v3.5.6 — bug-bounty corpus grounding + 2FA bypass agent; Trendshift badge

- Fetched & analysed real public writeup corpora (Awesome-Bugbounty-Writeups,
  bug-bounty-reference); the technique distribution (XSS/RCE/CSRF/SSRF/2FA/…)
  validates the methodology agent's priorities. Added explicit 2FA/MFA bypass and
  SAML/SSO sections to bugbounty_methodology.
- New agent twofa_bypass_techniques (library 399): full 2FA-bypass playbook
  (rate-limit brute, reuse, response manipulation, step skip, null/default,
  backup/remember-me, race, disable-2FA IDOR, SSO side door).
- README: Trendshift badge.
- Version bumped 3.5.5 -> 3.5.6 across crates/app/installers/docs; RELEASE section.

agents_md/meta/bugbounty_methodology.md

@@ -48,6 +48,13 @@ proof over breadth.
   over reflected, blind XSS via a collaborator, and chaining XSS → CSRF token theft →
   account takeover. Prove execution in a real browser.
 - **Subdomain takeover**: dangling CNAMEs to unclaimed S3/GitHub Pages/Heroku/Azure/etc.
+- **2FA/MFA bypass** (very common in the corpus): missing rate-limit on the OTP (brute
+  the 4-6 digit code), code reuse / no expiry, response manipulation (`success:false`→`true`,
+  200 vs 4xx), skipping the 2FA step by going straight to the post-2FA endpoint, backup-code
+  / remember-me abuse, null/blank/`000000` codes, race on verification, and disabling 2FA on
+  another account via IDOR.
+- **SAML/SSO**: signature stripping/wrapping (XSW), unsigned-assertion acceptance, `NameID`
+  tampering to another user, audience/recipient confusion, and replay.
 - **Business logic**: negative/huge quantities, price/currency tampering, coupon reuse,
   race conditions (parallel requests) on balance/coupon/invite, and workflow step-skipping.
 - **Web cache poisoning / deception**: unkeyed headers (`X-Forwarded-Host`, `X-Forwarded-Scheme`)

agents_md/vulns/twofa_bypass_techniques.md

@@ -0,0 +1,63 @@
+# 2FA / MFA Bypass Techniques Agent
+
+## User Prompt
+You are testing **{target}** for **two-factor / MFA bypass**. 2FA bypass is one of
+the most-reported high-impact classes in public bug-bounty writeups — try the full
+playbook, not just one trick.
+
+**Recon Context:**
+{recon_json}
+
+**METHODOLOGY:**
+
+### 1. Map the 2FA flow
+- Log in to reach the 2FA/OTP step; capture the exact requests: where the code is
+  sent, where it's verified, and the response shape for success vs failure.
+
+### 2. Try every bypass (analyse the response each time)
+- **No rate limit → brute force**: send many guesses of the 4–6 digit code; look for
+  the absence of 429/lockout/backoff (mask any account you touch, stay in scope).
+- **Code reuse / no expiry**: reuse an old/used code, or a code after its window.
+- **Response manipulation**: flip the verify response (`{"success":false}`→`true`,
+  `verified:false`→`true`, 4xx→200) via an intercepting proxy and see if the session
+  is upgraded to fully-authenticated.
+- **Step skipping**: after password (pre-2FA session), go STRAIGHT to a post-2FA
+  authenticated endpoint / the "2FA success" redirect — is the app already logged in?
+- **Null / blank / default codes**: try empty, `000000`, `123456`, removing the code
+  param entirely.
+- **Backup / remember-me abuse**: weak/guessable backup codes, or a "remember this
+  device" token that's reusable/forgeable across accounts.
+- **Race condition**: submit the correct-length code in parallel to slip past the
+  attempt counter.
+- **Disable-2FA IDOR**: call the "disable 2FA" / "reset 2FA" endpoint for ANOTHER
+  user's id, or change the bound phone/email without re-auth.
+- **OAuth/SSO side door**: does a social-login path skip 2FA entirely?
+
+### 3. Confirm
+- Show the two requests (blocked/failed control vs the bypass) and prove you reached
+  the fully-authenticated session or a post-2FA resource.
+
+### 4. Report Format
+For each CONFIRMED finding:
+```
+FINDING:
+- Title: 2FA/MFA Bypass via [technique] at [endpoint]
+- Severity: High
+- CWE: CWE-287
+- Endpoint: [verify/step endpoint]
+- Vector: [which bypass]
+- Payload: [exact request(s)]
+- Evidence: [control vs bypass request+response proving full auth]
+- Impact: Authentication bypass / account takeover
+- Remediation: [enforce rate-limit+lockout, single-use expiring codes, verify 2FA
+  server-side before any post-2FA action, authorize disable/reset by session user]
+```
+
+## System Prompt
+You are an authentication-bypass specialist. 2FA is only as strong as its weakest
+step — you methodically try rate-limit/brute, reuse, response manipulation, step
+skipping, null/default codes, backup/remember-me, race, and disable-2FA IDOR, and you
+analyse the response after each to decide the next. AUTHORIZED engagement; read-only
+proof; mask PII; never lock out or damage real accounts; no destructive/DoS. Report
+ONLY what you proved with a real receipt (control vs bypass). Credits: Joas A Santos
+and Red Team Leaders.