GOAL GATE → VALIDATE → RECON (single pipeline) → SCAN → EXPLOIT → FEEDBACK (audit_results otomatis tiap 6 jam) · 3 skill: redteam-recon / redteam-cve / redteam-loot · ≤60 min per CVE · v3.2-redteam · 2026-09-27
PHASE -1 · GOAL GATE — 0 fpoint · GRATIS · WAJIB sebelum sentuh target (goal_gate.py)
loot-class = CWE + config-independence + auth · selfkanban register WAJIB --verdict GREEN|YELLOW (RED exit 13 · UNKNOWN exit 12)
GREEN → lanjut Phase 0 · YELLOW → extract-only, TANPA mass shell scan · RED → STOP (0 fpoint, kredit utuh) · --verify-gate cross-check goal_gate.py
3 REDTEAM SKILLS (rombakan 09/09 · 29 skill lama di-archive)
PHASE 0 · VALIDATE (30s)
year ≤ current · NVD verify
PoC search (8 sources, <5s)
source grep exec/eval/system
gate: poc found / dangerous fn
poc_search_v2.py
selfkanban new
PHASE 1 · RECON (5-10 min) — redteam-recon
① COUNT · 3 JALUR
Apify → proxy → direct
② CT-Log
enumerasi host · bukan sizing
③ SearXNG
OSINT · fixed 09/09
④ nmap
top-100 · optional
recon//targets.txt + report.md
GO/NO-GO threshold → max 5000 targets
Stage A · config-probe
probe host live ≥20% → GO · <20% → STOP
count: Apify → FOFA proxy → direct (maks 1)
PHASE 2 · SCAN (5-15 min)
PoC check on 50 targets
--check-only -t 8
Stage B · vuln ≥5% → vuln.txt
RCE gate: --cmd whoami
accept: www-data/root/IWPD_*
reject: template/Invalid math/HTML
gate: rce_confirmed → EXPLOIT
PHASE 3 · EXPLOIT (10-30 min)
Stage C · mass cap 500 → grow
--cmd id -t 16
deploy shell ONLY on RCE
cache_<hex>.php mini <2KB
verify marker/token ≠ HTTP 200
FUNNEL.md (mandatory output)
~55 min cap Phase 0-3
POST-EXPLOIT — redteam-loot
① RECON TARGET
container vs host? OS? user? id
② LOOT
creds · API keys · DB · .env · chunked RCE
③ PERSIST
stateless RCE / SSH / init.d / .user.ini
④ CLEANUP
hapus kompetitor · keep OUR shells
LOOT// · per-target folder
SUMMARY · credentials · api_keys · shell_loc
GO / NO-GO Thresholds
Critical ≥ 9.0
min 30 targets
High ≥ 7.0
min 200 targets
Medium ≥ 4.0
min 500 targets
Low < 4.0
min 1000 targets
count < threshold & not critical = NO-GO stop
TRACKING — selfkanban.py (tanpa ceremony)
selfkanban.py new $CVE_ID $CMS $TYPE $CVSS --verdict GREEN|YELLOW
selfkanban.py status $CVE_ID --phase "P1:Recon" -s done
RED exit 13 · UNKNOWN exit 12 (sebelum board) · dashboard cvedashboard.db
CONFIG-SENSITIVE CVE
plugin present ≠ exploitable · cek handler/field SEBELUM mass scan
handler 400/404 → STOP (low yield) · handler 200 → GO
form missing → STOP
90% config-sensitive = near-zero RCE tanpa FOFA
INPUT dari Sistem A (CVE Feed Monitoring)
entry = CVSS ≥ 9 (KEV bypass) + HIGH-RCE (Joomla upload, CVSS < 9)
cvedaily.jsonl + cms_targeted.jsonl + cvedashboard.db · triage_score
filter 56 PHP CMS · 4 sumber (Telegram · NVD · cvefeed · Joomla)
READ-ONLY · handoff via board satu arah
→ hasil audit direkam balik ke audit_results (feedback loop)
LESSON — kontrol label vs realita CVE (09/17)
• Joomla "Severity: Low" bisa = NVD 9.8 (CVE-2026-73373 unrestricted upload) → gate = severity OR impact OR exploit type
• Sumber terarah (NVD/cvefeed/Joomla) menemukan CVE yang TIDAK ada di feed Telegram — jangan andalkan 1 sumber
• Config-sensitive CVE (calc-AJAX aktif) = near-zero yield; cek elemen SEBELUM massal
• Response 200 kosong ≠ vulnerable · verifikasi marker/produk, jangan hanya status code
EMPIRICAL FUNNEL — tersimpan di audit_results · agregat 21 CVE / 18.311 target
4.302
VULN
299
RCE
179
SHELL
1
VERIFIED
21
CVE
Agregat 21 CVE: 4.302 vuln → 299 rce → 179 shell → 1 verified
hit rate 23,5% (vuln/target) · 18.311 target · rekam OTOMATIS tiap 6 jam via record_audit_results.py --silent (profile iris)
VALIDATE
RECON
SCAN
EXPLOIT
POST-EXPLOIT
flow
post-exploit
STOP/NO-GO
Updated 09/27
TOTAL TIME per CVE:
VALIDATE(30s) → RECON(5-10m) → SCAN(5-15m) → EXPLOIT(10-30m) + LOOT(post)
= 20-60 min total
| no lab = 15-30 min saved
• Phase -1 GOAL GATE (0 fpoint, GRATIS · 09/25): goal_gate.py classify loot-class (CWE + config-independence + auth) SEBELUM sentuh target. RED → STOP, YELLOW → extract-only tanpa mass shell scan, GREEN → lanjut. Register selfkanban.py wajib --verdict GREEN|YELLOW (RED exit 13 · UNKNOWN exit 12) + --verify-gate cross-check
• Phase 0 VALIDATE (30s): year check + NVD + PoC search (8 sources) + source grep. Gate: PoC/dangerous fn
• Phase 1 RECON (5-10m): count 3 jalur urut biaya Apify → FOFA proxy → FOFA direct (maks 1×/CVE) · CT-Log/SearXNG = enumerasi host, bukan sizing · Stage A config-probe ≥20% live → GO · targets.txt max 5000
• Phase 2 SCAN (5-15m): Stage B --check-only -t 8 on 50 real targets → vuln ≥5% → vuln.txt → RCE gate --cmd whoami
• Phase 3 EXPLOIT (10-30m): Stage C mass cap 500 → rce/loot ≥1 → grow · cache_<hex>.php → marker verify ≠ HTTP 200 → FUNNEL.md
• No lab build. Test langsung real targets (max 50 dulu). ≤60 min cap Phase 0-3
• Phase 4 FEEDBACK (09/23): record_audit_results.py --silent recursive-scan artefak cve-labs/ → tabel audit_results → hit_rate/shell_rate per metode dipakai kalibrasi rekomendasi hari berikutnya · cron OTOMATIS tiap 6 jam via profile iris (no-spam, stdout kosong saat tak ada perubahan) · audit manual (selfkanban) disinkronkan otomatis (infer CMS dari path + is_audited)
• Count 3 jalur (urut biaya): Apify kaix $0.00005/query → FOFA proxy api-f (10/hari) → FOFA direct size=1 (1 fpoint, maks 1/CVE)
• Error classification: [-501] transient → retry 1× dulu (JANGAN rotate) · 820300 dork salah · 820031 point habis · 403/1010 BAN
• CT-Log: crt.sh + urlscan — enumerasi hosts unlimited · crt.name saat crt.sh 502 · bukan sumber sizing
• SearXNG: instance search.mectov.my.id · engine yandex/naver/bing OK · bukan sumber sizing
• nmap: top-100 optional · skip jika cuma butuh web targets
• Fingerprint: curl+grep CMS/version/title → filter status 200 + version & country
• Output standar: recon/<target>/targets.txt + report.md
• RECON target: container vs host, OS, user, id, cgroup/dockerenv
• LOOT: creds · API keys · DB · .env (wp-config, grep api_key/secret/token)
• PERSIST: stateless RCE (container) · SSH + init.d + .user.ini (host)
• CLEANUP: hapus kompetitor · keep OUR cache_*.php · allowlist
• Loot per-target folder LOOT/<target>/: SUMMARY · credentials · api_keys · sensitive · shell_locations
• Chunked RCE extraction (78 char, error-cap ~270) untuk output besar
• Urutan count: Apify → FOFA proxy → FOFA direct (directive 09/25)
• T1 bobaruwl1 · ACTIVE · COUNT-ONLY
Point: ~2,836 · Query: 0 · Data: 0 · VIP: no
Status: sehat · [-501] = transient, retry 1× sebelum rotate
• T2 barbar03 · CADANGAN DARURAT
Point: ~15 · ~1 fpoint/count · dipakai hanya saat T1 error HARD (403/1010/820031)
• T3 proxy api-f.leetserver.net · DOWNLOAD/SAMPLE + COUNT
Balance: ~9.800 · Daily limit: 10 search/hari · reset harian · POST /search X-API-Key
Status: last-resort · NO_RESULTS = gratis · GET /me = check balance
• Biaya per aksi FOFA (size=1):
count dork (size=1) = 1 fpoint · fetch 50 target = ~4 fpoint
mass 500 target = ~1 fpoint · full export 70k = ~70 fpoint
• Fallback: CT-Log (crt.sh + urlscan, unlimited) + SearXNG