Technical methods and evidence

Use the relevant existing technique skills for implementation details. These notes explain technical prerequisites and evidentiary limits; they do not define an engagement stage order, dispatch policy, or report lifecycle. Tool availability and argument names come from the live schema. Authorization comes from the RoE.

Reproducer design

Bind a proof to exact target/version, required identity, request bytes, session state, input and expected observable. A new GET may rotate CSRF tokens, cookies or encrypted challenges; do not submit data recovered under session A using session B. Preserve runnable scripts and redacted configuration with raw response artifacts. Copy a running harness before editing it and retain resume state for long extractions.

Component and protocol fidelity

Version-specific behavior can depend on proxy tiers, HTTP framing, runtime patch levels or exact gadget classes. Use available cve_lookup, cve_poc_lookup, methodology_lookup and payload_search when those facts are needed; an advisory match does not prove local exploitability. Respect byte-level prerequisites rather than substituting a superficially similar payload. Host-header routing, internal references and frontend/backend differences identify hypotheses, not new scope.

Discriminating observables

• Browser execution requires a browser-observable effect and realistic delivery; HTTP reflection alone is insufficient. Use an available browser tool only when the proof depends on JS, navigation or browser security behavior.
• Cross-account access requires controlled identities, known object ownership and a content or state comparison; status-code differences alone are ambiguous.
• Injection requires an output or differential tied to the injected condition, with syntax/encoding controls that rule out ordinary error handling.
• In-band SSRF may be established by attributed response content; blind SSRF needs a correlated owned-listener interaction. OOB is not mandatory for in-band cases.
• Races and timing channels need repeated matched trials with fresh state, baselines and noise characterization. A single fast response or race win is inconclusive.
• Request desynchronization requires observable cross-request framing/state effects; differential 400/501 responses alone are not confirmation.

Use existing domain routers and technique skills for exact test construction. Network harnesses need inner I/O timeouts and an outer process deadline; follow injected bash/session semantics and terminate only identified owned processes.