# Black Hat Arsenal runbook

Per target: how to launch, and which **oracle-proven** (`--verify`) vuln classes
to expect the swarm to prove. The demo beat: recon **fingerprints** the app →
exploit agent attacks the primed surface → findings land with a green
**✅ VERIFIED** badge (live on the dashboard + TUI), chained on the
**Vulnerability Chaining** panel. See `TARGETS.md` for exact run commands and
`docs/verification-oracles.md` for the 12 proof classes.

## Proof classes (`--verify`)
differential: BOLA/IDOR · 403-bypass (path+header) · mass assignment · NoSQL
auth-bypass · SSTI · LDAP  ·  out-of-band: SSRF · command injection · XXE  ·
timing: blind SQLi (ladder)  ·  header-aware: open redirect.

## One-command `--lab` targets

| Target | Launch | Expect proven |
|---|---|---|
| **crAPI** | `scan --lab --lab-target crapi --verify --follow` | BOLA (cross-user vehicle), mass assignment, JWT; SSRF→IMDS lead |
| **VAmPI** | `--lab-target vampi` | BOLA (users/books), mass assignment (register `admin:true`), excessive-data `/users/v1/_debug` |
| **Juice Shop** | `--lab-target juiceshop` | SQLi (`/rest/products/search`), BOLA basket; broad web surface |
| **DVGA** | `--lab-target dvga` | GraphQL injection / introspection / DoS |
| **DVWA** | `--lab-target dvwa` | SQLi, command injection, file upload, XSS, LFI/RFI (set security=low) |
| **WebGoat** | `--lab-target webgoat` | lesson-gated; needs a registered login for most |
| **bWAPP** | `--lab-target bwapp` | SQLi, XSS, command injection, many classes (after `/install.php`) |
| **Mutillidae** | `--lab-target mutillidae` | OWASP Top 10 pages (after `/set-up-database.php`) |

## Run-from-upstream targets (recon auto-fingerprints; see `deploy/lab/<name>/`)

| Target | Expect proven |
|---|---|
| **vAPI** | BOLA (`api1`), mass assignment (`api6`), broken auth (`api2`), SQLi (`api8`), OTP rate-limit (`api4`), weak JWT |
| **Pixi** | **NoSQL auth bypass**, mass assignment (`is_admin`), BFLA admin routes, BOLA (`other_user_info`) |
| **NodeGoat** | **IDOR** (`/allocations/:userId`), **SSJS** (`/contributions`), **open redirect / SSRF** (`/learn?url=`), stored XSS |
| **Hackazon** | BOLA (`cart`/`order`/`user` by id), SQLi (product/search) |
| **DVWS** | **command injection** (`sysinfo`), **XXE** (`import/xml`), **LFI** (`download`), BOLA (`notes/{id}`), **LDAP**, **open redirect** |
| **brokencrystals** | **SSRF**, **SSTI**, **XXE**, JWT attacks, path traversal, mass assignment (surface via `/api/spec`) |
| **Tiredful** | IDOR, info disclosure, throttling, SQLi, XSS, JWT |

## Notes for the floor
- **Verified means proven**, not guessed: each ✅ was re-confirmed against the
  live target by a non-LLM oracle (callback fired / responses diverged / it
  slept / Location pointed at us). Silence is never a finding.
- Blind SQLi (timing) needs sqlmap on PATH to source the injectable parameter;
  OOB classes (SSRF/XXE/command-injection) need `interactsh-client` on PATH.
- First-boot caveats (DB init, slow Spring boot) are in each `--lab` target's
  note — run `pentestswarm lab list`.