 CyberSecurityUP
|
26a8c84dc5
|
v3.5.6 — bug-bounty corpus grounding + 2FA bypass agent; Trendshift badge
- Fetched & analysed real public writeup corpora (Awesome-Bugbounty-Writeups,
bug-bounty-reference); the technique distribution (XSS/RCE/CSRF/SSRF/2FA/…)
validates the methodology agent's priorities. Added explicit 2FA/MFA bypass and
SAML/SSO sections to bugbounty_methodology.
- New agent twofa_bypass_techniques (library 399): full 2FA-bypass playbook
(rate-limit brute, reuse, response manipulation, step skip, null/default,
backup/remember-me, race, disable-2FA IDOR, SSO side door).
- README: Trendshift badge.
- Version bumped 3.5.5 -> 3.5.6 across crates/app/installers/docs; RELEASE section.
|
2026-07-10 00:40:01 -03:00 |
|
|
CyberSecurityUP
|
f2971b6630
|
train agent with bug-bounty techniques: methodology meta-agent + recon tricks
- New meta/bugbounty_methodology.md (library 398): distilled high-signal techniques
from public writeups (HackerOne Hacktivity, KingOfBugBounty, Awesome-Bugbounty-
Writeups, bug-bounty-reference, top hunters) — hunter mindset + per-class tricks
(IDOR/BOLA, 403 bypass, account takeover, SSRF->cloud, business logic/race, cache
poisoning, subdomain takeover, GraphQL), chaining and reporting.
- RECON_SYS gains KingOfBugBounty-style recon: subdomain enum (crt.sh/subfinder/
amass->httpx), historical URLs (gau/waybackurls/katana), gf patterns, param mining
(arjun+JS/wayback), content discovery (ffuf/feroxbuster), classic exposure checks
(.git/.env/swagger/actuator, dangling CNAMEs). Degrades to installed tools.
- Docs: counts 397->398, RELEASE note.
|
2026-07-09 19:46:55 -03:00 |
|