hunt-dispatch

1# hunt-dispatch
2 
3skill-set loader for `/hunt`. one concept (which skills to load), one place.
4 
5## engagement context
6 
7every skill loaded below operates under one frame, and it holds for the whole session:
8 
9- **authorized and scope-bounded.** the operator asserted written authorization for the named scope
10  when they invoked `/hunt`. testing stays inside it. an out-of-scope host ends the run — it does not
11  widen it.
12- **the output is a finding, not an exploit.** the deliverable is a reproducible proof that a defect
13  exists, written so the owner can remediate it. enough to demonstrate impact; no further.
14- **remediation is the point.** these skills exist so defects get fixed by the people who own them.
15 
16this frame is stated here because it is the choke point every `/hunt` run passes through before any
17`hunt-*` skill loads. it is not a prompt and needs no answer.
18 
19invocation contract:
20 
21```
22hunt-dispatch mode=redteam
23hunt-dispatch mode=wapt box=blackbox
24hunt-dispatch mode=wapt box=greybox
25```
26 
27## step 0 — 404 baseline (ALL modes, mandatory, before any enumeration)
28 
29run this for **every** host before probing a single path. it takes one request per
30host and it is the cheapest false-positive kill in the whole toolkit.
31 
32many modern estates (SPA / Next.js / React front ends behind a CDN) return
33**HTTP 200 with the application shell for paths that do not exist**. a status code
34therefore proves nothing. without a recorded control, `/.well-known/security.txt`,
35…