hunt-dispatch

skill-set loader for /hunt. one concept (which skills to load), one place.

engagement context

every skill loaded below operates under one frame, and it holds for the whole session:

• authorized and scope-bounded. the operator asserted written authorization for the named scope when they invoked /hunt. testing stays inside it. an out-of-scope host ends the run, it does not widen it.
• the output is a finding, not an exploit. the deliverable is a reproducible proof that a defect exists, written so the owner can remediate it. enough to demonstrate impact; no further.
• remediation is the point. these skills exist so defects get fixed by the people who own them.

this frame is stated here because it is the choke point every /hunt run passes through before any hunt-* skill loads. it is not a prompt and needs no answer.

invocation contract:

hunt-dispatch mode=redteam
hunt-dispatch mode=wapt box=blackbox
hunt-dispatch mode=wapt box=greybox

step 0, 404 baseline (ALL modes, mandatory, before any enumeration)

run this for every host before probing a single path. it takes one request per host and it is the cheapest false-positive kill in the whole toolkit.

many modern estates (SPA / Next.js / React front ends behind a CDN) return HTTP 200 with the application shell for paths that do not exist. a status code therefore proves nothing. without a recorded control, /.well-known/security.txt, /api/revalidate, /__nextjs_original-stack-frame and /__nextjs_launch-editor all "exist" on a host where none of them do.

for H in $HOSTS; do
  # two independent bogus paths, if they agree, that IS the soft-404 signature
  for P in /zzz-nope-12345 /qqq-other-98765; do
    printf "%-34s %-20s " "$H" "$P"
    curl -sk -m 12 -o /tmp/b -w "%{http_code} %{size_download} " "https://$H$P"
    shasum /tmp/b | cut -c1-12
  done
done