scope
Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope <asset> [<asset> ...]
mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/HEAD/commands/scope.md -o ~/.claude/commands/scope.mdscope.md
# /scope The mandatory pre-flight gate. Verify a host or URL is in scope **before** any active testing. Scope is enforced in **code** (`engine/scope.py`), not by LLM judgment — deny wins, default deny. ## What This Does 1. Loads in-scope / out-of-scope patterns from the engagement's `scope.md` (the `hunt` scaffold creates it) or from inline patterns. 2. Checks each asset deterministically with `engine/scope.py`: - apex `acme.com` → the apex **and** any subdomain - `*.acme.com` → any subdomain (NOT the bare apex) - `api.acme.com` → that exact host - `10.0.0.0/8` → any IP in the CIDR - `re:^lab[0-9]+\.acme\.io$` → explicit regex (prefix `re:`) 3. Prints `IN-SCOPE` / `OUT-OF-SCOPE <reason>` and exits non-zero if any asset is out of scope — so it can gate automation. ## Usage ``` /scope api.acme.com /scope api.acme.com staging.acme.io admin.acme.com ``` Under the hood, run the deterministic checker directly: ```bash # Against the engagement scope.md (preferred — fill scope.md from the program page first) python3 engine/scope.py api.acme.com --md ~/Targets/acme/scope.md # Or with inline patterns (repeat --in-scope / --out-of-scope per pattern) python3 engine/scope.py api.acme.com evil.com \ --in-scope acme.com --in-scope '*.acme.io' --out-of-scope admin.acme.com ``` ## Rules - **Run this before any HTTP touch.** An `OUT-OF-SCOPE` result is a hard stop — do not probe the asset. - If `scope.md` is still the empty template (`(paste ... here)` placeholders), fill it from the program page first; an empty in-scope list = default-deny = everything rejected, which is the safe default. - Deny wins: if an asset matches both an in-scope and an out-of-scope rule, it is out of scope.
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com
Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com
Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember