zyrexnn Autonomous God-Mode Bug Hunter Skill
1. Operational Directive & Scope Rule
- Explicit Operator Authorization: When target domains, URLs, or CIDRs are specified in
scope.yamlor conversation prompt, proceed with aggressive, exhaustive, and continuous technical validation. - Non-Destructive & Rate Controlled: Never perform DoS, volume saturation, or destructive data alterations. Always strive for Maximum Technical Validation with Minimum Unnecessary Impact.
- Zero False Positives: Never declare a vulnerability confirmed without reproducible HTTP request/response proofs, browser console logs, or execution evidence.
2. Autonomous Execution Pipeline
[ Target Defined in scope.yaml ]
│
┌──────────────┴──────────────┐
▼ ▼
[ Passive Recon ] [ Active Discovery ]
- Subfinder / Assetfinder - HTTPx Probe & Tech Detect
- Historical URL Mining (gau) - Katana SPA / JS Crawling
│ │
└──────────────┬──────────────┘
▼
[ Attack Surface Ranking & Fuzzing ]
- Content / Directory Fuzzing (ffuf / feroxbuster)
- Parameter Mining (burp-parameter-names)
- Client-side JS Secret & Endpoint Extraction
│
▼
[ Deep Vulnerability Hypothesis ]
- Auth & Session Handling (Dual-account matrix)
- IDOR / BOLA / Mass-Assignment Testing
- Injection Vectors (SQLi, SSTI, Command Injection)
- Client-side Flaws (DOM XSS, CORS, CSRF via Puppeteer MCP)
- SSRF & OOB Interaction Testing
│
▼
[ Controlled Exploit Validation ]
- Replay & Mutate Requests
- Isolate Root Cause Flaw
- Generate Minimal-Impact PoC Script (Python)
│
▼
[ Evidence Capture & Reporting ]
- Raw HTTP Request & Response Proofs
- Write CVSS v3.1 Structured Markdown Report to reports/
3. Autonomous Tooling Integration Guide
- Reconnaissance:
subfinder -d <target> -silent | httpx -silent -status-code -title -rate-limit 10 -t 5 - Crawling:
katana -u <url> -silent -depth 3 -rate-limit 10 -concurrency 3 - Fuzzing & Content Discovery:
ffuf -u <url>/FUZZ -w tools/wordlists/common.txt -rate 5 -t 5 -mc 200,301,302,403(fallback:katanacrawl +httpxprobe) - Vulnerability Scanning:
nuclei -u <url> -tags cve,auth-bypass -rate-limit 10 -c 5 -silent - XSS Analysis:
dalfox url <url> --silence(fallback:nucleixss templates or Puppeteer MCP) - SQLi Verification:
sqlmap -u "<url>?param=1" --batch --banner(fallback:nucleisqli templates or deterministic Python PoC) - Browser Automation: Use MCP tools (
puppeteer_navigate,puppeteer_screenshot,puppeteer_evaluate) for dynamic JavaScript and DOM verification.
4. Verification Checkpoint Matrix
| Vulnerability Type | Validation Standard | Evidence Requirement |
|---|---|---|
| IDOR / BOLA | Cross-tenant access between Account A & B | Both Request/Response pairs with leaked object |
| Auth Bypass | Accessing protected endpoint without valid credentials | Response payload showing privileged view |
| SQL Injection | DBMS version or deterministic differential response | Database banner or timing difference proof |
| XSS / DOM Flaw | Script execution context or DOM sink manipulation | Browser MCP console logs / DOM snapshot |
| SSRF | Server-side request callback or internal metadata fetch | Raw response headers and body |
5. Target-Scoped Output Hierarchy & Deliverables
Always create target-scoped directories before saving outputs (TARGET_SLUG e.g. example_com or 127_0_0_1_8888):
- Directory Setup:
mkdir -p reports/<TARGET_SLUG>/findings reports/<TARGET_SLUG>/pocs reports/<TARGET_SLUG>/evidence - Finding Report (Confirmed
low,medium,high,criticalonly):reports/<TARGET_SLUG>/findings/<severity>_<vuln_name>.md(clean snake_case, no square brackets) - Informational & Recon Findings: Group into
reports/<TARGET_SLUG>/evidence/recon_notes.md(Do NOT clutterfindings/with INFO files) - Standalone PoC:
reports/<TARGET_SLUG>/pocs/poc_<vuln_name>.py - Visual / HTTP Evidence:
reports/<TARGET_SLUG>/evidence/<filename> - Consolidated Summary: Run
aggregate_reports <TARGET_SLUG>to index findings intoreports/<TARGET_SLUG>/SUMMARY.md.