/pii-hunter

name: pii-hunter
description: >
  Elite PII (Personally Identifiable Information) leak hunting skill for authorized bug bounty and pentests.
  ALWAYS activate for: mass PII exposure, data breach vectors, GDPR-reportable leaks, user data enumeration,
  unauth/cross-tenant PII read, API over-fetching, export/download PII bugs, search/autocomplete PII leaks,
  open datastores with user data, log/debug endpoints with PII, cache-based PII leaks, notification/webhook
  PII leaks, third-party analytics leaking PII, PDF/invoice generation exposing other users' data,
  "find PII leaks on target", "check for data exposure", "test for user data leaks", "GDPR bug", "privacy bug".
  Runs full PII kill chain: surface map → PII vector taxonomy → passive discovery → active probe →
  cross-tenant confirm → scale → validate → report. Includes separate 9-gate PII validation pipeline.
  Authorized testing only. Exfil cap: 1 record + count metadata. No bulk data extraction ever.

<!-- MANDATORY-JS-RECON-DOCTRINE v1 — injected across EVERY skill. Do not delete or gate behind a condition. -->

🚨 MANDATORY JS RECON GATE — NO SKIP, NO EXCEPTIONS

**This block is law in every skill.** Whatever else this skill does, if a web/HTTP target is anywhere in scope you MUST complete the JS recon pipeline below BEFORE you conclude recon, rank surface, declare "nothing found," or move to the next phase. Skipping any step is a **process failure, not an optimization.** There is no file-count exception, no time-pressure exception, no "it's a small app / SPA / static site" exception.

> Client-side JS is the attack-surface map of the entire application. Every bundle, chunk, > worker, and source map leaks endpoints, secrets, roles, feature flags, and business logic > the server never meant you to see. Hunters who skip JS lose the P1s.

---

RULE 1 — The three crawlers are MANDATORY on EVERY live host

Run **all three** — never just one, never "pick your favourite." Enumerate subdomains first, then run this per host (each subdomain can ship its own bundle, secrets, and logic):

subfinder -d "$T" -all -silent | httpx -silent -mc 200 -o live_hosts.txt   # per-host, not per-apex

# PASSIVE (zero-touch history — catches dead/forgotten/rotated-but-still-live JS)
echo "$HOST" | waybackurls | grep -iE '\.js(\?|$)' | anew js.txt
echo "$HOST" | gau --subs   | grep -iE '\.js(\?|$)' | anew js.txt   # gauplus --subs = same

# ACTIVE (live DOM, dynamic <script>, chunk loads)
katana   -u "https://$HOST" -jc -jsl -d 5 -silent | grep -iE '\.js(\?|$)' | anew js.txt
hakrawler -u "https://$HOST" -d 3 -subs 2>/dev/null | grep -iE '\.js'     | anew js.txt
gospider  -s "https://$HOST" -d 3 --js 2>/dev/null  | grep -oE 'https?://\S+\.js' | anew js.txt

**MANUAL CRAWL is equally mandatory — tools miss auth-gated and lazy-loaded routes:**

• Open the app in a real browser with Burp/mitmproxy inline. **Log in.**
• Click through **every** route, tab, modal, multi-step wizard, settings/admin area.
• Watch the Network panel: every `.js`, every XHR/fetch, every chunk pulled on navigation

goes into `js.txt` / the endpoint list. SPAs load chunks lazily — a route you never visited = a bundle you never saw = bugs you never found.

• Toggle every feature you can and note the JS that loads behind each one.
• Burp extensions **JS Miner** + **Param Miner** run passively while you browse — enable both.

---

RULE 2 — Recover, beautify, and READ every file (never grep-only)

sort -u js.txt -o js.txt && mkdir -p js_files beautified recovered
xargs -a js.txt -P20 -I@ sh -c 'curl -sL -A "Mozilla/5.0" "@" -o "js_files/$(echo @ | md5sum | cut -c1-16).js"'
for f in js_files/*.js; do js-beautify "$f" > "beautified/$(basename "$f")"; done

# SOURCE MAPS = full original source (readable, real var names, internal paths). A 200 is game over.
while read u; do curl -so /dev/null -w "%{http_code} $u.map\n" "$u.map"; done < js.txt | grep '^200'
sourcemapper -url "https://$HOST/static/main.js.map" -output ./recovered/   # or unwebpack / webcrack

# WEBPACK: pull the runtime bootstrap's chunk-id→hash map to enumerate LAZY chunks no crawler triggered
grep -oE '[0-9]+:"[0-9a-f]{6,}"' beautified/*runtime* 2>/dev/null | head -50

**Grep is a triage pass to prioritize — NEVER the analysis itself.** Every beautified/deobfuscated file gets read end to end. No exception for hundreds of files across dozens of hosts.

---

RULE 3 — Hunt these in every file (the money list)

Static-scan to triage, then READ to confirm. Scanners: `trufflehog filesystem js_files/`, `jsluice urls|secrets js_files/*.js`, `mantra -f js.txt`, `SecretFinder -i <f> -o cli`, `LinkFinder -i beautified/ -o cli`, `nuclei -t http/exposures/ -l js.txt`.

**For PII hunting specifically — hunt these patterns in every JS file:**

• **User data API endpoints** — `/api/users`, `/api/members`, `/api/profiles`, `/api/accounts`,

`/api/customers`, `/api/admin/users`, `/api/v*/export`, `/api/v*/search?q=`

• **PII field names in API responses** — `email`, `phone`, `ssn`, `dob`, `address`, `fullName`,

`firstName`, `lastName`, `nationalId`, `passport`, `driverLicense`, `medicalRecord`, `salary`

• **Export/download features** — `?format=csv`, `?export=true`, `downloadReport`, `bulkExport`
• **Admin endpoints** — `/admin/users`, `/dashboard/users`, `/internal/customers`
• **GraphQL queries with PII fields** — any query returning `email`, `phoneNumber`, `address`
• **Autocomplete/search endpoints** — `/api/search/users`, `/typeahead`, `/suggest`
• **Notification APIs** — endpoints sending emails/SMS that reflect user data in responses

---

RULE 4 — Confirm dynamically, THEN it's a finding (kill false positives)

Nothing gets reported on a grep/static hit alone. Prove PII access live:

• **API endpoint** → hit it unauth + cross-tenant, confirm real user data in response
• **Export endpoint** → trigger export as User A, confirm it returns User B's records
• **Search/autocomplete** → query anot