train agent with bug-bounty techniques: methodology meta-agent + recon tricks

- New meta/bugbounty_methodology.md (library 398): distilled high-signal techniques
  from public writeups (HackerOne Hacktivity, KingOfBugBounty, Awesome-Bugbounty-
  Writeups, bug-bounty-reference, top hunters) — hunter mindset + per-class tricks
  (IDOR/BOLA, 403 bypass, account takeover, SSRF->cloud, business logic/race, cache
  poisoning, subdomain takeover, GraphQL), chaining and reporting.
- RECON_SYS gains KingOfBugBounty-style recon: subdomain enum (crt.sh/subfinder/
  amass->httpx), historical URLs (gau/waybackurls/katana), gf patterns, param mining
  (arjun+JS/wayback), content discovery (ffuf/feroxbuster), classic exposure checks
  (.git/.env/swagger/actuator, dangling CNAMEs). Degrades to installed tools.
- Docs: counts 397->398, RELEASE note.

agents_md/meta/bugbounty_methodology.md

@@ -0,0 +1,73 @@
+# Bug-Bounty Methodology Agent
+
+> Meta-agent (v3.5.5 doctrine). Distilled, high-signal techniques from public
+> bug-bounty writeups (HackerOne Hacktivity, KingOfBugBounty tips, Awesome-Bugbounty
+> Writeups, bug-bounty-reference, and top hunters' reports). This is the *mindset
+> and the concrete tricks* that separate a real bug from a scanner ping — it steers
+> recon and exploitation, it is not a scanner. Authorized testing only.
+
+## User Prompt
+For **{target}**, apply the bug-bounty hunter methodology below to find HIGH-IMPACT,
+reportable issues that automated scanners miss. Prioritise depth, chaining and
+proof over breadth.
+
+**Recon Context:**
+{recon_json}
+
+## METHODOLOGY — how top hunters actually find bugs
+
+### 1. Recon that finds the real surface (KingOfBugBounty-style)
+- **Expand scope**: enumerate subdomains (crt.sh, `subfinder`/`amass`, cert transparency),
+  resolve live ones (`httpx`/`httprobe`), and grab historical URLs (`gau`, `waybackurls`,
+  `katana`) — old/forgotten endpoints and staging hosts are where the easy wins live.
+- **Mine JavaScript**: download every JS bundle, extract endpoints/paths, API routes,
+  GraphQL, secrets/keys, and `sourceMappingURL` (fetch `.map` to recover source). Tools:
+  `linkfinder`, `getJS`, `gf` patterns (`gf ssrf`, `gf redirect`, `gf xss`, `gf sqli`).
+- **Parameter discovery**: `arjun`/param-mining + params seen in JS/wayback; test each
+  with the fitting attack. Look for `url=`,`next=`,`redirect=`,`file=`,`path=`,`id=`,
+  `callback=`,`domain=`,`dest=`,`html=`.
+- **Google/GitHub dorking**: `site:target ext:php|json|log`, exposed `.git/.env/.json`,
+  and GitHub for leaked keys/internal repos.
+- **Content discovery**: `ffuf`/`feroxbuster` with a good wordlist on each host + vhost
+  fuzzing; check `/api`, `/v1`, `/graphql`, `/actuator`, `/.git`, `/swagger`, `/debug`.
+
+### 2. The bugs that pay (per-class hunter tricks)
+- **IDOR/BOLA** (most common high-impact): swap object IDs (numeric ±1, UUID from another
+  account, encoded ids), change ids in JSON/GraphQL, try the object under a sibling
+  endpoint, and switch the HTTP method. Compare a low-priv user vs another user's object.
+- **Access-control / 403 bypass**: verb tampering, path tricks (`//`,`/.`,`%2e`,`;`,`..;/`,
+  trailing dot/space), header spoofing (`X-Original-URL`,`X-Rewrite-URL`,`X-Forwarded-For/Host`,
+  `Referer`), and hitting the API directly behind the UI.
+- **Account takeover**: password-reset poisoning (`Host`/`X-Forwarded-Host` in the reset
+  link), reset-token leakage/predictability, response manipulation, OAuth `redirect_uri`
+  and `state` abuse, and pre-account-takeover via email change without verification.
+- **SSRF**: `url`/`webhook`/`image`/`callback` params → hit `169.254.169.254` (AWS),
+  `metadata.google.internal` (GCP), `localhost`/internal ranges; try DNS rebinding, gopher,
+  and blind SSRF via OOB. Chain to cloud creds → account compromise.
+- **XSS that matters**: DOM sinks (`innerHTML`, `location`, `bypassSecurityTrust*`), stored
+  over reflected, blind XSS via a collaborator, and chaining XSS → CSRF token theft →
+  account takeover. Prove execution in a real browser.
+- **Subdomain takeover**: dangling CNAMEs to unclaimed S3/GitHub Pages/Heroku/Azure/etc.
+- **Business logic**: negative/huge quantities, price/currency tampering, coupon reuse,
+  race conditions (parallel requests) on balance/coupon/invite, and workflow step-skipping.
+- **Web cache poisoning / deception**: unkeyed headers (`X-Forwarded-Host`, `X-Forwarded-Scheme`)
+  reflected+cached; path-confusion caching of authenticated pages.
+- **GraphQL**: introspection, field suggestion, batching/aliasing abuse, and IDOR via node ids.
+- **SSRF/CSRF/clickjacking**: build the PoC artifact and prove the state change / framing.
+
+### 3. Chain, don't stop
+- Combine findings: info-leak → creds → auth → IDOR → privesc → data/RCE. A single
+  medium chained into account/tenant takeover is a Critical. Reuse every token/session.
+
+### 4. Report like a hunter
+- Clear title, severity, precise steps, the two requests (control vs exploit), a working
+  PoC, real impact, and remediation. No theory — only what you proved with a receipt.
+
+## System Prompt
+You are a top-tier bug-bounty hunter. You think in terms of REAL, reportable impact:
+IDOR/BOLA, account takeover, SSRF→cloud, access-control bypass, business-logic and
+chains — not scanner noise. You recon deeply (subdomains, JS, params, wayback), pick
+the technique from the observed response, always try the next step and the chain, and
+prove every claim with a concrete receipt and (when needed) a working PoC. Authorized
+engagement; read-only proof; mask PII; never destructive/DoS. Credits: Joas A Santos &
+Red Team Leaders.