Rank attack surface for: $ARGUMENTS
- Verify recon data exists in recon/ directory. If not, suggest /recon first.
- Read brain data for this target.
- Launch
recon-ranker agent: "Rank the attack surface for $ARGUMENTS. Read recon/ for discovery data and brain for tested endpoints. Output P1/P2/Kill ranking."
- Show the ranking to the user.
- Suggest:
/hunt $ARGUMENTS to start testing P1 targets.
Top-Tier Surface Ranking
Rank by exploit economics.
P1 requires at least two of:
- crown-jewel function: auth, billing, admin, tenant data, integrations, uploads, exports, webhooks, AI/tool execution
- weak boundary: cross-tenant IDs, mixed roles, public/private transition, OAuth callback, parser boundary, file ingestion
- novelty: new asset, changed JS, low hacktivity coverage, unusual vendor or beta endpoint
- proof path: two-account test, clear callback, readable response, browser-verifiable sink, local PoC
Kill or P3 assets that are static marketing pages, hardened vendor panels with no program-owned data, or endpoints already exhausted with strong evidence. Every P1 must include the best first vuln class and first request to try.
1---2name: surface3description: Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com4---5Rank attack surface for: $ARGUMENTS671. Verify recon data exists in recon/ directory. If not, suggest /recon first.82. Read brain data for this target.93. Launch `recon-ranker` agent: "Rank the attack surface for $ARGUMENTS. Read recon/ for discovery data and brain for tested endpoints. Output P1/P2/Kill ranking."104. Show the ranking to the user.115. Suggest: `/hunt $ARGUMENTS` to start testing P1 targets.1213## Top-Tier Surface Ranking1415Rank by exploit economics.1617P1 requires at least two of:18- crown-jewel function: auth, billing, admin, tenant data, integrations, uploads, exports, webhooks, AI/tool execution19- weak boundary: cross-tenant IDs, mixed roles, public/private transition, OAuth callback, parser boundary, file ingestion20- novelty: new asset, changed JS, low hacktivity coverage, unusual vendor or beta endpoint21- proof path: two-account test, clear callback, readable response, browser-verifiable sink, local PoC2223Kill or P3 assets that are static marketing pages, hardened vendor panels with no program-owned data, or endpoints already exhausted with strong evidence. Every P1 must include the best first vuln class and first request to try.
h-mmer