hunt-dispatch

# hunt-dispatch skill-set loader for `/hunt`. one concept (which skills to load), one place. invocation contract: ``` hunt-dispatch mode=redteam hunt-dispatch mode=wapt box=blackbox hunt-dispatch mode=wapt box=greybox ``` ## step 1 — fingerprint (red team only) fingerprint **every** live host, not just the apex. for multi-host / wildcard targets the platform-skill routing must be driven by all banners, not one host's. use `-L` (follow redirects) — identity-provider and CDN signals (`login.microsoftonline.com`, `okta`, `auth0`, CDN banners) routinely sit behind a 30x, so a no-redirect `curl -sI` silently misses those matches. pull both headers and the landing-page HTML (`__NEXT_DATA__`, `VIEWSTATE`, `laravel_session`, `Ignition`, framework markers live in the body, not headers). ```bash HOSTS="$TARGET" if [ -f "recon/$TARGET/live-hosts.txt" ]; then HOSTS=$(cat "recon/$TARGET/live-hosts.txt") fi for H in $HOSTS; do echo "=== $H ===" # -L follow redirects, -D - dump headers, -o body; cap body to keep context small curl -sSL -m 12 -D - -o /tmp/fp_body "https://$H" 2>/dev/null | tr -d '\r' # surface body-only platform markers grep -aoE '__NEXT_DATA__|/_next/|VIEWSTATE|rO0[AB]|laravel_session|Ignition|Telescope|Whitelabel|/actuator|application/grpc|socket\.io|swagger|\.js\.map' \ /tmp/fp_body | sort -u done rm -f /tmp/fp_body ``` if `live-hosts.txt` is absent, the loop still runs once against `$TARGET`. record which signal came from which host — a platform s...