Реверс клиентской подписи запросов

★ 8.1 · general

client-reverse is a Claude Code skill that recovers just enough of a client-side request signer to reproduce the request outside the browser when Burp Repeater returns 401/403 due to sign/sig/hmac/nonce/X-Sensor-Data fields or an encrypted body. The approach is packet-first: verify whether replay actually fails before opening DevTools Sources, eliminating roughly half of assumed reversal cases. The skill walks through a locate→recover→runtime→validation→replay spine — tracing backward from the signature field through writer, builder, entry, and source; hooking fetch/XHR; and handling basic webpack/wasm/JSVMP deobfuscation. It is built for bug bounty hunters who need to reach under-tested APIs protected by signing schemes in order to hunt IDOR, BOLA, auth, and business-logic bugs — reversing the signature is the cost of admission, not the finding itself.