opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/web2-recon/references/details.md

@@ -0,0 +1,319 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `web2-recon`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## 30-MINUTE RECON PROTOCOL
+
+### Minutes 0-5: Read Program Page
+
+```
+Note:
+- ALL in-scope assets (every domain listed)
+- Out-of-scope list (read carefully — common trap)
+- Safe harbor statement
+- Impact types accepted (some exclude "low")
+- Average bounty amount (signals program generosity)
+```
+
+### Minutes 5-15: Asset Discovery
+
+Run the standard pipeline above. Focus on live.txt output.
+
+### Minutes 15-25: Surface Map
+
+Run gf patterns and the interesting-params grep above.
+
+### Minutes 25-30: Manual Exploration
+
+Open Burp Suite. Browse the app with proxy on:
+1. Register an account
+2. Perform main user actions (create/read/update/delete resources)
+3. Note all API calls in Burp history
+4. Look for endpoints not in your URL list
+
+### After 30 min: Prioritize
+
+```
+Priority 1: API endpoints with ID parameters → IDOR candidates
+Priority 2: File upload features → XSS/RCE candidates
+Priority 3: OAuth/SSO flows → auth bypass candidates
+Priority 4: Search/filter with user input → SQLi/SSRF/SSTI candidates
+Priority 5: Admin/debug endpoints → auth bypass candidates
+```
+
+---
+
+
+## Toolchain fallback (when `dnsx` / `httpx` crash)
+
+The projectdiscovery Go binaries (`dnsx`, `httpx`, `naabu`) occasionally `SIGSEGV` on macOS arm64 due to a cgo / system-resolver interaction. The crash signature is identical regardless of install method — both `brew install` and `go install github.com/projectdiscovery/<tool>@latest` produce binaries that segfault at the same address. Smoke-test once before relying on them in a real engagement:
+
+```bash
+dnsx -version   # if SIGSEGV: use the dig fallback below
+httpx -version  # if SIGSEGV: use the curl fallback below
+```
+
+### `dnsx` → `dig` fallback
+
+```bash
+# Replaces: dnsx -l subs.txt -a -resp -silent
+while read s; do
+  ips=$(dig +short +tries=1 +time=3 "$s" \
+    | grep -E '^[0-9.]+$' \
+    | paste -sd, -)
+  [ -n "$ips" ] && echo "$s|$ips"
+done < subs.txt
+```
+
+### `httpx` → `curl` fallback
+
+```bash
+# Replaces: httpx -l subs.txt -silent -status-code -title -tech-detect
+while read s; do
+  resp=$(curl -s -L -m 5 -o /tmp/body \
+    -w "%{http_code}|%{url_effective}|%{header_server}" \
+    "https://$s")
+  code=$(echo "$resp" | cut -d'|' -f1)
+  if [ "$code" != "000" ]; then
+    title=$(grep -oE '<title[^>]*>[^<]*</title>' /tmp/body | head -1 | sed 's/<[^>]*>//g')
+    echo "$s|$resp|$title"
+  fi
+done < subs.txt
+```
+
+**Trade-off:** Serial vs. concurrent. The fallback handles ~24 subdomains in 14 seconds; the same workload on `httpx` with default 50 threads finishes in 2-3 seconds. For VDP-scale recon (< 100 subdomains) the fallback is fine. For mass recon (1000+) fix the toolchain first.
+
+Verified against HackerOne's own VDP in `docs/verification/recon-hackerone-vdp.md`.
+
+---
+
+
+## API Spec / Swagger / OpenAPI Discovery (2024-2026 surface)
+
+API spec endpoints are the single highest-leverage recon target on any modern .NET / Node / Python / Java backend. The spec discloses every endpoint, HTTP methods, parameter names + types + formats, models, validation rules — a complete attack-map in JSON. Default routes are commonly left enabled in production. **Add this wordlist to the directory-fuzzing phase** (after the standard `common.txt` pass).
+
+### Default discovery path wordlist (paste into `swagger-paths.txt`)
+
+```
+# NSwag / Swashbuckle (ASP.NET Core)
+/swagger
+/swagger/
+/swagger/index.html
+/swagger/ui/index.html
+/swagger/v1/swagger.json
+/swagger/v2/swagger.json
+/swagger/v3/swagger.json
+/swagger/docs/v1
+/swagger/docs/v2
+/swagger-ui
+/swagger-ui/
+/swagger-ui.html
+/swagger-resources
+/swagger-resources/configuration/ui
+/nswag
+/nswag/index.html
+/api/swagger
+/api/swagger.json
+/api/swagger/v1/swagger.json
+/api/openapi
+/api/openapi.json
+/api/v1/swagger.json
+/api/v2/swagger.json
+/api-docs
+/api-docs/swagger.json
+
+# OpenAPI generic
+/openapi
+/openapi.json
+/openapi.yaml
+/openapi.yml
+/openapi/v1.json
+/openapi/v2.json
+/openapi/v3.json
+/.well-known/openapi.json
+
+# Java / Spring (Springfox / springdoc)
+/v2/api-docs
+/v3/api-docs
+/v3/api-docs.yaml
+/v3/api-docs/swagger-config
+/swagger-ui/index.html
+
+# Python (FastAPI / Flask-RESTPlus / Connexion / DRF)
+/docs
+/docs/
+/redoc
+/redoc/
+/openapi.json
+/swagger.json
+/swagger/?format=openapi
+/swagger.yaml
+
+# Express / Node / Hapi
+/api-docs
+/api-docs.json
+/swagger.json
+/swagger-stats
+/graphql-docs
+
+# GraphQL adjacent (often co-located)
+/graphql
+/graphiql
+/playground
+/altair
+/voyager
+/graphql/console
+/graphql-explorer
+
+# ReDoc / RapiDoc / Stoplight / alt UIs
+/redoc
+/redoc.html
+/redoc-ui.html
+/rapidoc
+/rapidoc.html
+/stoplight
+/elements
+
+# Misc / dev-leftover
+/actuator
+/actuator/openapi
+/actuator/mappings
+/q/openapi
+/q/swagger-ui
+/docs/swagger.json
+/api/v1/docs
+/api/v2/docs
+/internal/swagger
+/admin/swagger
+/management/swagger
+```
+
+### Integration with the standard pipeline
+
+```bash
+# After live-hosts.txt is built (Phase 1 / 2), run:
+ffuf -w swagger-paths.txt -u "https://FUZZ.target.com" -mc 200,302 -fs 0 -t 50 -o swagger-hits.json
+# Or with httpx for content-aware filtering:
+httpx -l live-hosts.txt -path swagger-paths.txt -mc 200 -mr "swagger|openapi" -json | tee swagger-hits.jsonl
+# For every hit:
+jq '.paths | keys' swagger.json > endpoints.txt
+jq '.components.schemas' swagger.json > schemas.json   # mass-assignment field candidates
+```
+
+### Why this matters for recon-to-hunting handoff
+
+- **Spec → mass IDOR/BOLA** — `jq '.paths | keys' swagger.json` becomes the input list for `Autorize`/`ffuf` per-user testing.
+- **Spec → mass-assignment payload construction** — `components.schemas.UserUpdateDto` enumerates `isAdmin`, `emailVerified`, `tenantId`, `role`.
+- **Spec → hidden endpoint discovery** — `/internal/*`, `/debug/*`, `/v0/*`, `/legacy/*` routes documented but never auth-gated.
+- **Spec → injection-class seeding** — every parameter's type + format + enum + max-length means payloads pass validation before reaching the sink. Especially valuable against ASP.NET Core where the model binder rejects malformed input before any controller logic.
+
+### Tools
+
+- `kiterunner` — natively ingests OpenAPI spec, generates requests against the API.
+- `sj` (Swagger Jacker) — purpose-built for Swagger spec exploitation.
+- `apidetector` (brinhosa) — Swagger-UI mass scanner.
+- `XSSwagger` (vavkamil) — detects vulnerable Swagger UI versions (CVE-2018-25031 family).
+- `nuclei -t http/exposures/apis/` — built-in templates for default spec paths.
+
+### Anti-pattern reminder
+
+A 404/403 on `/swagger` does NOT mean no spec is exposed. Many .NET projects route the spec under `/api/swagger/v1/swagger.json` rather than `/swagger`. Always test the full path list, not just the root.
+
+Full attack-chain analysis is in `hunt-api-misconfig` → `NSwag / Swagger / OpenAPI Spec Exposure`.
+
+---
+
+
+## Related Skills & Chains
+
+- **`offensive-osint`** — When recon needs concrete probes / wordlists / regexes beyond the basic pipeline. Workflow primitive: this skill produces the URL set; `offensive-osint` provides the secret regexes, GraphQL/Swagger paths, and identity-fabric probes you apply to that URL set.
+- **`osint-methodology`** — When you need a severity rubric for what you discovered. Workflow primitive: after recon outputs `subdomains.txt` / `live-hosts.txt` / `urls.txt`, score each asset against `osint-methodology`'s findings rubric to decide what gets a finding versus what stays in the asset graph.
+- **`hunt-subdomain`** — When recon surfaces stale CNAMEs / dangling DNS. Workflow primitive: any subdomain in `subdomains.txt` whose CNAME points to S3 / GitHub Pages / Heroku / Shopify / Azure should auto-route to `hunt-subdomain` for takeover validation.
+- **`security-arsenal`** — When the URL set is classified by `gf` and ready for active testing. Workflow primitive: `gf xss/ssrf/sqli/idor` output names become payload-class queries against `security-arsenal`'s payload library.
+- **`bb-methodology`** — When recon completes and Phase 1 transitions to Phase 2 (Mapping). Workflow primitive: hand the live host + URL set back to `bb-methodology` Phase 2 for endpoint mapping and Phase 3 vulnerability discovery routing.
+
+---
+
+
+## Operator Notes (Claude-BugHunter)
+
+> Engagement-derived + 2026-specific additions to the vendored foundation.
+> Wisdom from real authorized engagements + Phase 2 verification across
+> this repo's 31+ skill-area live tests. The upstream pipeline covers the WHAT;
+> this layer covers the WHEN-IT-WORKS-vs-WHEN-IT-DOESN'T.
+
+### Cross-TLD pivot discipline
+
+Phase 2C's HackerOne VDP recon walked from `hackerone.com` (24 subdomains) into a sister TLD `hacker.one` (12 more subdomains found in JS bundle references). Operators who only enumerate `*.target.com` miss attack surface that the target legitimately operates on a different domain.
+
+Always grep JS bundles for plausible sibling TLDs:
+
+```bash
+# pull all JS, grep for sibling-TLD candidates
+for url in $(cat live-hosts.txt); do
+  curl -s "$url" | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//'
+done | sort -u > js-urls.txt
+
+# then on each JS file
+for j in $(cat js-urls.txt); do
+  curl -s "$j" | grep -oE '[a-z0-9.-]+\.(io|app|one|dev|test|cloud|ai|co)' | sort -u
+done | sort -u > sibling-tld-candidates.txt
+```
+
+Common sibling-TLD patterns: `target.com → target.io / target.app / target.one / target.dev / target.test / target-corp.com / target-cdn.net`. Always validate via WHOIS or by checking if the cert chain trusts the same internal CA before treating the sister TLD as in-scope.
+
+### Subdomain wordlist priorities by 2026
+
+Top discovery prefixes by hit rate against enterprise VDPs in our 2024-2026 corpus:
+
+```
+mta-sts.*          api.*              docs.*
+dev-*              staging-*          *-qa
+*-stage            *-uat              events.*
+portal.*           customer.*         partner.*
+vendor.*           internal-*         admin-*
+employee-*         hr.*               jobs.*
+sso.*              auth.*             id.*
+```
+
+Internal-looking subdomains often expose more surface than the marketing site — `partner.target.com` and `vendor-portal.target.com` frequently have weaker auth than the main app because they're scoped for "trusted" external users. Always send a probe to the long-tail wordlist after the standard subfinder run completes.
+
+### Live-host probe: how to fingerprint stack quickly
+
+`curl -sI <host>` headers are 80% of the fingerprint:
+
+- `Server:` — apache / nginx / cloudflare / kestrel (= .NET Core) / openresty / envoy
+- `X-Powered-By:` — PHP version, ASP.NET version, Express.js
+- `X-Drupal-Cache`, `X-Generator: Drupal 9` — Drupal
+- `X-Generator: WordPress` — WordPress
+- `Via:` — CDN chain (1.1 varnish, 1.1 cloudfront)
+- `Set-Cookie:` names — `JSESSIONID` (Java), `PHPSESSID` (PHP), `ASP.NET_SessionId` (.NET), `connect.sid` (Express), `laravel_session` (Laravel)
+
+JS bundle filename patterns:
+
+- `/_next/static/` = Next.js
+- `/_nuxt/` = Nuxt
+- `/assets/static/` with hash filenames = Vite
+- `/static/js/main.*.chunk.js` = Create React App
+- `runtime.*.js + polyfills.*.js + main.*.js` = Angular CLI
+
+The first 10s of recon should yield a stack guess; the rest is targeting. If your fingerprint contradicts itself (Server says nginx, Set-Cookie says ASP.NET) you've found a reverse proxy front-end — note the origin app for later smuggling/cache attacks.
+
+### GitHub Pages 404 vs takeover signal
+
+Critical distinction operators get wrong:
+
+- **"Page not found · GitHub Pages"** with HTTP 404 means the repo EXISTS — NOT a takeover.
+- **"There isn't a GitHub Pages site here"** means the repo was deleted — TAKEOVER candidate.
+
+Same distinction for CloudFront:
+
+- **"Error - 404"** with `Server: CloudFront` = distribution exists, origin returned 404 — NOT a takeover.
+- **"The request could not be satisfied"** with `X-Cache: Error from cloudfront` = origin missing entirely — potential takeover.
+
+Phase 2C verified both patterns live. Always check the EXACT response body string before filing a takeover finding — the takeover-scanner tools (subzy, subjack) match on multiple fingerprints and frequently false-positive on the "still owned, just empty" case.
+
+### Toolchain fallback
+
+Already covered in this file's Phase 2C addition. Quick reminder: dnsx/httpx may segfault on macOS arm64; the dig+curl fallback works for < 100-host runs in ~14 seconds. Don't burn an hour debugging Go binary panics when the fallback gets you to the same URL set.
+