# Prooflane

Prooflane is an original CTF and bug bounty research desk. It discovers public opportunities, solves a narrow class of offline encoding puzzles, and records repeated GET observations for explicitly authorized URLs. Its value is the trail from source and scope to a reviewable report. It does not claim to find accepted vulnerabilities, win CTFs, or earn money on its own.

The [portfolio dashboard](index.html) displays a saved demonstration made from Prooflane's own loopback fixtures. The public page makes no requests to challenge or bounty targets. Its browser workbench transforms pasted text locally. The Python CLI keeps discoveries, lab runs, and reports in a private SQLite workspace.

## Requirements and quick start

Python 3.11 or newer is required. The core CLI has no runtime package dependencies. From this directory:

```sh
python -m unittest discover -s tests -v
python -m prooflane --workspace .prooflane demo
python -m prooflane --workspace .prooflane serve --port 8791
```

Open `http://127.0.0.1:8791/` for the local dashboard. The `demo` command starts a temporary server bound to loopback, makes repeated GET observations against its original weak and hardened pages, blocks a redirect outside its exact URL scope, and solves an original encoded fixture. It shuts the server down after the run. The run status is `partial` because the deliberate redirect block is recorded. Local history is under `.prooflane/` and is excluded from the source archive.

## CTF discovery and solving

```sh
python -m prooflane --workspace .prooflane discover --output .prooflane/discovery.json
python -m prooflane --workspace .prooflane solve examples/dispatch.txt --output .prooflane/solution.json
```

Discovery reads the CTFtime events API and a public HackerOne program directory snapshot. It ranks entries using visible metadata, reports source failures separately, and presents them as leads to review. A directory entry never authorizes testing, and an event listing does not prove that an award is available. The local dashboard can refresh discovery manually. If a source is unavailable or its schema changes, inspect the source status rather than treating the shortlist as complete.

The Python solver accepts up to 65,536 bytes from a file you supply. It searches a bounded number of states for common `flag{}`, `ctf{}`, `picoCTF{}`, `HTB{}`, `THM{}`, and `prooflane{}` patterns through base64, hexadecimal, ROT13, reversing ASCII, and a limited single-byte XOR pass. It records each transformation and the input hash. Results are **candidates**; Prooflane does not submit or verify them with a platform. It does not execute binaries, scripts, or decoded text. The public browser workbench has its own smaller text-only transform set and a 32 KB input limit.

One reproducible historical exercise has a [visual case study](ctf/ductf-2024-shufflebox/index.html) and a [technical writeup](ctf/ductf-2024-shufflebox/README.md). It recovers a censored input from the [official DownUnderCTF 2024 shufflebox archive](https://github.com/DownUnderCTF/Challenges_2024_Public/tree/f2797a33d8f5851508f37e854afceedf85eee8a3/beginner/shufflebox) using two known input/output pairs. Download the two handouts from the pinned official links in the writeup before running its solver; the public Prooflane source archive includes our original case study, writeup, and solver without the organizer's handouts. The solver checks the original output handout hash, inverts the derived permutation, and re-encodes all three rows. The recovered flag is an offline result from a published archive; no competition submission or completion credit is claimed.

## Scoped observations

The example manifest at [examples/scope.example.json](examples/scope.example.json) intentionally has `authorized: false`, `automation_allowed: false`, and an expired date. To use an actual program, first read its current rules and obtain permission for the exact URLs and automated request rate. Then create a private manifest with both booleans set to literal `true`, a future expiry, and only the approved exact URLs.

```sh
python -m prooflane --workspace .prooflane plan --scope path/to/private-scope.json
python -m prooflane --workspace .prooflane assess --scope path/to/private-scope.json
python -m prooflane --workspace .prooflane watch --scope path/to/private-scope.json --cycles 3 --interval 60
```

`plan` validates scope without contacting a target. `assess` makes two paced GET observations per selected URL, up to the manifest's shared request budget. `watch` repeats bounded assessments while sharing that same budget across cycles. Redirect destinations must also match an exact allowed URL; private, special, and rebound DNS addresses are blocked. The transport validates TLS certificates, limits body size, and stores hashes plus derived security metadata instead of response bodies or cookies. Observed header and cookie gaps are hypotheses for manual review, not verified vulnerabilities. No submissions or payload testing occur.

Reports from `assess` are written to `.prooflane/reports/`. `status` shows local evidence. `outcome` records a manually supplied program decision or receipt reference against an existing finding fingerprint; the local database cannot independently authenticate those claims. Do not publish the private workspace or treat an `accepted` entry as a payout.

## Public release artifacts

Run the local fixture builder after changing source or tests:

```sh
python build_release.py
```

It regenerates `public-demo.json` from original loopback evidence and creates `prooflane-source.zip` with an explicit list of source, fixtures, tests, documentation, and the original DownUnderCTF 2024 writeup and solver. The organizer's handouts, private SQLite workspace, and fetched discovery records are excluded. The dashboard links to both files. A release should include `index.html`, `app.js`, `style.css`, `README.md`, `public-demo.json`, and `prooflane-source.zip` together.

## Limits and publication

- Prooflane supports introductory offline encoding puzzles; it does not solve arbitrary CTF categories or operate on competition hosts.
- Discovery feeds are leads that can become stale. Check the official event or program page before acting.
- The demo's header observations come from original local fixtures. They show repeatability and redaction, not a real bounty result.
- The public demo states zero accepted reports and zero payouts. An actual result requires platform completion evidence or a program decision and, for money claims, an authenticated payment record.
- Keep restricted challenge solutions private and follow each platform's publication rules.

The source is licensed under [MIT](LICENSE).