/hunt

---

description: Start hunting on a target — loads scope, reads disclosed reports, picks best attack surface based on tech stack, runs targeted vuln checks. Usage: /hunt target.com [--vuln-class ssrf|idor|xss|sqli|oauth|race|graphql|llm|upload|business-logic]

/hunt

Active vulnerability hunting on a target.

What This Does

1. Reads program scope (in-scope assets, exclusions, payment behavior)
2. Loads recon output from recon// if available
3. Detects tech stack and maps to primary bug classes
4. Runs targeted tests for the highest-ROI bug classes
5. Documents findings with exact HTTP requests

Usage

/hunt target.com
/hunt target.com --vuln-class idor
/hunt target.com --vuln-class ssrf
/hunt target.com --vuln-class graphql
/hunt target.com --source-code   (if repo is available)

Phase 1: Read Before Touching (15 min)

Read Program Scope

1. Go to program page (HackerOne/Bugcrowd/Intigriti)
2. Note ALL in-scope domains — only test these
3. Note ALL out-of-scope domains — never test these (Vienna: /advuew/* excluded!)
4. Note impact types accepted (some exclude "low" severity)
5. Check average bounty — signals program generosity

Read Disclosed Reports (Intel)

# HackerOne Hacktivity for this program:
# https://hackerone.com/TARGET_NAME/hacktivity

# Search by bug class:
# https://hackerone.com/hacktivity?querystring=TARGET_NAME+IDOR
# https://hackerone.com/hacktivity?querystring=TARGET_NAME+SSRF

# Extract from each report:
# 1. Which endpoint
# 2. Which bug class
# 3. What parameter
# 4. What check was missing
# 5. What they paid

Phase 2: Tech Stack Detection (2 min)

TARGET="target.com"

curl -sI https://$TARGET | grep -iE "server|x-powered-by|x-aspnet|x-runtime|x-generator"

# Stack → Primary bug class:
# Ruby on Rails  → mass assignment, IDOR
# Django         → IDOR (ModelViewSet), SSTI
# Flask          → SSTI (render_template_string), SSRF
# Laravel        → mass assignment, IDOR
# Express/Node   → prototype pollution, path traversal
# Spring Boot    → Actuator endpoints, SSTI
# Next.js        → SSRF via Server Actions, open redirect
# GraphQL        → introspection, IDOR via node(), auth bypass on mutations

Phase 3: Active Testing

IDOR Testing (highest ROI)

# Setup: create two accounts (attacker + victim)
# Log in as attacker, perform actions, note all IDs in requests
# Replay with attacker's token but victim's IDs

# Test HTTP method variations:
# If GET /api/user/123/orders is protected:
curl -X DELETE https://target.com/api/user/123/orders \
  -H "Authorization: Bearer ATTACKER_TOKEN"

# Test API version differences:
# Protected: /api/v2/user/123/data
# Try: /api/v1/user/123/data (older version, may lack auth)

# Test GraphQL node():
# {"query": "{ node(id: \"dXNlcjoy\") { ... on User { email phone } } }"}

Auth Bypass Testing

# Check all siblings — if 9 have auth, find the 1 that doesn't:
for endpoint in export delete share arc