/johnwick

name: johnwick
description: Use when the user says "run johnwick" / "/johnwick", hands you a bug-bounty target or scope and wants the full manual+recon+automated hunt run end-to-end, or asks to hunt a target with total coverage (every in-scope domain/subdomain, all JS, signup+login, then exploit and validate). Self-contained long-running orchestrator — recon, JS mining, auto-signup, and hunting for IDOR, SSRF, RCE, SSTI, XXE, SQLi, request smuggling, cache poisoning, race conditions, OAuth/JWT/SAML ATO, GraphQL, 403-bypass, and mobile are all built in via internal reference files (each grounded in disclosed paid HackerOne reports), with a zero-skip coverage ledger and a superpowers verification gate between every phase.

<!-- MANDATORY-JS-RECON-DOCTRINE v1 — injected across EVERY skill. Do not delete or gate behind a condition. -->

🚨 MANDATORY JS RECON GATE — NO SKIP, NO EXCEPTIONS

**This block is law in every skill.** Whatever else this skill does, if a web/HTTP target is anywhere in scope you MUST complete the JS recon pipeline below BEFORE you conclude recon, rank surface, declare "nothing found," or move to the next phase. Skipping any step is a **process failure, not an optimization.** There is no file-count exception, no time-pressure exception, no "it's a small app / SPA / static site" exception.

> Client-side JS is the attack-surface map of the entire application. Every bundle, chunk, > worker, and source map leaks endpoints, secrets, roles, feature flags, and business logic > the server never meant you to see. Hunters who skip JS lose the P1s.

---

RULE 1 — The three crawlers are MANDATORY on EVERY live host

Run **all three** — never just one, never "pick your favourite." Enumerate subdomains first, then run this per host (each subdomain can ship its own bundle, secrets, and logic):

subfinder -d "$T" -all -silent | httpx -silent -mc 200 -o live_hosts.txt   # per-host, not per-apex

# PASSIVE (zero-touch history — catches dead/forgotten/rotated-but-still-live JS)
echo "$HOST" | waybackurls | grep -iE '\.js(\?|$)' | anew js.txt
echo "$HOST" | gau --subs   | grep -iE '\.js(\?|$)' | anew js.txt   # gauplus --subs = same

# ACTIVE (live DOM, dynamic <script>, chunk loads)
katana   -u "https://$HOST" -jc -jsl -d 5 -silent | grep -iE '\.js(\?|$)' | anew js.txt
hakrawler -u "https://$HOST" -d 3 -subs 2>/dev/null | grep -iE '\.js'     | anew js.txt
gospider  -s "https://$HOST" -d 3 --js 2>/dev/null  | grep -oE 'https?://\S+\.js' | anew js.txt

**MANUAL CRAWL is equally mandatory — tools miss auth-gated and lazy-loaded routes:**

• Open the app in a real browser with Burp/mitmproxy inline. **Log in.**
• Click through **every** route, tab, modal, multi-step wizard, settings/admin area.
• Watch the Network panel: every `.js`, every XHR/fetch, every chunk pulled on navigation

goes into `js.txt` / the endpoint list. SPAs load chunks lazily — a route you never visited = a bundle you never saw = bugs you never found.

• Toggle every feature you can and note the JS that loads behind each one.
• Burp extensions **JS Miner** + **Param Miner** run passively while you browse — enable both.

---

RULE 2 — Recover, beautify, and READ every file (never grep-only)

sort -u js.txt -o js.txt && mkdir -p js_files beautified recovered
xargs -a js.txt -P20 -I@ sh -c 'curl -sL -A "Mozilla/5.0" "@" -o "js_files/$(echo @ | md5sum | cut -c1-16).js"'
for f in js_files/*.js; do js-beautify "$f" > "beautified/$(basename "$f")"; done

# SOURCE MAPS = full original source (readable, real var names, internal paths). A 200 is game over.
while read u; do curl -so /dev/null -w "%{http_code} $u.map\n" "$u.map"; done < js.txt | grep '^200'
sourcemapper -url "https://$HOST/static/main.js.map" -output ./recovered/   # or unwebpack / webcrack

# WEBPACK: pull the runtime bootstrap's chunk-id→hash map to enumerate LAZY chunks no crawler triggered
grep -oE '[0-9]+:"[0-9a-f]{6,}"' beautified/*runtime* 2>/dev/null | head -50

**Grep is a triage pass to prioritize — NEVER the analysis itself.** Grep finds `apikey` and `fetch(`. It does not tell you a URL-upload feature silently proxies server-side (SSRF), or that a role flag is set client-side and never re-checked. **Every beautified/deobfuscated file gets read end to end.** No exception for hundreds of files across dozens of hosts — budget the time; this step is supposed to be slow.

---

RULE 3 — Hunt these in every file (the money list)

Static-scan to triage, then READ to confirm. Scanners: `trufflehog filesystem js_files/` (verifies live keys), `jsluice urls|secrets js_files/*.js`, `mantra -f js.txt`, `SecretFinder -i <f> -o cli`, `LinkFinder -i beautified/ -o cli`, `xnLinkFinder`, `nuclei -t http/exposures/ -l js.txt`, `retire.js --js`.

• **Secrets / tokens** — AWS `AKIA…`, GCP `AIza…`, Stripe `sk_live_`, GitHub `ghp_`/`github_pat_`,

Slack `xox…`, SendGrid `SG.`, Twilio `AC…`, JWTs `eyJ…`, `Authorization: Basic` blobs, `client_id`+`client_secret`, Firebase config, Algolia **admin** key, Mapbox `sk.`, private PEM keys.

• **Hidden / internal / staging endpoints** — every endpoint in JS is an UNTESTED endpoint. Grep

`/api/`, `/internal/`, `/admin/`, `/graphql`, `v1|v2|v3`, `*-dev|staging|uat|sandbox`. Real payout pattern: `/api/v2/internal/users` recovered from obfuscated JS → full user DB → $25k.

• **Client-side auth & roles** — `isAdmin`, `role === 'admin'`, `hasPermission`, `parseJwt`,

`atob(token)`, `localStorage.setItem('admin',…)`. Any UI/route gated ONLY client-side is a BAC/BFLA lead — call the endpoint directly with a low-priv token.

• **Hidden routes & feature flags** — dump the SPA router table (React Router / Vue Router / Angular

route config) from the bundle → visit admin/beta/internal routes the nav never links. **Flip feature flags** (`localStorage`, `?feature=`, cookie, JSON config) to unlock ungated functionality.

• **Hardcoded IDs / IDOR seeds** — UUIDs and numeric `userId/orgId/accountId` be