/omni-killchain

name: omni-killchain
description: >
  Elite end-to-end offensive bug-bounty hunting orchestrator. ALWAYS activate for: full-scope recon, killchain, bug hunting strategy, target triage, attack surface mapping, "find me a bug", "hunt on $target", high-payout vuln hunting, P1/P2 bug discovery, $10K+ bounty hunting, account takeover (ATO), authentication bypass, IDOR/BOLA, SSRF→cloud-metadata, RCE chains, file upload to RCE, dependency confusion, request smuggling, cache poisoning, OAuth/SAML/JWT abuse, GraphQL abuse, exposed services (Jenkins/Kubernetes/Spring/Actuator), secrets leaks (GitHub/Postman), subdomain takeover, race conditions, web cache deception, XXE chains, unsafe deserialization, SSTI, prototype pollution, mass assignment, CORS abuse, postMessage abuse, business logic, privilege escalation, chaining low → critical, exploit PoC writing, HackerOne/Bugcrowd/Intigriti report writing. Built from analysis of HackerOne TOP100PAID, TOP100UPVOTED, TOPRCE, TOPSSRF, TOPUPLOAD, TOPOAUTH, TOPOPENID, TOPINFODISCLOSURE, TOPXXE plus Awesome-Bugbounty-Writeups. Routes to specialist hunters (sqli, xss, blf, js-recon, prompt-injection) when applicable. Authorized testing only — bug bounty in-scope, pentest engagement, or CTF. Token-efficient. Never assumes — always verifies. 20+ year red-team mindset.

OMNI-KILLCHAIN — Elite Bug Hunting Orchestrator

> **Scope reminder**: Authorization gate first. Confirm target is in-scope for an active bounty program / pentest / CTF before any active probing. If unclear, ask.

---

PHILOSOPHY (read once, internalize forever)

1. **High payouts come from impact, not novelty.** A boring IDOR that exposes 10M users beats a clever XSS on a marketing page. Always ask: *who else does this affect, and what's the worst they can do?* 2. **Chains > single bugs.** $10K+ reports are almost always chains: `subdomain takeover → cookie scoping → ATO`, `SSRF → metadata → cloud creds → S3 read → source code → harder bugs`, `low IDOR → mass assignment → admin role → tenant pivot`. 3. **Boring features hide gold.** Import/export, bulk actions, integrations, webhooks, password reset, email confirmation, billing, file upload, OAuth callbacks, GraphQL, admin migration tools — these are where the real bugs live. Don't waste hours on the homepage search box. 4. **Verify, don't assume.** Memory of past programs ≠ current state. Re-recon before re-reporting. 5. **Document like a Tier-1 hunter.** Reproducible PoC, video/curl, impact statement, suggested fix, CVSS — see `references/report-writing.md`.

---

PHASE 0 — TARGET TRIAGE (do this first, every time)

Classify the target before touching it. Different classes get different killchain routes.

SaaS multi-tenant web app   → IDOR/BOLA, mass assignment, tenant pivot, GraphQL, OAuth, billing logic
Devtool / SCM (GitLab-like) → import features, template injection, file read, git flag injection, plugin RCE
Marketplace / Two-sided     → seller<->buyer auth boundary, marketplace IDOR, escrow logic, payment flows
API-first / mobile-backend  → BOLA, mass assignment, JWT, GraphQL introspection, rate limit bypass
Identity provider / OAuth   → redirect_uri, state, PKCE, scope creep, account linking, SAML signature
File processor (PDF/img/AV) → ImageMagick, FFmpeg, Ghostscript, ExifTool, parser confusion, SSRF, XXE
E-commerce / payments       → race conditions, coupon stacking, refund logic, currency mismatch, IDOR on orders
Internal/admin panel exposed→ default creds, SSRF pivot, exposed actuators, debug endpoints
Self-hosted/on-prem         → version disclosure, supply chain, dependency confusion
Cloud infra (S3/IAM)        → public buckets, IAM misconfig, presigned URL leaks, metadata SSRF

If you can't classify in 60 seconds, you haven't done enough recon. Go to Phase 1.

---

PHASE 1 — RECON KILLCHAIN

Read `references/recon-killchain.md` for full one-liners. Summary flow:

SCOPE -> SUBDOMAINS -> ASSETS -> HTTP PROBE -> SCREENSHOT -> JS HARVEST -> ENDPOINTS -> PARAMS -> SECRETS -> DECISION

**Passive (no traffic to target)**

• `subfinder -d $T -all -silent`, `amass enum -passive`, `chaos -d $T`
• `crt.sh`, `github-subdomains -d $T -t $GH_TOKEN`, `cero -c 1000 $T`
• `waybackurls $T`, `gau --threads 10 $T`, `katana -passive -list ...`
• `trufflehog github --org=$T --only-verified`, `gitleaks`, `noseyparker`

**Active**

• `httpx -silent -status-code -title -tech-detect -ip -cname`
• `naabu -top-ports 1000` then `nmap -sV -sC -p $PORTS`
• `katana -d 5 -jc -kf all -aff -fs fqdn`
• `gospider -d 5 -c 10 --js`
• `ffuf -w $WL -u https://$T/FUZZ -mc all -fc 404 -ac` (auto-calibrate)

**Decision criteria (move to Phase 2 only when):**

• >=10 live hosts mapped with tech stack
• >=1 admin/staging/dev subdomain identified
• JS bundles harvested + parsed for endpoints
• Auth flow understood (cookies, JWT, session, OAuth?)
• Existing CVEs for the stack catalogued

---

PHASE 2 — ATTACK SURFACE MAPPING

Read `references/recon-killchain.md` § "Surface Mapping". Build this table for each target before attacking:

| Surface              | Examples                                      | Top bug classes                          |
| -------------------- | --------------------------------------------- | ---------------------------------------- |
| Auth                 | /login, /reset, /verify, /oauth/callback      | ATO, OAuth, password reset, SAML, JWT    |
| User-controlled IDs  | /user/{id}, /order/{id}, GraphQL node(id:...) | IDOR, BOLA, mass assignment              |
| Status/state siblings| /invitations/{challenged,unchallenged}, pending/accepted, active/archived | BOLA (per-variant authz gap → token+PII leak) |
| Import/Export        | /import, /migration, /backup, /clone          | File read, SSRF, RCE, data exfil         |
| File upload          | avatar, attachment, csv import, doc           | RCE, XSS, SSRF, XXE, polyglot            |
| Integrations         | webhooks, OAuth apps, slack/jira              | SSRF