45 tagged cti, measured the same way as everything else here.
Browse within: ai-security 37bug-bounty 37bugcrowd 37claude-ai 37claude-code-skill 8cyber-threat-intelligence 8digital-forensics 8investigation 8
Command
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 | /bypass-403 -l.
Command
Password spray with hard guards — typed-hostname confirmation, lockout warning, audit log. Modes: http-form (custom login page), oauth (password grant), o365 + okta (via TREVORspray). Default delay 30min/round + 60s jitter. Usage /spray --mode --users --passes.
Command
Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage…
Command
Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case [seed...].
Command
False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check.
Command
THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti [--deep|--quick|--passive].