ineedcodes 1.6.0 → 1.7.0

package/skills/subdomain-takeover/SKILL.md

@@ -0,0 +1,247 @@
+---
+name: subdomain-takeover
+description: >-
+  Subdomain takeover detection and exploitation playbook. Use when targets have
+  dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired
+  third-party services, or unclaimed SaaS tenants that an attacker can register
+  to serve content under the victim's domain.gated: true
+---
+
+# SKILL: Subdomain Takeover — Detection & Exploitation Playbook
+
+> **AI LOAD INSTRUCTION**: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the *resource behind the CNAME is unclaimed and claimable*.
+
+## 0. RELATED ROUTING
+
+- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when a subdomain takeover is used to bypass SSRF allowlists trusting `*.target.com`
+- [cors-cross-origin-misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) when CORS trusts `*.target.com` — takeover → full cross-origin read
+- [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse)
+- [http-host-header-attacks](../http-host-header-attacks/SKILL.md) when Host routing leads to subdomain-scoped cache or auth issues
+- [web-cache-deception](../web-cache-deception/SKILL.md) when a taken-over subdomain shares cache with the main domain
+
+---
+
+## 1. CORE CONCEPT
+
+Subdomain takeover occurs when:
+
+1. `sub.target.com` has a DNS record (CNAME, NS, A) pointing to an external service
+2. The external resource is **no longer provisioned** (deleted S3 bucket, removed Heroku app, etc.)
+3. The attacker can **register/claim** that exact resource name on the provider
+4. The attacker now controls content served under `sub.target.com`
+
+**Impact**: cookie theft (parent domain cookies), OAuth token interception, phishing under trusted domain, CORS bypass, CSP bypass via whitelisted subdomain.
+
+---
+
+## 2. DETECTION METHODOLOGY
+
+### 2.1 CNAME Enumeration
+
+```
+1. Collect subdomains (amass, subfinder, assetfinder, crt.sh, SecurityTrails)
+2. Resolve DNS for each:
+   dig CNAME sub.target.com +short
+3. For each CNAME → check if the CNAME target returns NXDOMAIN or a provider error
+4. Match error response against fingerprint table (Section 3)
+```
+
+### 2.2 Key Signals
+
+| Signal | Meaning |
+|---|---|
+| CNAME → `xxx.s3.amazonaws.com` + HTTP 404 "NoSuchBucket" | S3 bucket deleted, claimable |
+| CNAME → `xxx.herokuapp.com` + "No such app" | Heroku app deleted |
+| CNAME → `xxx.github.io` + 404 "There isn't a GitHub Pages site here" | GitHub Pages unclaimed |
+| NXDOMAIN on the CNAME target domain itself | Target domain expired or never existed |
+| CNAME → provider but HTTP 200 with default parking page | May or may not be claimable — verify |
+
+### 2.3 Automated Tools
+
+| Tool | Purpose |
+|---|---|
+| `subjack` | Automated CNAME takeover checking |
+| `nuclei -t takeovers/` | Nuclei takeover detection templates |
+| `can-i-take-over-xyz` (GitHub) | Reference for which services are vulnerable |
+| `dnsreaper` | Multi-provider takeover scanner |
+| `subzy` | Fast subdomain takeover verification |
+
+---
+
+## 3. SERVICE PROVIDER FINGERPRINT TABLE
+
+| Provider | CNAME Pattern | Fingerprint (HTTP Response) | Claimable? |
+|---|---|---|---|
+| **AWS S3** | `*.s3.amazonaws.com` / `*.s3-website-*.amazonaws.com` | `NoSuchBucket` (404) | Yes — create bucket with matching name |
+| **GitHub Pages** | `*.github.io` | `There isn't a GitHub Pages site here` (404) | Yes — create repo + enable Pages |
+| **Heroku** | `*.herokuapp.com` / `*.herokudns.com` | `No such app` | Yes — create app with matching name |
+| **Azure** | `*.azurewebsites.net` / `*.cloudapp.azure.com` / `*.trafficmanager.net` | Various default pages, NXDOMAIN | Yes — register matching resource |
+| **Shopify** | `*.myshopify.com` | `Sorry, this shop is currently unavailable` | Yes — create shop, add custom domain |
+| **Fastly** | CNAME to Fastly edge | `Fastly error: unknown domain` | Yes — add domain to Fastly service |
+| **Pantheon** | `*.pantheonsite.io` | `404 Site Not Found` with Pantheon branding | Yes |
+| **Tumblr** | `*.tumblr.com` (custom domain CNAME) | `There's nothing here` / `Whatever you were looking for doesn't exist` | Yes |
+| **WordPress.com** | CNAME to `*.wordpress.com` | `Do you want to register` | Yes — claim domain in WP.com |
+| **Zendesk** | `*.zendesk.com` | `Help Center Closed` / Zendesk branding on error | Yes — create matching subdomain |
+| **Unbounce** | `*.unbouncepages.com` | `The requested URL was not found` | Yes |
+| **Ghost** | `*.ghost.io` | `404 Not Found` Ghost error | Yes |
+| **Surge.sh** | `*.surge.sh` | `project not found` | Yes |
+| **Fly.io** | CNAME to `*.fly.dev` | Fly.io default 404 | Yes |
+
+---
+
+## 4. TAKEOVER PROCEDURE — COMMON PROVIDERS
+
+### 4.1 AWS S3
+
+```
+1. Confirm: curl -s http://sub.target.com → "NoSuchBucket"
+2. Extract bucket name from CNAME (e.g., sub.target.com.s3.amazonaws.com → bucket = "sub.target.com")
+3. aws s3 mb s3://sub.target.com --region <region>
+4. Upload index.html proving control
+5. Enable static website hosting
+```
+
+### 4.2 GitHub Pages
+
+```
+1. Confirm: curl -s https://sub.target.com → "There isn't a GitHub Pages site here"
+2. Create GitHub repo (any name)
+3. Add CNAME file containing "sub.target.com"
+4. Enable GitHub Pages in repo settings
+5. Wait for DNS propagation (GitHub verifies CNAME match)
+```
+
+### 4.3 Heroku
+
+```
+1. Confirm: curl -s http://sub.target.com → "No such app"
+2. heroku create <app-name-from-cname>
+3. heroku domains:add sub.target.com
+4. Deploy proof-of-concept page
+```
+
+---
+
+## 5. NS TAKEOVER — HIGH SEVERITY
+
+NS takeover is **far more dangerous** than CNAME takeover: you control **all DNS resolution** for the zone.
+
+### How It Happens
+
+```
+target.com NS → ns1.expireddomain.com
+                 ↓
+attacker registers expireddomain.com
+                 ↓
+attacker now controls ALL DNS for target.com
+(A records, MX records, TXT records — everything)
+```
+
+### Detection
+
+```
+1. Enumerate NS records: dig NS target.com +short
+2. Check each NS domain: whois ns1.example.com → is the domain expired or available?
+3. Also check: dig A ns1.example.com → NXDOMAIN/SERVFAIL?
+4. Subdelegated zones: check NS for sub.target.com specifically
+```
+
+### Impact
+
+- Full domain takeover (serve any content, intercept email, issue TLS certs via DNS-01)
+- Issue DV certificates from any CA using DNS challenge
+- Modify SPF/DKIM/DMARC → send authenticated email as target
+
+---
+
+## 6. MX TAKEOVER — EMAIL INTERCEPTION
+
+When MX records point to deprovisioned mail services:
+
+```
+target.com MX → mail.deadservice.com (service discontinued)
+```
+
+If attacker can claim `mail.deadservice.com` or the mail tenant:
+- Receive password reset emails
+- Intercept sensitive communications
+- Potentially reset accounts that use email-based auth
+
+### Common Scenario
+
+Expired Google Workspace / Microsoft 365 tenant → MX still points to Google/Microsoft → attacker creates new tenant and claims the domain.
+
+---
+
+## 7. WILDCARD DNS RISKS
+
+If `*.target.com` has a wildcard CNAME to a claimable service:
+- **Every** undefined subdomain is vulnerable
+- `anything.target.com` can be taken over
+- Massively increases attack surface
+
+Detection: `dig A random1234567.target.com` — if it resolves, wildcard exists.
+
+---
+
+## 8. DETECTION & EXPLOITATION DECISION TREE
+
+```
+Subdomain discovered (sub.target.com)?
+├── Resolve DNS records
+│   ├── Has CNAME → external service?
+│   │   ├── HTTP response matches known fingerprint? (Section 3)
+│   │   │   ├── YES → Attempt claim on provider (Section 4)
+│   │   │   │   ├── Claim successful → TAKEOVER CONFIRMED
+│   │   │   │   └── Claim blocked (name reserved, region locked) → document, try variations
+│   │   │   └── NO → Service active, no takeover
+│   │   └── CNAME target NXDOMAIN?
+│   │       ├── Target is a registrable domain? → Register it → full control
+│   │       └── Target is a subdomain of active provider → check provider claim process
+│   │
+│   ├── Has NS records → external nameserver?
+│   │   ├── NS domain expired/available? → Register → FULL ZONE TAKEOVER
+│   │   └── NS domain active → no takeover
+│   │
+│   ├── Has MX → external mail service?
+│   │   ├── Mail service deprovisioned/claimable? → Claim tenant → EMAIL INTERCEPTION
+│   │   └── Active mail service → no takeover
+│   │
+│   └── Has A record → IP address?
+│       ├── IP belongs to elastic cloud (AWS EIP, Azure, GCP)?
+│       │   ├── IP unassigned? → Claim IP → serve content
+│       │   └── IP assigned to another customer → no takeover
+│       └── IP belongs to dedicated server → no takeover
+│
+└── Post-takeover impact assessment
+    ├── Shared cookies with parent domain? → Session hijacking
+    ├── CORS trusts *.target.com? → Cross-origin data theft
+    ├── CSP whitelists *.target.com? → XSS via taken-over subdomain
+    ├── OAuth redirect_uri allows sub.target.com? → Token theft
+    └── Can issue TLS cert for sub.target.com? → Full MITM
+```
+
+---
+
+## 9. DEFENSE & REMEDIATION
+
+| Action | Priority |
+|---|---|
+| Remove DNS records when deprovisioning cloud resources | Critical |
+| Monitor CNAME targets for NXDOMAIN responses | High |
+| Use DNS monitoring tools (SecurityTrails, DNSHistory) | High |
+| Claim/reserve resource names before deleting DNS records | High |
+| Audit NS delegations — ensure NS domains are owned and renewed | Critical |
+| Avoid wildcard CNAMEs to third-party services | Medium |
+| Implement Certificate Transparency monitoring | Medium |
+
+---
+
+## 10. TRICK NOTES — WHAT AI MODELS MISS
+
+1. **CNAME ≠ takeover**: A CNAME to S3 that returns 403 (bucket exists, private) is NOT vulnerable. Only `NoSuchBucket` (404) is.
+2. **Region matters for S3**: Bucket names are global, but website endpoints are regional. Try matching the region from the CNAME.
+3. **GitHub Pages verification**: GitHub added domain verification — org-verified domains cannot be claimed by others. Check if target uses this.
+4. **Edge cases**: Some providers (e.g., Cloudfront) require specific distribution configuration, not just domain claiming.
+5. **Second-order takeover**: `sub.target.com CNAME → other.target.com CNAME → dead-service.com` — the chain must be followed fully.
+6. **SPF subdomain takeover**: If SPF includes `include:sub.target.com` and you take over `sub.target.com`, you can modify its SPF TXT record to authorize your mail server → send spoofed email as `target.com`.

package/skills/symbolic-execution-tools/ANGR_COOKBOOK.md

@@ -0,0 +1,437 @@
+# angr Cookbook — Ready-to-Use Script Patterns for CTF Challenges
+
+> **AI LOAD INSTRUCTION**: Load this when you need drop-in angr script templates for common CTF challenge patterns. Each recipe includes the scenario description, complete script, and adaptation notes. Assumes the main [SKILL.md](./SKILL.md) is already loaded for angr fundamentals.
+
+---
+
+## Recipe 1: Basic find/avoid by Address
+
+**Scenario**: Binary prints "Correct" at 0x401234, "Wrong" at 0x401300. Input via stdin.
+
+```python
+import angr
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].posix.dumps(0))  # fd 0 = stdin
+```
+
+---
+
+## Recipe 2: Find by stdout Content
+
+**Scenario**: Success/failure messages not at fixed addresses (PIE binary or indirect calls).
+
+```python
+import angr
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+
+simgr.explore(
+    find=lambda s: b"Correct" in s.posix.dumps(1),
+    avoid=lambda s: b"Wrong" in s.posix.dumps(1)
+)
+
+if simgr.found:
+    print(simgr.found[0].posix.dumps(0))
+```
+
+---
+
+## Recipe 3: Symbolic stdin with Printable Constraint
+
+**Scenario**: Flag is 32 printable characters read via scanf/fgets.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+FLAG_LEN = 32
+flag = claripy.BVS("flag", 8 * FLAG_LEN)
+
+state = proj.factory.entry_state(stdin=flag)
+
+for i in range(FLAG_LEN):
+    byte = flag.get_byte(i)
+    state.solver.add(byte >= 0x20)
+    state.solver.add(byte <= 0x7e)
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    solution = simgr.found[0].solver.eval(flag, cast_to=bytes)
+    print(f"Flag: {solution}")
+```
+
+---
+
+## Recipe 4: Symbolic argv
+
+**Scenario**: Binary takes flag as command-line argument `./challenge FLAG`.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+flag = claripy.BVS("flag", 8 * 32)
+state = proj.factory.full_init_state(
+    args=['./challenge', flag],
+    add_options=angr.options.unicorn
+)
+
+for i in range(32):
+    b = flag.get_byte(i)
+    state.solver.add(b >= 0x20, b <= 0x7e)
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
+```
+
+---
+
+## Recipe 5: Symbolic File Input
+
+**Scenario**: Binary reads flag from a file.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+flag = claripy.BVS("flag", 8 * 64)
+sim_file = angr.SimFile("flag.txt", content=flag)
+
+state = proj.factory.entry_state(fs={'/tmp/flag.txt': sim_file})
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
+```
+
+---
+
+## Recipe 6: Hook scanf
+
+**Scenario**: Custom scanf that angr's default SimProcedure handles incorrectly.
+
+```python
+import angr
+import claripy
+
+class MyScanf(angr.SimProcedure):
+    def run(self, fmt, ptr):
+        buf = claripy.BVS("scanf_input", 8 * 32)
+        self.state.memory.store(ptr, buf)
+        self.state.globals['scanf_buf'] = buf
+        return 1
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+proj.hook_symbol('__isoc99_scanf', MyScanf())
+
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    found = simgr.found[0]
+    buf = found.globals['scanf_buf']
+    print(found.solver.eval(buf, cast_to=bytes))
+```
+
+---
+
+## Recipe 7: Hook strcmp to Leak Expected Value
+
+**Scenario**: Binary compares input against computed value. Hook strcmp to extract the expected string.
+
+```python
+import angr
+import claripy
+
+class LeakStrcmp(angr.SimProcedure):
+    def run(self, s1, s2):
+        # Read both strings up to null
+        str1 = self.state.memory.load(s1, 64)
+        str2 = self.state.memory.load(s2, 64)
+        self.state.globals['cmp_s1'] = s1
+        self.state.globals['cmp_s2'] = s2
+        return claripy.If(str1 == str2, claripy.BVV(0, 32), claripy.BVV(1, 32))
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+proj.hook_symbol('strcmp', LeakStrcmp())
+
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234)
+
+if simgr.found:
+    found = simgr.found[0]
+    s2_addr = found.solver.eval(found.globals['cmp_s2'])
+    expected = found.memory.load(s2_addr, 32)
+    print(found.solver.eval(expected, cast_to=bytes))
+```
+
+---
+
+## Recipe 8: Start from Specific Function (skip initialization)
+
+**Scenario**: Large binary, but the check function is known. Skip everything before it.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+CHECK_FUNC = 0x401500
+BUF_ADDR = 0x600000
+
+flag = claripy.BVS("flag", 8 * 32)
+
+state = proj.factory.blank_state(addr=CHECK_FUNC)
+state.memory.store(BUF_ADDR, flag)
+state.regs.rdi = BUF_ADDR  # first arg = buffer pointer (System V ABI)
+state.regs.rsi = 32         # second arg = length
+
+state.stack_push(0xDEADBEEF)  # fake return address
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(
+    find=lambda s: b"OK" in s.posix.dumps(1),
+    avoid=lambda s: b"FAIL" in s.posix.dumps(1)
+)
+
+if simgr.found:
+    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
+```
+
+---
+
+## Recipe 9: Veritesting (Merge Paths at Branches)
+
+**Scenario**: Path explosion due to many conditional branches (e.g., per-character check).
+
+```python
+import angr
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+
+simgr.use_technique(angr.exploration_techniques.Veritesting())
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].posix.dumps(0))
+```
+
+---
+
+## Recipe 10: Unicorn Concrete Execution Speedup
+
+**Scenario**: Most code is concrete (no symbolic data), only small portion needs symbolic reasoning.
+
+```python
+import angr
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+state = proj.factory.entry_state(
+    add_options=angr.options.unicorn  # enable Unicorn backend
+)
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].posix.dumps(0))
+```
+
+---
+
+## Recipe 11: Multi-Stage Binary (Sequential Checks)
+
+**Scenario**: Binary has multiple stages, each validating part of the flag.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+stages = [
+    {"find": 0x401100, "avoid": [0x401150]},
+    {"find": 0x401200, "avoid": [0x401250]},
+    {"find": 0x401300, "avoid": [0x401350]},
+]
+
+flag = claripy.BVS("flag", 8 * 48)
+state = proj.factory.entry_state(stdin=flag)
+
+for i, stage in enumerate(stages):
+    simgr = proj.factory.simulation_manager(state)
+    simgr.explore(find=stage["find"], avoid=stage["avoid"])
+    if simgr.found:
+        state = simgr.found[0]
+        partial = state.solver.eval(flag, cast_to=bytes)
+        print(f"Stage {i+1}: {partial}")
+    else:
+        print(f"Stage {i+1} failed")
+        break
+```
+
+---
+
+## Recipe 12: Constrain Flag Format (CTF{...})
+
+**Scenario**: Flag format is known: `flag{...}` with alphanumeric content.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+FLAG_LEN = 40
+flag = claripy.BVS("flag", 8 * FLAG_LEN)
+state = proj.factory.entry_state(stdin=flag)
+
+prefix = b"flag{"
+for i, c in enumerate(prefix):
+    state.solver.add(flag.get_byte(i) == c)
+state.solver.add(flag.get_byte(FLAG_LEN - 1) == ord('}'))
+
+for i in range(len(prefix), FLAG_LEN - 1):
+    b = flag.get_byte(i)
+    state.solver.add(
+        claripy.Or(
+            claripy.And(b >= ord('0'), b <= ord('9')),
+            claripy.And(b >= ord('a'), b <= ord('z')),
+            claripy.And(b >= ord('A'), b <= ord('Z')),
+            b == ord('_'), b == ord('-')
+        )
+    )
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234, avoid=[0x401300])
+
+if simgr.found:
+    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
+```
+
+---
+
+## Recipe 13: Replace rand() with Concrete Value
+
+**Scenario**: Binary uses `rand()` making execution non-deterministic.
+
+```python
+import angr
+
+class ConcreteRand(angr.SimProcedure):
+    def run(self):
+        return 42  # deterministic
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+proj.hook_symbol('rand', ConcreteRand())
+proj.hook_symbol('srand', angr.SIM_PROCEDURES['libc']['srand']())
+
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401234)
+
+if simgr.found:
+    print(simgr.found[0].posix.dumps(0))
+```
+
+---
+
+## Recipe 14: Timeout + DFS for Deep Binaries
+
+**Scenario**: Binary has deep execution path, BFS runs out of memory.
+
+```python
+import angr
+import signal
+
+def timeout_handler(signum, frame):
+    raise TimeoutError("angr timed out")
+
+signal.signal(signal.SIGALRM, timeout_handler)
+signal.alarm(300)  # 5-minute timeout
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+
+simgr.use_technique(angr.exploration_techniques.DFS())
+
+try:
+    simgr.explore(find=0x401234, avoid=[0x401300])
+    if simgr.found:
+        print(simgr.found[0].posix.dumps(0))
+except TimeoutError:
+    print("Timed out — try narrowing search space")
+```
+
+---
+
+## Recipe 15: Symbolic Memory at Global Buffer
+
+**Scenario**: Input is read into a global buffer at a known address, but through a complex path.
+
+```python
+import angr
+import claripy
+
+proj = angr.Project('./challenge', auto_load_libs=False)
+
+GLOBAL_BUF = 0x604080
+CHECK_START = 0x401200
+FLAG_LEN = 24
+
+flag = claripy.BVS("flag", 8 * FLAG_LEN)
+state = proj.factory.blank_state(addr=CHECK_START)
+state.memory.store(GLOBAL_BUF, flag)
+
+for i in range(FLAG_LEN):
+    b = flag.get_byte(i)
+    state.solver.add(b >= 0x20, b <= 0x7e)
+
+simgr = proj.factory.simulation_manager(state)
+simgr.explore(find=0x401300, avoid=[0x401400])
+
+if simgr.found:
+    print(simgr.found[0].solver.eval(flag, cast_to=bytes))
+```
+
+---
+
+## Adaptation Checklist
+
+When adapting any recipe to your specific challenge:
+
+1. **Update addresses**: `find=`, `avoid=`, function addresses, buffer addresses
+2. **Match input method**: stdin, argv, file, or memory — use the right recipe
+3. **Set correct flag length**: Too short = can't find solution; too long = slow
+4. **Add format constraints**: Known prefix, charset, null terminator
+5. **Hook problematic functions**: Any function causing path explosion or crashes
+6. **Choose exploration technique**: BFS (default) for short paths, DFS for deep, Veritesting for branchy
+7. **Enable Unicorn**: `add_options=angr.options.unicorn` for speed on mostly-concrete paths
+8. **Check architecture**: Ensure `auto_load_libs=False` doesn't break needed functionality