hunt-dispatch

Name: hunt-dispatch
Author: elementalsouls

3.0kstars461forks

How to install hunt-dispatch?

elementalsouls/claude-bughunter/hunt-dispatch

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-dispatch

Installs into the current project.

Summary

Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and pri

Files · 1

View on GitHub

SKILL.md

1	# hunt-dispatch
2
3	skill-set loader for `/hunt`. one concept (which skills to load), one place.
4
5	invocation contract:
6
7	```
8	hunt-dispatch mode=redteam
9	hunt-dispatch mode=wapt box=blackbox
10	hunt-dispatch mode=wapt box=greybox
11	```
12
13	## step 1 — fingerprint (red team only)
14
15	fingerprint every live host, not just the apex. for multi-host / wildcard
16	targets the platform-skill routing must be driven by all banners, not one host's.
17
18	use `-L` (follow redirects) — identity-provider and CDN signals
19	(`login.microsoftonline.com`, `okta`, `auth0`, CDN banners) routinely sit
20	behind a 30x, so a no-redirect `curl -sI` silently misses those matches. pull
21	both headers and the landing-page HTML (`__NEXT_DATA__`, `VIEWSTATE`,
22	`laravel_session`, `Ignition`, framework markers live in the body, not headers).
23
24	```bash
25	HOSTS="$TARGET"
26	if [ -f "recon/$TARGET/live-hosts.txt" ]; then
27	HOSTS=$(cat "recon/$TARGET/live-hosts.txt")
28	fi
29	for H in $HOSTS; do
30	echo "=== $H ==="
31	# -L follow redirects, -D - dump headers, -o body; cap body to keep context small
32	curl -sSL -m 12 -D - -o /tmp/fp_body "https://$H" 2>/dev/null \| tr -d '\r'
33	# surface body-only platform markers
34	grep -aoE '__NEXT_DATA__\|/_next/\|VIEWSTATE\|rO0[AB]\|laravel_session\|Ignition\|Telescope\|Whitelabel\|/actuator\|application/grpc\|socket\.io\|swagger\|\.js\.map' \
35	/tmp/fp_body \| sort -u
36	done
37	rm -f /tmp/fp_body
38	```
39
40	if `live-hosts.txt` is absent, the loop still runs once against `$TARGET`. record
41	which signal came from which host — a platform skill matched on host B does not
42	imply host A runs that stack.
43
44	look for the following signals → platform skill mapping:
45
46	```
47	okta.com \| auth0.com \| pingidentity → okta-attack
48	login.microsoftonline.com \| outlook \| sts → m365-entra-attack
49	pulse \| fortinet \| ivanti \| citrix → enterprise-vpn-attack
50	vsphere \| vcenter \| :9443 → vmware-vcenter-attack
51	amazonaws \| azure \| googleapis \| gcp → cloud-iam-deep
52	github.com/<org>/ → supply-chain-attack-recon
53	.apk \| play.google.com → apk-redteam-pipeline
54	MongoDB \| mongoose \| CouchDB \| Redis → hunt-nosqli
55	?page= \| ?file= \| ?path= \| php wrapper → hunt-lfi
56	rO0A \| VIEWSTATE \| rememberMe cookie → hunt-deserialization
57	Access-Control-Allow-Origin header → hunt-cors
58	/forgot-password \| /reset \| X-Forwarded → hunt-host-header
59	?redirect= \| ?next= \| ?return= \| ?url= → hunt-open-redirect
60	OTP \| /verify \| /2fa \| no-rate-limit → hunt-brute-force
61	Set-Cookie session \| PHPSESSID → hunt-session
62	Active Directory \| LDAP \| OpenLDAP \| ADFS → hunt-ldap
63	__NEXT_DATA__ \| /_next/ \| buildId → hunt-nextjs
64	X-Powered-By: Express \| Node.js \| .js stack → hunt-nodejs
65	postMessage \| dangerouslySetInnerHTML → hunt-dom
66	WebSocket \| ws:// \| socket.io → hunt-websocket
67	gRPC \| :50051 \| application/grpc → hunt-grpc
68	laravel_session \| Ignition \| Telescope → hunt-laravel
69	X-Application-Context \| Whitelabel \| /actuator → hunt-springboot
70	:6443 \| :10250 \| :2379 \| kubectl → hunt-k8s
71	.github/workflows \| Jenkins \| GitLab CI → hunt-cicd
72	.js.map \| swagger.json \| /.env → hunt-source-leak
73	HSTS missing \| SPF \| DMARC \| AXFR → hunt-tls-network
74	```
75
76	### conflict resolution & load budget
77
78	real targets almost always return multiple signals at once — e.g. a single host
79	can show Cloudflare (CDN) + `login.microsoftonline.com` (redirect) + `__NEXT_DATA__`
80	(Next.js front end) + `amazonaws` (origin) simultaneously. loading every match
81	blindly can pull 20-plus skills and blow the context window, drowning the
82	high-signal skill in noise. apply this precedence and cap:
83
84	priority order (load highest tiers first, stop at the cap):
85
86	```
87	tier 1 identity / SSO fabric okta-attack, m365-entra-attack
88	(own the auth boundary — highest blast radius if compromised)
89	tier 2 perimeter appliances enterprise-vpn-attack, vmware-vcenter-attack
90	(pre-auth RCE / direct internal foothold)
91	tier 3 cloud / IAM cloud-iam-deep, hunt-cloud-misconfig
92	(credential → lateral movement)
93	tier 4 app framework / stack hunt-nextjs, hunt-nodejs, hunt-laravel,
94	hunt-springboot, hunt-aspnet, hunt-sharepoint
95	tier 5 protocol / class signals hunt-nosqli, hunt-lfi, hunt-deserialization,
96	hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,
97	hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,
98	hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session
99	```
100
101	load budget: cap platform-skill loads at 8.

People who liked this also viewed

6 picks

Type

hunt-dispatch

3.0kstars461forks

View on GitHub

How to install hunt-dispatch?

elementalsouls/claude-bughunter/hunt-dispatch

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-dispatch

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# hunt-dispatch
2
3	skill-set loader for `/hunt`. one concept (which skills to load), one place.
4
5	invocation contract:
6
7	```
8	hunt-dispatch mode=redteam
9	hunt-dispatch mode=wapt box=blackbox
10	hunt-dispatch mode=wapt box=greybox
11	```
12
13	## step 1 — fingerprint (red team only)
14
15	fingerprint every live host, not just the apex. for multi-host / wildcard
16	targets the platform-skill routing must be driven by all banners, not one host's.
17
18	use `-L` (follow redirects) — identity-provider and CDN signals
19	(`login.microsoftonline.com`, `okta`, `auth0`, CDN banners) routinely sit
20	behind a 30x, so a no-redirect `curl -sI` silently misses those matches. pull
21	both headers and the landing-page HTML (`__NEXT_DATA__`, `VIEWSTATE`,
22	`laravel_session`, `Ignition`, framework markers live in the body, not headers).
23
24	```bash
25	HOSTS="$TARGET"
26	if [ -f "recon/$TARGET/live-hosts.txt" ]; then
27	HOSTS=$(cat "recon/$TARGET/live-hosts.txt")
28	fi
29	for H in $HOSTS; do
30	echo "=== $H ==="
31	# -L follow redirects, -D - dump headers, -o body; cap body to keep context small
32	curl -sSL -m 12 -D - -o /tmp/fp_body "https://$H" 2>/dev/null \| tr -d '\r'
33	# surface body-only platform markers
34	grep -aoE '__NEXT_DATA__\|/_next/\|VIEWSTATE\|rO0[AB]\|laravel_session\|Ignition\|Telescope\|Whitelabel\|/actuator\|application/grpc\|socket\.io\|swagger\|\.js\.map' \
35	/tmp/fp_body \| sort -u
36	done
37	rm -f /tmp/fp_body
38	```
39
40	if `live-hosts.txt` is absent, the loop still runs once against `$TARGET`. record
41	which signal came from which host — a platform skill matched on host B does not
42	imply host A runs that stack.
43
44	look for the following signals → platform skill mapping:
45
46	```
47	okta.com \| auth0.com \| pingidentity → okta-attack
48	login.microsoftonline.com \| outlook \| sts → m365-entra-attack
49	pulse \| fortinet \| ivanti \| citrix → enterprise-vpn-attack
50	vsphere \| vcenter \| :9443 → vmware-vcenter-attack
51	amazonaws \| azure \| googleapis \| gcp → cloud-iam-deep
52	github.com/<org>/ → supply-chain-attack-recon
53	.apk \| play.google.com → apk-redteam-pipeline
54	MongoDB \| mongoose \| CouchDB \| Redis → hunt-nosqli
55	?page= \| ?file= \| ?path= \| php wrapper → hunt-lfi
56	rO0A \| VIEWSTATE \| rememberMe cookie → hunt-deserialization
57	Access-Control-Allow-Origin header → hunt-cors
58	/forgot-password \| /reset \| X-Forwarded → hunt-host-header
59	?redirect= \| ?next= \| ?return= \| ?url= → hunt-open-redirect
60	OTP \| /verify \| /2fa \| no-rate-limit → hunt-brute-force
61	Set-Cookie session \| PHPSESSID → hunt-session
62	Active Directory \| LDAP \| OpenLDAP \| ADFS → hunt-ldap
63	__NEXT_DATA__ \| /_next/ \| buildId → hunt-nextjs
64	X-Powered-By: Express \| Node.js \| .js stack → hunt-nodejs
65	postMessage \| dangerouslySetInnerHTML → hunt-dom
66	WebSocket \| ws:// \| socket.io → hunt-websocket
67	gRPC \| :50051 \| application/grpc → hunt-grpc
68	laravel_session \| Ignition \| Telescope → hunt-laravel
69	X-Application-Context \| Whitelabel \| /actuator → hunt-springboot
70	:6443 \| :10250 \| :2379 \| kubectl → hunt-k8s
71	.github/workflows \| Jenkins \| GitLab CI → hunt-cicd
72	.js.map \| swagger.json \| /.env → hunt-source-leak
73	HSTS missing \| SPF \| DMARC \| AXFR → hunt-tls-network
74	```
75
76	### conflict resolution & load budget
77
78	real targets almost always return multiple signals at once — e.g. a single host
79	can show Cloudflare (CDN) + `login.microsoftonline.com` (redirect) + `__NEXT_DATA__`
80	(Next.js front end) + `amazonaws` (origin) simultaneously. loading every match
81	blindly can pull 20-plus skills and blow the context window, drowning the
82	high-signal skill in noise. apply this precedence and cap:
83
84	priority order (load highest tiers first, stop at the cap):
85
86	```
87	tier 1 identity / SSO fabric okta-attack, m365-entra-attack
88	(own the auth boundary — highest blast radius if compromised)
89	tier 2 perimeter appliances enterprise-vpn-attack, vmware-vcenter-attack
90	(pre-auth RCE / direct internal foothold)
91	tier 3 cloud / IAM cloud-iam-deep, hunt-cloud-misconfig
92	(credential → lateral movement)
93	tier 4 app framework / stack hunt-nextjs, hunt-nodejs, hunt-laravel,
94	hunt-springboot, hunt-aspnet, hunt-sharepoint
95	tier 5 protocol / class signals hunt-nosqli, hunt-lfi, hunt-deserialization,
96	hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,
97	hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,
98	hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session
99	```
100
101	load budget: cap platform-skill loads at 8.

People who liked this also viewed

6 picks

Type