exploit

Files (21)

• SKILL.md
• 2fa-ato.md · tech/
• business-logic.md · tech/
• cache-smuggling.md · tech/
• cors-misc.md · tech/
• cred-spray.md · tech/
• deser.md · tech/
• graphql.md · tech/
• idor-mass.md · tech/
• jndi-cve.md · tech/
• jwt.md · tech/
• lfi-upload.md · tech/
• nosql.md · tech/
• oauth-saml.md · tech/
• prototype.md · tech/
• race-timing.md · tech/
• sqli.md · tech/
• ssrf.md · tech/
• ssti-xxe.md · tech/
• xs-leaks.md · tech/
• xss.md · tech/

SKILL.md (first lines)

# Exploitation Phase

## Philosophy

Every confirmed finding must have a direct evidence quote from the actual response.
Never claim Critical without proving the full kill chain: access -> escalation -> data.
Never skip a technique because "it probably won't work" - the manifest decides what runs.
WAF presence means bypass first, then exploit - never give up at the first 403.

---

## Phase 0: Smart Intake

```bash
source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate || exit 0

p0_read_relay recon secrets
p0_read_hypotheses
p0_read_memory

TECH=$(jq -r '.intel.technologies[]?' "$SESSION" 2>/dev/null | tr '\n' ',')
# Fallback endpoints
[ -z "$API_SPEC_ENDPOINTS" ] && API_ENDPOINTS=$(jq -r '.intel.endpoints[]?' "$SESSION" 2>/dev/null | head -50)
API_ENDPOINTS="${API_SPEC_ENDPOINTS:-$API_ENDPOINTS}"

echo "=== EXPLOIT SMART INTAKE: $TARGET ==="
echo "State: $STATE | WAF: $WAF | Tech: $TECH"
echo "Top hypothesis: [$TOP_HYPO_PROB%] $TOP_HYPO_LABEL"
echo "Verified creds: $(echo "$VERIFIED_CREDS" | grep -c .)"
echo "JWT tokens: $(echo "$JWT_TOKENS" | grep -c .)"
echo "API endpoints: $(echo "$API_ENDPOINTS" | grep -c .)"
echo "ATW flagged (skip): $ATW_FLAGGED"
```

**Tech stack drives technique priority:**

| Tech detected | Prioritize first |
|---|---|
| AWS in stack | SSRF->IMDS->IAM, cloud-audit fork |
| Node.js + JWT | JWT RS256->HS256, prototype pollution |
| Django/Python | SSTI Jinja2, Python pickle deserialization |
| Spring/Java | Deserialization (ysoserial), XXE, JNDI |
| PHP | LFI->RCE (filter chains), PHP type juggling |
| .NET/ASP.NET | ViewState deserialization, XXE, SSRF |
| Redis visible | SSRF->gopher->Redis RCE |
| GraphQL | Introspection, batching, aliasing IDOR |
| OAuth/SSO | redirect_uri bypass, state CSRF, JWT kid injection |
| Nginx+Apache chain | Path confusion (CVE-2025-0108), off-by-slash |
| ElasticSearch | Unauthenticated query access, script injection |
| MongoDB | NoSQL operator injection, JS injection |

---

## Phase 1: Build Execution Manifest

```bash
MANIFEST_ITEMS="[]"

[ -n "$VERIFIED_CREDS" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e01","tool":"cred_spray","target":"all_live_hosts","reason":"Verified creds from secrets phase","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e02","tool":"hypothesis_test","target":"'"$TOP_HYPO_LABEL"'","reason":"Top hypothesis '"$TOP_HYPO_PROB"'%","priority":"MUST","status":"pending"}]')

[ -n "$JWT_TOKENS" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e03","tool":"jwt_attacks","target":"jwt_tokens_found","reason":"JWT tokens from secrets","priority":"MUST","status":"pending"}]')

[ -n "$API_ENDPOINTS" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e04","tool":"arjun+nuclei","target":"api_endpoints","reason":"Discovered API surface","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e05","tool":"dalfox+sqlmap","target":"param_endpoints","reason":"Reflected param surfaces","priority":"SHOULD","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e06","tool":"ssrf_hunt","target":"all_live_hosts","reason":"SSRF on URL/file/webhook params","priority":"MUST","status":"pending"}]')

[ "$WAF" != "none" ] && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e07","tool":"403_bypass","target":"blocked_endpoints","reason":"WAF detected","priority":"MUST","status":"pending"}]')

echo "$TECH" | grep -qi "java\|spring" && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e08","tool":"deserialization_java","target":"serialized_endpoints","reason":"Java tech detected","priority":"MUST","status":"pending"}]')
echo "$TECH" | grep -qi "node\|express" && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e09","tool":"prototype_pollution","target":"json_endpoints","reason":"Node.js detected","priority":"MUST","status":"pending"}]')
echo "$TECH" | grep -qi "php" && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e10","tool":"lfi_php_filter_chain","target":"file_param_endpoints","reason":"PHP detected","priority":"MUST","status":"pending"}]')
echo "$TECH" | grep -qi "graphql" && MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"e11","tool":"graphql_full","target":"graphql_endpoint","reason":"GraphQL detected","priority":"MUST","status":"pending"}]')

p0_manifest_write "exploit" "$MANIFEST_ITEMS"
jq '.scalpel.active_manifest.items[] | "[\(.priority)] \(.id): \(.tool) on \(.target)"' $SESSION
```

---

## Phase 2: Technique Loader

**Read ONLY the technique files that match your active manifest items. Do NOT load all files.**

Use the `Read` tool to load: `~/.claude/skills/exploit/tech/<filename>`

| Manifest ID / trigger | Technique file | Load when |
|---|---|---|
| e01 - cred spray | `cred-spray.md` | VERIFIED_CREDS non-empty |
| e02 - top hypothesis | See hypothesis table below | Always |
| e03 - jwt attacks | `jwt.md` | JWT_TOKENS found |
| e04 - api surface | `idor-mass.md` + `business-logic.md` | API endpoints found |
| e05 - sqli/xss | `sqli.md` + `xss.md` | reflected param surfaces |
| e06 - ssrf | `ssrf.md` | any live hosts |
| e07 - waf bypass | Read `/403-bypass/SKILL.md` | WAF confirmed |
| e08 - java deser | `deser.md` | Java/Spring tech |
| e09 - prototype poll. | `prototype.md` | Node.js tech |
| e10 - lfi/php | `lfi-upload.md` | PHP tech |
| e11 - graphql | `graphql.md` | GraphQL tech |

**Hypothesis-to-technique file mapping:**

| Hypothesis label contains | Load technique file(s) |
|---|---|
| SSRF / metadata / IMDS / cloud | `ssrf.md` |
| JWT / algorithm / token | `jwt.md` |
| SQL / SQLi | `sqli.md` |
| XSS / client-side | `xss.md` |
| OAuth / OIDC / SSO / SAML | `oauth-saml.md` |
| deserialization / ysoserial | `deser.md` |
| SSTI / template | `ssti-xxe.md` |
| cache poisoning / smuggling | `cache-smuggling.md` |

From kalpmodi/akira, MIT.

More from kalpmodi/akira