wufufu770 TL;DR
- 目的：独立复核：对复杂或反直觉发现穷举替代解释、置信度评分(1-10)、给出补充验证步骤。
- 适用：复杂/异常发现的复核
- 输入：候选发现 + 证据链 + 假设
- 输出：替代解释 + 验证步骤建议 + 置信度评分
- 红线：保持独立判断，不带预设
- 关联：上游：fp-check → 下游：reporting skill
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
Workflow
- State the finding — What was found, with evidence
- List assumptions — What conditions had to be true
- Brainstorm alternatives — Other explanations for the evidence
- Verify each alternative — Can it be ruled out? How?
- Score confidence — 1-10 with reasoning
- Suggest additional tests — To increase confidence
Confidence Scoring
- 9-10: Two independent tools, reproducible, clear impact
- 7-8: One tool, manual confirmation, plausible impact
- 5-6: One tool, no manual confirmation
- 3-4: Edge case, depends on specific conditions
- 1-2: Likely false positive
Common False Positives
- WAF response code — 403 is block, not exploit success
- Custom error page — Looks like SQL error but is app-specific
- Self-XSS — Reporter's own input echoed back
- Out-of-bounds test data — Test endpoint only
- CSRF on GET-only form — No state change possible