violin/skills/pentest/references/flags-mode.md

Flag-Capture Mode

Optional FLAGS phase for authorised training / lab / challenge-style engagements where the test objective is to retrieve one or more secret "flag" objects (a value the target mints or stores as proof of a completed objective). Applies alongside POST_EXPLOITATION verb like privilege escalation, but the deliverable is a captured value plus a verification receipt.

Use templates/flag-capture-register.md to track every captured value.

Core invariants

1. Target-sourced only. The value is retrieved from the target — its filesystem, a response body, a config node, memory, or re-derived from target evidence you can read. It is never sourced from a blog, writeup, search engine, or third-party dump. Searching online for the value is out of scope for this mode and forbidden.
2. Derive from evidence, not memory of sources. If public descriptions of a lab disagree with what the actual target returns, trust the primary target evidence and re-derive. A value that only appears in a third-party re-statement is not a capture.
3. Shape/mask check. Compare every candidate to the expected shape (length, charset, structure) before recording or using it.
4. Independent re-check. Verify capture by re-reading the target's accepted end-state (value retained / control disabled / objective complete), not from the first accept toast.
5. Paced, one at a time. Apply capture values sequentially with backoff; never blast a batch, which anti-automation swallows.
6. Static analysis only. Never execute a recovered binary or payload to mint a value — analyze with parsers, disassemblers, and decoders and derive the value.
7. Report in-target blockers honestly. If a step that mints or verifies the value must run inside the target's own environment and cannot be reached from this host, record what you can from accessible evidence, mark the row unsupported/blocked, and report the exact blocker. Never fabricate.

When it adds no value

Flag capture is not a substitute for a normal finding: it is an objective marker for authorized training/lab work. For real-world engagements, the FLAGS phase is skipped and objectives are reported as findings with CVSS + evidence.