename}
+```
+
+Check for GraphiQL/Playground exposure with credentials enabled (cross-origin with cookies can leak data via postMessage bridges).
+
+**Schema Acquisition**
+
+If introspection enabled:
+```graphql
+{__schema{types{name fields{name args{name}}}}}
+```
+
+If disabled, infer schema via:
+- `__typename` probes on candidate fields
+- Field suggestion errors (submit near-miss names to harvest suggestions)
+- "Expected one of" errors revealing enum values
+- Type coercion errors exposing field structure
+- Error taxonomy: different codes for "unknown field" vs "unauthorized field" reveal existence
+
+**Schema Mapping**
+
+Map: root operations, object types, interfaces/unions, directives, custom scalars. Identify sensitive fields: email, tokens, roles, billing, API keys, admin flags, file URLs. Note cascade paths where child resolvers may skip auth under parent assumptions.
+
+## Key Vulnerabilities
+
+### Authorization Bypass
+
+**Field-Level IDOR**
+
+Test with aliases comparing owned vs foreign objects in single request:
+```graphql
+query {
+  own: order(id:"OWNED_ID") { id total owner { email } }
+  foreign: order(id:"FOREIGN_ID") { id total owner { email } }
+}
+```
+
+**Edge/Child Resolver Gaps**
+
+Parent resolver checks auth, child resolver assumes it's already validated:
+```graphql
+query {
+  user(id:"FOREIGN") {
+    id
+    privateData { secrets }  # Child may skip auth check
+  }
+}
+```
+
+**Relay Node Resolution**
+
+Decode base64 global IDs, swap type/id pairs:
+```graphql
+query {
+  node(id:"VXNlcjoxMjM=") { ... on User { email } }
+}
+```
+Ensure per-type authorization is enforced inside resolvers. Verify connection filters (owner/tenant) apply before pagination; cursor tampering should not cross ownership boundaries.
+
+**Mutation Bypass**
+- Probe mutations for partial updates bypassing validation (JSON Merge Patch semantics)
+- Test mutations that accept extra fields passed to downstream logic
+
+### Batching & Alias Abuse
+
+**Enumeration via Aliases**
+```graphql
+query {
+  u1:user(id:"1"){email}
+  u2:user(id:"2"){email}
+  u3:user(id:"3"){email}
+}
+```
+Bypasses per-request rate limits; exposes per-field vs per-request auth inconsistencies.
+
+**Array Batching**
+
+If supported (non-standard), submit multiple operations to achieve partial failures and bypass limits.
+
+### Input Manipulation
+
+**Type Confusion**
+```
+{id: 123}      vs {id: "123"}
+{id: [123]}    vs {id: null}
+{id: 0}        vs {id: -1}
+```
+
+**Duplicate Keys**
+```json
+{"id": 1, "id": 2}
+```
+Parser precedence varies; may bypass validation. Also test default argument values.
+
+**Extra Fields**
+
+Send unexpected keys in input objects; backends may pass them to resolvers or downstream logic.
+
+### Cursor Manipulation
+
+Decode cursors (usually base64) to:
+- Manipulate offsets/IDs
+- Skip filters
+- Cross ownership boundaries
+
+### Directive Abuse
+
+**@defer/@stream**
+```graphql
+query {
+  me { id }
+  ... @defer { adminPanel { secrets } }
+}
+```
+May return gated data in incremental delivery. Confirm server supports incremental delivery.
+
+**Custom Directives**
+
+@auth, @private and similar directives often annotate intent but do not enforce—verify actual checks in each resolver path.
+
+### Complexity Attacks
+
+**Fragment Bombs**
+```graphql
+fragment x on User { friends { ...x } }
+query { me { ...x } }
+```
+Test depth/complexity limits, query cost analyzers, timeouts.
+
+**Wide Selection Sets**
+
+Abuse selection sets and fragments to force overfetching of sensitive subfields.
+
+### Federation Exploitation
+
+**SDL Exposure**
+```graphql
+query { _service { sdl } }
+```
+
+**Entity Materialization**
+```graphql
+query {
+  _entities(representations:[
+    {__typename:"User", id:"TARGET_ID"}
+  ]) { ... on User { email roles } }
+}
+```
+Gateway may enforce auth; subgraph resolvers may not. Look for cross-subgraph IDOR via inconsistent ownership checks.
+
+### Subscription Security
+
+- Authorization at handshake only, not per-message
+- Subscribe to other users' channels via filter args
+- Cross-tenant event leakage
+- Abuse filter args in subscription resolvers to reference foreign IDs
+
+### Persisted Query Abuse
+
+- APQ hashes leaked from client bundles
+- Replay privileged operations with attacker variables
+- Hash bruteforce for common operations
+- Validate hash→operation mapping enforces principal and operation allowlists
+
+### CORS & CSRF
+
+- Cookie-auth with GET queries enables CSRF on mutations via query parameters
+- GraphiQL/Playground cross-origin with credentials leaks data
+- Missing SameSite and origin validation
+
+### File Uploads
+
+GraphQL multipart spec:
+- Multiple Upload scalars
+- Filename/path traversal tricks
+- Unexpected content-types, oversize chunks
+- Server-side ownership/scoping for returned URLs
+
+## WAF Evasion
+
+**Query Reshaping**
+- Comments and block strings (`"""..."""`)
+- Unicode escapes
+- Alias/fragment indirection
+- JSON variables vs inline args
+- GET vs POST vs `application/graphql`
+
+**Fragment Splitting**
+
+Split fields across fragments and inline spreads to avoid naive signatures:
+```graphql
+fragment a on User { email }
+fragment b on User { password }
+query { me { ...a ...b } }
+```
+
+## Bypass Techniques
+
+**Transport Switching**
+```
+Content-Type: application/json
+Content-Type: application/graphql
+Content-Type: multipart/form-data
+GET with query params
+```
+
+**Timing & Rate Limits**
+- HTTP/2 multiplexing and connection reuse to widen timing windows
+- Batching to bypass rate limits
+
+**Naming Tricks**
+- Case/underscore variations
+- Unicode homoglyphs (server-dependent)
+- Aliases masking sensitive field names
+
+**Cache Confusion**
+- CDN caching without Vary on Authorization
+- Variable manipulation affecting cache keys
+- Redirects and 304/206 behaviors leaking partial responses
+
+## Testing Methodology
+
+1. **Fingerprint** - Identify endpoints, transports, stack (Apollo, Hasura, etc.), GraphiQL exposure
+2. **Schema mapping** - Introspection or inference to build complete type graph
+3. **Principal matrix** - Collect tokens for unauth, user, premium, admin roles with at least one valid object ID per subject
+4. **Field sweep** - Test each resolver with owned vs foreign IDs via aliases in same request
+5. **Transport parity** - Verify same auth on HTTP, WebSocket, persisted queries
+6. **Federation probe** - Test `_service` and `_entities` for subgraph auth gaps
+7. **Edge cases** - Cursors, @defer/@stream, subscriptions, file uploads
+
+## Validation Requirements
+
+- Paired requests (owner vs non-owner) showing unauthorized access
+- Resolver-level bypass: parent checks present, child field exposes data
+- Transport parity proof: HTTP and WebSocket for same operation
+- Federation bypass: `_entities` accessing data without subgraph auth
+- Minimal payloads with exact selection sets and variable shapes
+- Document exact resolver paths that missed enforcement

package/skills/protocols/oauth.md

@@ -0,0 +1,185 @@
+---
+name: oauth
+description: OAuth 2.0 and OIDC flow security testing covering redirect manipulation, token leakage, PKCE bypass, and client misconfiguration
+---
+
+# OAuth 2.0 / OIDC
+
+OAuth and OIDC failures often enable account takeover, token theft, and cross-client token confusion. Treat every redirect, client identifier, and token exchange as an authorization boundary — not a convenience layer.
+
+## Attack Surface
+
+**Flows**
+- Authorization code (with/without PKCE)
+- Implicit (legacy), hybrid, device authorization, client credentials
+- Refresh token rotation, token introspection, revocation
+
+**Endpoints**
+- `/authorize`, `/token`, `/userinfo`, `/introspect`, `/revoke`, `/logout`
+- `/.well-known/openid-configuration`, `/jwks.json`
+- Dynamic client registration (if enabled)
+
+**Token Types**
+- Authorization codes, access tokens, refresh tokens, ID tokens
+- Opaque vs JWT formats; reference tokens vs self-contained JWTs
+
+**Client Types**
+- Public clients (SPAs, mobile) vs confidential (server-side)
+- Multiple redirect URIs, wildcard/pattern matching, custom URI schemes
+
+## Reconnaissance
+
+**Discovery**
+```
+GET /.well-known/openid-configuration
+GET /oauth2/.well-known/openid-configuration
+GET /.well-known/oauth-authorization-server
+```
+
+Extract: `authorization_endpoint`, `token_endpoint`, `registration_endpoint`, supported `response_types`, `code_challenge_methods_supported`, `grant_types_supported`.
+
+**Client Enumeration**
+- Inspect JS bundles, mobile APK/IPA configs, GitHub repos for `client_id`, redirect URIs, scopes
+- Check error messages for client validation hints ("invalid redirect_uri", "unregistered client")
+
+## Key Vulnerabilities
+
+### Redirect URI Manipulation
+
+**Open Redirect Chains**
+- Register or guess permissive redirect patterns: `https://app.com/callback`, path-prefix only, subdomain wildcards
+- Test: append paths, fragments, query injection, `@` tricks, encoded slashes, backslash variants
+
+```
+https://app.com/callback.evil.com
+https://app.com/callback%2f..%2f@evil.com
+https://app.com/callback?next=https://evil.com
+com.app://callback  (mobile custom scheme)
+```
+
+**Redirect URI Validation Bypasses**
+- Trailing slash, case, port, scheme downgrade (`http` vs `https`)
+- Path normalization differentials between IdP validator and consuming app
+- `redirect_uri` parameter pollution (first vs last wins)
+- Wildcard subdomain acceptance: `*.app.com` → register `attacker.app.com` or find dangling subdomain
+
+### Authorization Code Issues
+
+**Code Leakage**
+- Codes in URL fragments, Referer headers, browser history, server logs, analytics
+- Code replay before expiry; missing one-time-use enforcement
+- Code sent to wrong redirect_uri if binding is weak
+
+**Code Injection / Mix-Up**
+- Attacker initiates flow, victim completes login, code delivered to attacker's redirect
+- Mix-up attack: swap `client_id` between authorize and token steps
+- Missing `redirect_uri` binding at token endpoint
+
+### State and Nonce
+
+- Missing, predictable, or reusable `state` → CSRF on OAuth login (session fixation, account linking)
+- Missing `nonce` in OIDC → ID token injection/replay
+- `state` not bound to client session or PKCE verifier
+
+### PKCE Bypass
+
+- `code_challenge_method` downgrade: accept `plain` instead of `S256`
+- Missing PKCE requirement on public clients
+- `code_verifier` not validated or compared case-insensitively with weak matching
+- Authorization code issued without challenge, token endpoint accepts any verifier
+
+### Client Authentication
+
+**Public Client Abuse**
+- Token endpoint accepts requests without `client_secret` for confidential clients
+- `client_id` only authentication on token/introspection endpoints
+- Dynamic registration with attacker-controlled redirect URIs
+
+**Secret Leakage**
+- Hardcoded secrets in mobile apps, SPAs, or public repos
+- `client_secret` accepted in query string or logged in access logs
+
+### Scope and Token Issues
+
+- Scope escalation: request `admin`/`offline_access`/`openid profile email` beyond app need; server grants all requested scopes
+- Refresh token not rotated or reuse not detected → persistent access
+- Access token accepted across services (missing audience/resource binding)
+- Token introspection returns `active:true` without proper auth on introspection endpoint
+
+### OpenID Connect Specific
+
+- ID token accepted as access token at resource servers (token confusion)
+- `acr`, `amr`, `auth_time` not validated for step-up requirements
+- Userinfo endpoint returns PII without matching access token scope
+- `sub` collision across issuers if `iss` not validated
+
+## Advanced Techniques
+
+**Referer Leakage**
+- Embed authorized redirect as subresource on attacker page; harvest `code` from Referer if policy allows
+
+**Device Flow Abuse**
+- Poll `device_code` endpoint with guessed codes; slow rate limits only
+- User approves attacker-initiated device login
+
+**Account Linking**
+- OAuth login links attacker's IdP identity to victim's local account without re-auth
+- Email collision: same email from different IdP providers
+
+## Testing Methodology
+
+1. **Map flows** — Identify all grant types, clients, and redirect URIs in use
+2. **Redirect matrix** — For each client, fuzz redirect_uri validation with encoding and parser tricks
+3. **CSRF** — Initiate OAuth without `state`; swap sessions mid-flow
+4. **PKCE** — Replay codes with wrong/missing verifier; downgrade challenge method
+5. **Token exchange** — Swap codes/tokens between clients; test cross-audience acceptance
+6. **Mobile/deep links** — Custom schemes, intent filters, universal links hijacking
+
+## Validation
+
+1. Demonstrate stolen authorization code or token via redirect manipulation or Referer leak
+2. Show account takeover or access to victim resources with attacker's OAuth session
+3. Prove CSRF: victim completes login into attacker's linked session without consent UI bypass where applicable
+4. Document exact validation gap (redirect binding, PKCE, state, audience)
+5. Provide full authorize → callback → token request chain with before/after evidence
+
+## False Positives
+
+- Redirect URI rejected consistently across all bypass attempts
+- Public client correctly requires PKCE S256 with strict verifier validation
+- `state`/`nonce` enforced and bound; CSRF test fails as expected
+- Token audience/issuer correctly validated at resource server
+- Custom scheme redirects require app ownership proof (verified Android/iOS app links)
+
+## Impact
+
+- Full account takeover via stolen authorization codes or tokens
+- Persistent access through refresh token theft
+- Cross-tenant or cross-client data access via token confusion
+- PII exposure from userinfo or ID token claim leakage
+
+## Pro Tips
+
+1. Always capture the full redirect chain including intermediate 302 locations
+2. Compare authorize-step and token-step parameter binding (`redirect_uri`, `client_id`, PKCE)
+3. Test both web and mobile clients — validation rules often differ
+4. Check logout/revocation — tokens may remain valid after "logout"
+5. Chain with open redirect or XSS on the legitimate redirect_uri to exfiltrate codes
+
+## Tooling
+
+The sandbox ships **jwt_tool** (already cloned at `/home/pentester/tools/jwt_tool`) plus `curl` — enough for the token side of OAuth/OIDC.
+
+- **jwt_tool** (ticarpi) — inspect and tamper ID tokens / JWT access tokens: `alg:none`, `HS256`/`RS256` key confusion, `kid` injection, claim editing (`sub`, `aud`, `iss`, `exp`):
+  ```
+  python3 /home/pentester/tools/jwt_tool/jwt_tool.py <ID_TOKEN>                    # decode/inspect
+  python3 /home/pentester/tools/jwt_tool/jwt_tool.py <ID_TOKEN> -X a               # alg:none
+  python3 /home/pentester/tools/jwt_tool/jwt_tool.py <ID_TOKEN> -X k -pk pub.pem   # RS256->HS256 confusion
+  ```
+- **curl** — drive the authorize → callback → token chain by hand so you control every parameter (`redirect_uri`, `client_id`, `state`, PKCE `code_challenge`/`code_verifier`) and can test the binding/downgrade cases above.
+
+Humans often use Burp's **EsPReSSO** (RUB-NDS) SSO extension for flow visualization; it is GUI-only, so prefer manual `curl` + `jwt_tool` in-sandbox.
+
+## Summary
+
+OAuth security hinges on strict redirect URI binding, unguessable state/nonce, PKCE for public clients, and consistent token audience validation. Any gap in the authorize-to-token chain is a potential account takeover.

package/skills/reconnaissance/asset_discovery.md

@@ -0,0 +1,150 @@
+---
+name: asset-discovery
+description: Passive asset and attack-surface discovery via certificate transparency, TLS SAN pivoting, passive DNS, and ASN/IP enumeration to find hosts beyond subdomain brute force
+---
+
+# Asset Discovery
+
+Most engagements start from a small seed (one domain, one org name) but the real attack surface is far larger: forgotten hosts, staging/internal-named services, acquisitions, and infrastructure that never appears in a wordlist. Build a broad, deduplicated inventory using passive intelligence — certificate transparency, TLS certificate metadata, passive DNS, and ASN/IP data — then collapse it into a probed, classified attack surface. The aim is coverage and pivoting: every certificate, DNS record, and IP is a lead to more assets.
+
+Only use this skill when all subdomains and related assets of the target are in scope — broad discovery pulls in hosts far beyond the seed.
+
+## Attack Surface
+
+- Hosts discoverable via issued certificates (CT logs) but absent from DNS brute force
+- Internal/staging/pre-prod hostnames leaked in certificate SAN lists
+- Sibling and acquisition domains sharing certificates, ASNs, or IP ranges with the seed
+- Wildcard and short-lived certs revealing naming conventions (`*.internal.example.com`, `k8s-*`, `argocd.*`)
+- ASN-owned IP ranges hosting services with no DNS name at all
+- Virtual hosts co-located on shared IPs (multiple apps behind one address)
+- Non-HTTP services on discovered hosts (databases, brokers, admin ports)
+
+## High-Value Sources
+
+### Certificate Transparency (CT)
+
+CT logs record nearly every publicly-trusted certificate. Query by domain (matches SAN/CN) and by organization name.
+
+- **crt.sh** (free, no key):
+  - By domain incl. subdomains: `curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sed 's/^\*\.//' | sort -u`
+  - By organization: `https://crt.sh/?O=Example+Inc&output=json`
+- **Censys / Shodan / Fofa** (API keys): search certs by `parsed.names`, `parsed.subject.organization`, or a specific `fingerprint_sha256`, then pivot to every host serving that cert.
+- Cross-check multiple indexes (`certspotter`, Google CT, `chaos`) — no single log is complete.
+- **Wildcards** (`*.corp.example.com`) reveal internal naming schemes even when individual hosts resolve privately; use them to seed targeted guesses (`grafana.corp`, `ci.corp`, `vault.corp`).
+
+### TLS Certificate SAN/CN
+
+- **SAN expansion**: one cert often lists many hostnames (marketing + api + admin + internal) — extract every SAN, not just the queried name.
+- **Shared-cert pivot**: the same cert fingerprint served on multiple IPs ties disparate assets to one owner.
+- **Issuer/org pivot**: certs sharing `subject.organization`/`organizationalUnit` frequently belong to the same target.
+- **Active read** catches names never submitted to public CT: `echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -text | grep -A1 'Subject Alternative Name'`
+- **Internal leak signal**: SANs like `localhost`, `*.internal`, `*.svc.cluster.local`, `*.local`, or RFC1918-style names on a public cert expose internal naming and sometimes internal services fronted publicly.
+
+### Passive DNS
+
+- Forward-resolve every name (A/AAAA/CNAME); keep CNAME chains — they reveal third-party providers and CDNs.
+- **Reverse DNS (PTR)** on discovered IPs surfaces co-located hostnames.
+- **Historical/passive DNS** (SecurityTrails, VirusTotal, `chaos`, passivedns providers) recovers names that no longer resolve but may still front live infra.
+
+### ASN & IP Ranges
+
+- Map a known IP to its ASN and netblock: `whois -h whois.cymru.com " -v <IP>"` or a BGP/ASN lookup.
+- If the org runs its own ASN, enumerate all announced prefixes and treat them as candidate assets.
+- For cloud-hosted targets the IP belongs to the provider, not the org — pivot via cert/vhost instead of netblock.
+
+## Recommended Tooling
+
+These tools are available in the sandbox and are pipeline-friendly with JSON output:
+
+- **`subfinder`** — passive subdomain aggregation across many sources incl. CT: `subfinder -d example.com -all -recursive -silent -oJ -o subs.jsonl`
+- **`httpx`** — live probing plus cert/SAN grab in one pass: `httpx -l hosts.txt -tls-grab -json` (see methodology).
+- **`naabu`** — port sweep for non-HTTP services: `naabu -list hosts.txt -top-ports 100 -verify -silent`
+- **`curl` + `jq`** — direct **crt.sh** JSON queries for CT (no key needed) and other index APIs.
+- **`openssl s_client`** — active read of a live host's cert to extract SANs/CN.
+- **`dig`** / **`nslookup`** — forward/reverse (PTR) resolution and CNAME chains.
+- **`whois`** — ASN/netblock lookups (e.g. `whois -h whois.cymru.com`).
+
+Cross-source results — CT + passive DNS + `subfinder` together beat any single source. If you need a tool that is not installed, install it into the sandbox at runtime.
+
+## Key Techniques
+
+### Iterative Seed Expansion
+
+Every new name, PTR result, CNAME target, and cert SAN becomes a fresh seed. Loop CT → SAN extraction → passive DNS → ASN/range expansion until the asset set stops growing.
+
+### Cert-Fingerprint Pivoting
+
+Search Censys/Shodan by a cert's `fingerprint_sha256` to find every other host presenting the same certificate — the strongest cross-asset link for tying acquisitions and shadow infra to the target.
+
+### Naming-Convention Inference
+
+Wildcard SANs and observed hostnames expose the org's naming scheme; generate targeted candidates from it (`<service>.<env>.example.com`) rather than blind brute force.
+
+### IP-First Discovery
+
+For ASN-owned ranges, sweep IPs directly with `naabu`/`httpx` and read served certs (`httpx -tls-grab`, or `openssl s_client`) to find services that have no DNS name at all.
+
+## Advanced Techniques
+
+- **Active SAN harvesting** across whole ranges with `httpx -tls-grab` (or `openssl s_client`) recovers internal hostnames never logged to public CT.
+- **Favicon and response hashing** (`httpx -favicon`, hash pivots in Shodan) clusters instances of the same app across unrelated hostnames.
+- **Vhost differentials**: probe a single IP with multiple `Host:` values to unmask co-located apps behind one address.
+- **Historical CT/DNS diffing** highlights recently issued certs and newly appearing hosts — high-signal for fresh or misconfigured deployments.
+
+## Consolidation & Probing
+
+1. **Dedupe** names and IPs into one inventory; record source(s) per asset for confidence.
+2. **Live probe** with `httpx`, capturing status/title/tech/server and cert SANs in one pass — each grabbed SAN feeds back as a new seed:
+   `httpx -l hosts.txt -sc -title -server -td -tls-grab -json -o assets.jsonl`
+3. **Classify** assets by function from title/tech/path signals: app, API, marketing, auth, CI/CD, observability, storage, admin, VCS, mail. Cluster by role, not by a specific product.
+4. **Port sweep** interesting hosts with `naabu` for non-HTTP services (DBs, caches, brokers, mgmt ports).
+5. **Prioritize** by exposure and value, then hand each finding to the right specialist skill:
+   - Exposed dashboards / debug / observability / metadata leaks → `information_disclosure`
+   - Login/admin panels with default or weak creds → `weak_password_detection`
+   - Dangling DNS / unclaimed provider resources → `subdomain_takeover`
+   - Cloud consoles/metadata surfaces → `aws` / `gcp` / `kubernetes`
+
+## Testing Methodology
+
+1. **Seed** - domains, org/legal names, known IPs, email domains, code-host org
+2. **Certificate transparency** - pull all logged certs per seed domain and org name (crt.sh, Censys/Shodan)
+3. **SAN/CN extraction** - parse every Subject CN and SAN with `httpx -tls-grab` (or `openssl s_client`); each new name is a new seed
+4. **Passive DNS** - resolve forward and reverse with `dig`; harvest historical records
+5. **ASN/IP mapping** - `whois` the netblock/ASN to expand owned ranges, then sweep for live hosts
+6. **Active TLS pivot** - `httpx -tls-grab` on live IPs/ports to grab SANs missing from public CT
+7. **Consolidate & probe** - dedupe, `httpx` probe, classify, and route to specialists
+
+## Validation
+
+1. Confirm each discovered asset actually resolves and serves content (live `httpx` result, not just a passive hit)
+2. Attribute assets to the target via matching cert org, shared cert fingerprint, or DNS under a seed domain
+3. Deduplicate vhost aliases and CDN edges down to distinct origins so the surface is not inflated
+4. Record provenance (which source produced each asset) for reproducibility
+
+## False Positives
+
+- CDN/edge hostnames and provider default names that are not org-owned
+- Shared-hosting neighbors on the same IP (vhost co-tenancy, not the target's asset)
+- Stale historical DNS entries pointing at reassigned infrastructure
+- Wildcard-cert-implied hostnames that never actually resolve or serve content
+
+## Impact
+
+- Expanded attack surface: forgotten, staging, and internal-named hosts brute force misses
+- Discovery of misconfigured or unauthenticated services fronted by leaked internal hostnames
+- Attribution of shadow infra, acquisitions, and sibling domains to the target
+- A prioritized, classified inventory that feeds every downstream specialist skill
+
+## Pro Tips
+
+1. Loop the pipeline — every SAN, PTR, and CNAME target is a new seed until the set converges.
+2. crt.sh is the cheapest high-yield source (no key); Censys/Shodan add cert-fingerprint and vhost pivoting when keys exist.
+3. Always cert-grab live hosts with `httpx -tls-grab` (or `openssl s_client`) — active SANs catch internal hostnames never sent to public CT.
+4. Internal-looking SANs (`*.internal`, `*.svc.cluster.local`, staging names) are the highest-signal leads.
+5. Wildcard SANs reveal naming conventions — seed targeted guesses instead of blind brute force.
+6. Cluster by function, not product name, so the workflow generalizes to any exposed service.
+7. Keep JSON output throughout so stages chain cleanly (`subfinder` → `dig` → `httpx` → `naabu`).
+
+## Summary
+
+Broad passive discovery — CT + TLS SAN pivoting + passive DNS + ASN/IP mapping, looped until convergence — finds the assets brute force misses, especially internal-named and forgotten services leaked through certificates. Build the inventory with `subfinder`, `httpx`, `naabu`, and CT/DNS/cert queries, probe and classify it generically, then route each interesting asset to the specialist skill for its class.