Generate attack surface mindmap for: $ARGUMENTS
Process
- Read brain data:
uv run python3 ../../tools/brain.py brief $ARGUMENTS
- Read recon data from recon/ directory
- Read intel data:
uv run python3 ../../tools/intel_engine.py suggest <tech-stack>
- Generate a tree-format mindmap:
target.com
├── Tech Stack
│ ├── Next.js 14 → SSRF (Server Actions), Open Redirect
│ ├── GraphQL → Introspection, IDOR via node(), Mutation Auth
│ └── PostgreSQL → SQL Injection
├── Auth
│ ├── Okta SSO → SAML bypass, OAuth redirect_uri
│ └── JWT → Secret brute-force, Algorithm confusion
├── API Surface
│ ├── /api/v2/users/{id}/* → IDOR (P1)
│ │ ├── /orders — TESTED: exhausted
│ │ ├── /export — UNTESTED
│ │ └── /settings — UNTESTED
│ ├── /api/v2/payments/* → Race conditions, price manipulation (P1)
│ └── /graphql → Auth bypass on mutations (P1)
├── File Handling
│ └── /upload → Extension bypass, SVG XSS (P2)
└── Findings
├── [CONFIRMED] IDOR on /api/v2/users/{id}/orders
└── [EXHAUSTED] XSS on /search — CloudFront blocks all payloads
- Mark each endpoint as TESTED, UNTESTED, CONFIRMED, or EXHAUSTED from brain data
- Suggest: "Start with UNTESTED P1 endpoints. Run /hunt $ARGUMENTS --vuln-class "
Top-Tier Mindmap Standard
The mindmap should expose attack decisions at a glance.
- Group by trust boundary first: unauth, user, tenant, admin, integration, internal, CI/CD, AI/tool.
- Mark every node with one of:
P1, P2, Kill, Confirmed, Partial, Exhausted, Chain.
- Draw capability edges, not just URL hierarchy: export reads data, webhook sends server-side request, template renders attacker input, OAuth callback grants token.
- Surface blind spots explicitly: "no second-account test", "no browser verification", "no sibling replay", "no chain attempt".
- End with the top three routes where one more test could change severity or reportability.
1---2name: mindmap-23description: Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target>4---56Generate attack surface mindmap for: $ARGUMENTS78## Process91. Read brain data: `uv run python3 ../../tools/brain.py brief $ARGUMENTS`102. Read recon data from recon/ directory113. Read intel data: `uv run python3 ../../tools/intel_engine.py suggest <tech-stack>`124. Generate a tree-format mindmap:1314```15target.com16├── Tech Stack17│ ├── Next.js 14 → SSRF (Server Actions), Open Redirect18│ ├── GraphQL → Introspection, IDOR via node(), Mutation Auth19│ └── PostgreSQL → SQL Injection20├── Auth21│ ├── Okta SSO → SAML bypass, OAuth redirect_uri22│ └── JWT → Secret brute-force, Algorithm confusion23├── API Surface24│ ├── /api/v2/users/{id}/* → IDOR (P1)25│ │ ├── /orders — TESTED: exhausted26│ │ ├── /export — UNTESTED27│ │ └── /settings — UNTESTED28│ ├── /api/v2/payments/* → Race conditions, price manipulation (P1)29│ └── /graphql → Auth bypass on mutations (P1)30├── File Handling31│ └── /upload → Extension bypass, SVG XSS (P2)32└── Findings33 ├── [CONFIRMED] IDOR on /api/v2/users/{id}/orders34 └── [EXHAUSTED] XSS on /search — CloudFront blocks all payloads35```36375. Mark each endpoint as TESTED, UNTESTED, CONFIRMED, or EXHAUSTED from brain data386. Suggest: "Start with UNTESTED P1 endpoints. Run /hunt $ARGUMENTS --vuln-class <suggested>"3940## Top-Tier Mindmap Standard4142The mindmap should expose attack decisions at a glance.4344- Group by trust boundary first: unauth, user, tenant, admin, integration, internal, CI/CD, AI/tool.45- Mark every node with one of: `P1`, `P2`, `Kill`, `Confirmed`, `Partial`, `Exhausted`, `Chain`.46- Draw capability edges, not just URL hierarchy: export reads data, webhook sends server-side request, template renders attacker input, OAuth callback grants token.47- Surface blind spots explicitly: "no second-account test", "no browser verification", "no sibling replay", "no chain attempt".48- End with the top three routes where one more test could change severity or reportability.
h-mmer