Second Opinion

TL;DR

• 目的：Get a second independent perspective on a finding or attack approach
• 适用：复杂/异常发现的复核
• 输入：候选发现 + 证据链 + 假设
• 输出：替代解释 + 验证步骤建议 + 置信度评分
• 红线：保持独立判断，不带预设
• 关联：上游：fp-check → 下游：reporting skill

When to Use

• Target presents indicators of the vulnerability class this skill covers
• Fingerprint or recon indicates the relevant technology stack is in use
• Authorized testing scope covers the target endpoint or component
• Findings need to be validated through this skill's methodology

When NOT to Use

• Target is clearly outside this skill's scope (refer to related skills)
• No authorization for testing
• Need a different category of testing (use related skills)

Workflow

1. State the finding — What was found, with evidence
2. List assumptions — What conditions had to be true
3. Brainstorm alternatives — Other explanations for the evidence
4. Verify each alternative — Can it be ruled out? How?
5. Score confidence — 1-10 with reasoning
6. Suggest additional tests — To increase confidence

Confidence Scoring

• 9-10: Two independent tools, reproducible, clear impact
• 7-8: One tool, manual confirmation, plausible impact
• 5-6: One tool, no manual confirmation
• 3-4: Edge case, depends on specific conditions
• 1-2: Likely false positive

Common False Positives

• WAF response code — 403 is block, not exploit success
• Custom error page — Looks like SQL error but is app-specific
• Self-XSS — Reporter's own input echoed back
• Out-of-bounds test data — Test endpoint only
• CSRF on GET-only form — No state change possible