Skip to content

feat(replay): finding replay / regression (/replay) — re-verify past findings #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shivsin25 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(replay): finding replay / regression (/replay) — re-verify past findings #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f37c57
feat(replay): add finding replay / regression (/replay)
Shivendra-Coherent Sep 22, 2026
a7773d8
fix(replay): address review — scope gate, initial-hop SSRF guard, BLO…
Shivendra-Coherent Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ This repo is a Claude Code plugin for professional bug bounty hunting across Hac
| `/poc` | `/poc capture <url> [-H ...] \| from-request req.txt [--response resp.txt]` — reproducible PoC evidence bundle (request/response, curl, HAR, screenshot, report-ready evidence.md); secrets redacted by default |
| `/dashboard` | `/dashboard [--port 8777] \| --export dashboard.html` — local web Hunt Dashboard: leads, recon surface, findings, reports, galleries, memory flywheel, in one live view |
| `/verify` | `/verify check <bundle-dir> [--marker "signal"] \| sweep [root]` — report gate: independently re-derives a finding from its PoC bundle; PROVEN → reportable, REFUTED/UNPROVEN/INCONCLUSIVE → suppressed; writes verification.json; `--require-proof` gates CI |
| `/replay` | `/replay run <bundle-dir> [--marker "signal"] \| all [root]` — re-verify a PoC bundle: STILL_VULNERABLE / FIXED / CHANGED / UNREACHABLE; SSRF-guarded, unsafe methods gated, batch retest report |

### Agents (9 specialized agents)

Expand Down Expand Up @@ -124,6 +125,7 @@ This repo is a Claude Code plugin for professional bug bounty hunting across Hac
- `tools/poc_bundler.py` — PoC evidence bundler (`capture` live via SSRF-guarded `safe_http`, or `from-request` offline from a saved/Burp request). Emits `request.http`, `response.http`, `repro.sh` (curl), `evidence.har` (HAR 1.2), optional `screenshot.png`, `evidence.md` (report-ready), and `bundle.json` (manifest + response SHA-256) under `findings/<target>-<class>/evidence/<id>/`. Secrets redacted by default (repro.sh uses `$ENV` placeholders); refuses PUT/DELETE/PATCH without `--confirm-unsafe`. See `/poc`.
- `tools/hunt_dashboard.py` — local web Hunt Dashboard (`serve`/`export`); reads `memory/leads/`, `recon/`, `findings/`, `reports/`, galleries, and `hunt-memory/` into one live view. Pure stdlib, binds to 127.0.0.1, HTML-escapes all recon-derived data, path-traversal-guarded `/file` endpoint. Distinct from `tools/dashboard.py` (the in-terminal ANSI progress TUI). See `/dashboard`.
- `tools/verifier.py` — the report gate (prove-or-suppress). Independently re-derives a finding from its `poc_bundler` bundle (re-sends via SSRF-guarded `safe_http` with an initial-host guard, checks a confirmation marker in the fresh response headers+body) and decides reportability: PROVEN only if the marker was in the original response AND is still present now; else REFUTED/UNPROVEN/INCONCLUSIVE → suppressed. Records the re-fetched response's SHA + status. `decide()` is a pure, total policy function; only PROVEN ships. Writes `verification.json`; `check`/`sweep`; `--require-proof` exits non-zero for gating; unsafe methods never re-fired without `--confirm-unsafe`; secrets read from env only. Reuses only merged code (poc_bundler). See `/verify`.
- `tools/replay.py` — finding replay / regression. Re-sends the exact request from a `poc_bundler` bundle (via SSRF-guarded `safe_http`) and returns STILL_VULNERABLE / FIXED / CHANGED / UNREACHABLE / INDETERMINATE. Marker-based verdicts are `confirmed`; status+SHA-256 diff is a labelled `heuristic` (never claims FIXED alone). `run <bundle-dir>` for one, `all [root]` sweeps every bundle into `regression-report.md`. Secrets read from env only; unsafe methods gated by `--confirm-unsafe`; `--fail-if-vulnerable` exits 3 for CI/monitoring. See `/replay`.
- Full catalogue: **`tools/README.md`** (~50 tools). `hunt.py` auto-ingests leads after recon (`--graphql` / `--cve-hunt` / `--skip-leads` flags).

### External tool references
Expand Down
Loading
Loading