[command]
name = "predator"
description = "Mass scan targets for known CVEs using D1337 predator engine"

[command.args.targets]
description = "Target URL, file with URLs (one per line), or CIDR range"
required = true

[command.args.mode]
description = "Scan mode: fingerprint (detect only), exploit (detect + verify), full (detect + verify + loot)"
default = "fingerprint"

[command.args.cms]
description = "Force CMS type: wordpress, magento, joomla, nextjs, laravel, auto"
default = "auto"

[command.prompt]
text = """
Load the predator skill. Execute mass scan against {{targets}}.

MODE: {{mode}}
CMS: {{cms}}

WORKFLOW:
1. FINGERPRINT (always):
   - Detect CMS type from response headers, meta tags, URLs
   - Identify version where possible
   - Map attack surface (admin panels, API endpoints, login pages)

2. EXPLOIT (if mode=exploit or full):
   - Match CVEs from predator database (27+ entries)
   - Use TIME-BASED verification (no echo, stealth)
   - Or DNS callback verification
   - Report confirmed vulnerabilities

3. LOOT (if mode=full):
   - Extract wp-config.php / .env files from confirmed vulns
   - Parse database credentials, API keys, salts
   - Save structured loot to .d1337-loot.json

STEALTH RULES:
- NO echo-based verification (too noisy)
- Use time-based OR DNS callback only
- Rate limit: max 2 requests/second per target
- Random User-Agent rotation
- No sequential path scanning

OUTPUT: Structured report with confirmed vulns, loot summary, and next steps.
"""
