---
name: scenarios-master
description: "MASTER SCENARIO DISPATCHER — Maps attacker goals to RTExit skills, scenarios, and Docker Kali tools. Use this FIRST in any engagement."
---

# RTExit Scenario Master Dispatcher

> **Read this first.** Given a target type or goal, this dispatcher tells you which skill's `scenarios.md` to read, which scenarios to try in priority order, and which Docker Kali tools to use.

---

## Quick Dispatch Table

| Attacker Goal | Read Skill Scenario | Top Scenarios | Kali Tools |
|---|---|---|---|
| LFI / File read | `02-web/rt-path-traversal/scenarios.md` | S01-S15, S51-S57 | `ffuf`, `curl`, `dotdotpwn` |
| XXE | `02-web/rt-xxe/scenarios.md` | CVE-2017-9805, CVE-2019-17554 | `burp`, `curl` |
| SSRF | `02-web/rt-exploit-ssrf/scenarios.md` | IMDS, internal services | `ffuf`, `interactsh-client` |
| SQLi | `02-web/rt-exploit-injection/scenarios.md` | S01-S39 | `sqlmap`, `ghauri` |
| XSS | `02-web/rt-exploit-xss/scenarios.md` | Stored/Reflected/DOM | `dalfox`, `xsstrike` |
| IDOR | `02-web/rt-exploit-idor/scenarios.md` | S01-S70 | `burp`, `curl` (Autorize) |
| Business Logic | `02-web/rt-business-logic/scenarios.md` | Payment, signup, OAuth | `burp` (Turbo Intruder) |
| CORS/CSRF | `02-web/rt-cors-csrf/scenarios.md` | S01-S40 | `curl` |
| Race Condition | `02-web/rt-race-conditions/scenarios.md` | S01-S70 | `turbo-intruder`, `curl` |
| Request Smuggling | `02-web/rt-request-smuggling/scenarios.md` | CL.TE, TE.CL, H2 | `h2csmuggler`, `python3` |
| OAuth/OIDC | `02-web/rt-oauth-oidc/scenarios.md` | redirect_uri, scope | `burp` |
| API BOLA/BFLA | `03-api/rt-exploit-api/scenarios.md` | S01-S50 | `burp`, `curl` |
| GraphQL | `03-api/rt-exploit-graphql/scenarios.md` | Introspection, batching | `graphql-cop`, `inql` |
| JWT | `02-web/rt-exploit-jwt/scenarios.md` | alg=none, weak key | `jwt_tool`, `hashcat` |
| Deserialization | `02-web/rt-deserialization/scenarios.md` | ysoserial, marshalsec | `ysoserial`, `ysoserial-modified` |
| File Upload | `02-web/rt-exploit-file-upload/scenarios.md` | Webshell, polyglot | `burp` |
| Prototype Pollution | `02-web/rt-prototype-pollution/scenarios.md` | S01-S05 | `ppmap` |
| Web Cache Poisoning | `02-web/rt-cache-attacks/scenarios.md` | Header injection | `burp` |
| Clickjacking | `02-web/rt-clickjacking/scenarios.md` | Frame busting bypass | `burp` |
| AWS Exploitation | `05-cloud/rt-exploit-cloud-aws/scenarios.md` | S3, IMDS, Lambda | `aws-cli`, `pacu` |
| Azure AD | `packaged-assets/.agents/skills/rt-azure-ad/SKILL.md` | OAuth, MS Graph | `roadtools`, `azure-cli` |
| GCP | `packaged-assets/.agents/skills/rt-exploit-cloud-gcp/SKILL.md` | Metadata, IAM | `gcloud` |
| Active Directory | `06-active-directory/rt-exploit-active-directory/scenarios.md` | Kerberoast, DCSync | `impacket`, `mimikatz`, `rubeus` |
| ADCS ESC1-13 | `06-active-directory/rt-adcs-esc9-13/SKILL.md` | Cert template abuse | `certipy` |
| Zerologon | `06-active-directory/rt-zerologon/SKILL.md` | CVE-2020-1472 | `impacket` |
| PrintNightmare | `06-active-directory/rt-printnightmare-rce/SKILL.md` | CVE-2021-1675 | `cube0x0` exploit |
| PetitPotam | `06-active-directory/rt-coercion-attacks/SKILL.md` | CVE-2021-36942 | `impacket` |
| NTLM Relay | `06-active-directory/rt-kerberos-relay/SKILL.md` | NTLM relay chains | `ntlmrelayx`, `responder` |
| Wifi | `07-network/rt-wifi-attacks/SKILL.md` | PMKID, Evil Twin | `hcxdumptool`, `hostapd-wpe` |
| Container Escape | `05-cloud/rt-kubernetes/SKILL.md` | privileged, mount | `kubectl`, `linpeas` |
| Mobile Android | `04-mobile/rt-exploit-android/SKILL.md` | APK reverse, Frida | `jadx`, `frida`, `apktool` |
| Mobile iOS | `04-mobile/rt-exploit-ios/SKILL.md` | IPA reverse, Frida | `frida-ios-dump`, `objection` |
| AI/LLM | `13-ai-llm/rt-ai-llm-security/SKILL.md` | Prompt injection, jailbreak | `garak`, `rebuff` |
| OSINT | `01-recon/rt-osint/SKILL.md` | email, domain, leak | `theHarvester`, `h8mail` |
| Subdomain Enum | `01-recon/rt-subdomain-enum/SKILL.md` | DNS brute | `subfinder`, `amass` |
| JS Analysis | `01-recon/rt-js-analysis/SKILL.md` | Secrets in JS | `linkfinder`, `secretfinder` |
| GitHub Recon | `01-recon/rt-github-recon/SKILL.md` | Leaked secrets | `trufflehog`, `gitleaks` |
| Phishing | `packaged-assets/.agents/skills/rt-exploit-phishing/SKILL.md` | Templates, infra | `gophish`, `evilginx2` |
| Vishing | `packaged-assets/.agents/skills/rt-exploit-vishing/SKILL.md` | Call scripts | `voicemyai` |
| BEC | `packaged-assets/.agents/skills/rt-exploit-bec/SKILL.md` | Business email | `evilginx2` |
| Persistence | `packaged-assets/.agents/skills/rt-persistence/SKILL.md` | Implants, scheduled | `impacket`, `schtasks` |
| Lateral Movement | `packaged-assets/.agents/skills/rt-lateral-movement/SKILL.md` | WMI, PSExec, WinRM | `impacket`, `wmiexec` |
| PrivEsc | `packaged-assets/.agents/skills/rt-privilege-escalation/SKILL.md` | Linux/Windows | `linpeas`, `winpeas` |
| Post Exploitation | `packaged-assets/.agents/skills/rt-post-exploitation/SKILL.md` | Cred hunt, dump | `mimikatz`, `lazagne` |
| C2 Operations | `packaged-assets/.agents/skills/rt-c2-operations/SKILL.md` | Sliver, Havoc, Mythic | `sliver`, `havoc` |
| Defense Evasion | `packaged-assets/.agents/skills/rt-defense-evasion/SKILL.md` | ETW bypass, AMSI | `SysWhispers3` |
| Beacon Sleep | `packaged-assets/.agents/skills/rt-beacon-sleep-masking/SKILL.md` | Ekko, Foliage | `C-Slides` |
| Process Injection | `packaged-assets/.agents/skills/rt-process-injection-advanced/SKILL.md` | Process hollowing | `C` |
| PPID Spoofing | `packaged-assets/.agents/skills/rt-ppid-spoofing/SKILL.md` | Parent PID | `C` |
| ETW Bypass | `packaged-assets/.agents/skills/rt-etw-bypass/SKILL.md` | EtwEventWrite patch | `C` |
| Syscall Bypass | `packaged-assets/.agents/skills/rt-syscall-bypass/SKILL.md` | Direct syscalls | `SysWhispers3` |
| Golden SAML | `packaged-assets/.agents/skills/rt-golden-saml/SKILL.md` | ADFS token forge | `ADFSpoof` |
| ADFS | `06-active-directory/rt-adfs/SKILL.md` | ADFS exploitation | `ADFSpoof` |

---

## How an Agent Should Use This

### Step 0: Load Memory (CRITICAL — Always Do First)
Read the engagement context to know where you are:
```bash
# Read state
cat _rtexit-output/data/engagement-context.json | jq .

# Check phase, findings, creds, etc.
jq -r '.engagement.phase' _rtexit-output/data/engagement-context.json
jq -r '.findings.total' _rtexit-output/data/engagement-context.json
jq -r '.agent_log[-5:]' _rtexit-output/data/engagement-context.json
```
See [AGENT-MEMORY.md](AGENT-MEMORY.md) for full details.

### Step 1: Identify Attacker Goal
User says: "I want to test for LFI" or "target has GraphQL endpoint" or "test Zerologon on this DC"

### Step 2: Look Up the Skill
- Use the **Quick Dispatch Table** above
- For example: "I want to test for LFI" → `02-web/rt-path-traversal/scenarios.md`
- "I want to test Zerologon" → `06-active-directory/rt-zerologon/SKILL.md`

### Step 3: Pick the Right Tools
- Use [TOOLS-MASTER.md](TOOLS-MASTER.md) to find which tools to use
- For LFI: `ffuf`, `curl`, `dotdotpwn`
- For GraphQL: `graphql-cop`, `inql`
- For Zerologon: `impacket`, `python3`

### Step 4: Read the Skill's `scenarios.md`
- Open the file
- Read the **Index** at the top
- For your goal, identify the **top 3-5 scenarios** with the highest probability of working
- Each scenario has:
  - **Context** (where this appears)
  - **Seen in** (real CVE / HackerOne / engagement)
  - **Detection** commands
  - **Exploit** commands
  - **Chain** step-by-step
  - **Bypass / Notes** for filters

### Step 5: Run Detection First
```bash
# In Docker Kali container (always — tools are pre-installed)
docker exec -it rtexit-kali bash

# Run the Detection command from the scenario
# For example, for LFI S01:
curl -s "https://target.com/file?name=../../../../etc/passwd"
```

### Step 6: Try Scenarios in Order
- Always try the **simplest first** (no encoding, no wrapper)
- Then try **bypasses** if blocked
- Then try **CVE-specific** payloads if version matches
- Track which scenarios you tried, which worked

### Step 7: Chain to Maximum Impact
- Each scenario's **Chain** section tells you how to escalate
- Don't stop at file read — try to get RCE, ATO, or full compromise

### Step 8: Update Memory & Document
```bash
# After every action, update context
python3 _rtexit/scripts/init-engagement.py update \
  --agent "breaker" \
  --field "findings.list.+=..." \
  --note "Found LFI on staging"

# For findings:
python3 _rtexit/scripts/finding_tracker.py add \
  --title "..." --severity "critical" --target "..." --cvss 9.8
```
- Use `rt-finding-document` skill to write a finding
- Evidence: screenshot, request/response, output

---

## Decision Tree Examples

### Example 1: "I found a file parameter — should I test LFI?"

```
Found ?file= parameter
  ↓
Read 02-web/rt-path-traversal/scenarios.md
  ↓
Try S01: ../../../../etc/passwd (5 min)
  ↓ Worked? → Read sensitive files → Try S14-S30 for RCE
  ↓ Blocked? → Try S02-S13 for encoding bypasses
  ↓ Confirmed RCE possible? → Get shell → Move to rt-post-exploitation
```

### Example 2: "Target has GraphQL endpoint"

```
Found /graphql endpoint
  ↓
Read 03-api/rt-exploit-graphql/scenarios.md
  ↓
Run introspection query (S01)
  ↓ Exposed? → Map all types → Look for IDOR (S16-S20), batching DoS (S08-S12)
  ↓ Disabled? → Try field suggestions bypass (S06-S07)
  ↓ Found vuln? → Chain to ATO or data dump
```

### Example 3: "Domain Controller in scope"

```
DC at dc01.corp.local
  ↓
Read 06-active-directory/rt-zerologon/SKILL.md FIRST (no creds needed)
  ↓
Try CVE-2020-1472 (5 min)
  ↓ Worked? → DCSync → Full domain takeover
  ↓ Failed? → Move to rt-exploit-active-directory/scenarios.md
  ↓
Try AS-REP Roasting (S06-S08) for any user
  ↓ Got creds? → Move to AD attack chain
  ↓
Try PrintNightmare (rt-printnightmare-rce)
  ↓ Worked? → RCE on DC → DCSync
```

### Example 4: "AWS account compromised"

```
Got AWS keys
  ↓
Read 05-cloud/rt-exploit-cloud-aws/scenarios.md
  ↓
Run aws sts get-caller-identity
  ↓
Check IAM permissions (enumerate)
  ↓
Look for S3 buckets, Lambda, EC2, etc.
  ↓
Try privilege escalation patterns (S16-S20)
  ↓
Document all access → Move to rt-exploit-cloud-azure or similar
```

---

## Scenario Priority Per Engagement Phase

### Phase 1: Reconnaissance (Pre-Attack)
- Use `01-recon/` skills (OSINT, subdomain enum, GitHub recon, JS analysis)
- Goal: Map attack surface
- Output: List of URLs, technologies, exposed services

### Phase 2: Initial Access
- Use `02-web/`, `03-api/`, `04-mobile/`, `07-network/` skills
- Goal: Get first foothold (RCE, ATO, shell)
- Top scenarios: IDOR, XSS, File Upload, Auth Bypass, RCE

### Phase 3: Post-Exploitation
- Use `packaged-assets/.agents/skills/rt-post-exploitation/SKILL.md`
- Goal: Escalate, dump creds, pivot
- Top scenarios: PrivEsc, Credential Hunt, Lateral Movement

### Phase 4: Active Directory / Cloud
- Use `06-active-directory/`, `05-cloud/` skills
- Goal: Domain/cloud takeover
- Top scenarios: Kerberoast, DCSync, ADCS abuse, IMDS, S3

### Phase 5: Persistence & C2
- Use `packaged-assets/.agents/skills/rt-persistence/SKILL.md`, `rt-c2-operations/SKILL.md`
- Goal: Maintain access
- Top scenarios: Scheduled tasks, services, implants, sleep masking

### Phase 6: Reporting
- Use `14-reporting/`, `15-management/` skills
- Goal: Document findings
- Top skills: rt-finding-document, rt-technical-report, rt-executive-report, rt-mitre-map

---

## Docker Kali Container — Always Use

```bash
# Start the container (built from /docker/kali/Dockerfile)
docker-compose -f docker/lab/docker-compose.yml up -d

# Enter
docker exec -it rtexit-kali bash

# Verify tools (in container)
/opt/rt-verify/rt-verify-all.sh

# Tools available:
# - Web: burpsuite, zaproxy, ffuf, nuclei, sqlmap, ghauri, jwt_tool, dalfox, xsstrike, dotdotpwn, graphql-cop, inql, ysoserial
# - Network: nmap, masscan, responder, ntlmrelayx, crackmapexec, bloodhound-python
# - AD: impacket, mimikatz, rubeus, certipy, bloodhound, sharphound
# - Cloud: aws-cli, azure-cli, gcloud, pacu, scoutsuite
# - Mobile: jadx, apktool, frida, objection, frida-ios-dump
# - Web3: hardhat, foundry, slither, mythril
# - WiFi: aircrack-ng, hcxdumptool, hostapd-wpe, wifite
# - C2: sliver, havoc, mythic
# - Frida scripts: /opt/frida-scripts/

# Always:
# 1. Run INSIDE the Docker Kali container (tools pre-installed)
# 2. Save outputs to /opt/loot/ (shared volume)
# 3. Document each step with screenshots → /opt/loot/screenshots/
```

---

## Scenario Selection Heuristics

### For Time-Boxed Engagements (1-2 days)
Focus on **high-impact, low-effort** scenarios:
- LFI (path-traversal S01-S10) — 5 min to confirm
- IDOR (idor S01-S20) — 30 min for mass dump
- Default credentials — 5 min
- CVE-2020-1472 (Zerologon) — 5 min if DC in scope
- S3 bucket enumeration — 1 hour for full dump

### For Deep Engagements (1-4 weeks)
Layer scenarios:
- All LFI variants + RCE chains
- All IDOR + business logic
- All OWASP Top 10
- All AD attack chains
- All cloud privilege escalation

### For Bug Bounty (Time-Optimized)
- Focus on **disclosed HackerOne patterns** in each `scenarios.md`
- Try high-bounty areas: ATO, RCE, payment bypass, privilege escalation
- Avoid low-impact: Self-XSS, missing headers, clickjacking

---

## When You Don't Know What to Do

1. Run `rt-help` (in `15-management/`) for methodology selection
2. Run `rt-status` to see current engagement status
3. Run `rt-attack-surface-map` to map the target
4. Pick top 3 attack types from the attack surface
5. For each, look up scenarios in this dispatcher
6. Try scenarios in priority order
7. Document findings as you go

---

## Summary

This dispatcher is your **first read** in any engagement. After reading it:
1. Identify your goal
2. Read the corresponding `scenarios.md` file
3. Run detection commands in Docker Kali
4. Try exploits in priority order
5. Chain to maximum impact
6. Document with `rt-finding-document`

**Always run inside the Docker Kali container** — all tools are pre-installed and verified.

---

## Verification (Read after every engagement)

Run the verify script to ensure all scenario files are in good shape:
```bash
cd /opt/RTExit
pwsh verify-scenarios.ps1
# Expected: 557+ scenarios, 91+ unique CVEs, 143+ H1 refs
```

If counts are lower, run the scenario expansion sub-task.
