Src Hunter

---
name: src-hunter
description: Practical SRC / Crowdsourced Security / Bug Bounty vulnerability hunting workflow skill. Features: 5-phase methodology (intake → recon → enum → hunt → report), 19 attack-class playbooks (SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS), 305 structured payloads, 263 WAF/EDR bypass variants, 2,887 disclosed HackerOne High/Critical real-world cases, 77,000+ WooYun historical case statistics, Chinese OA/middleware fingerprint library, and banking/telecom vertical industry playbooks. Triggered when the user mentions "src hunting / src vulnerability hunting / bug bounty / crowdsourced testing / hackerone / SRC / arbitrary X vulnerability / penetration testing" or asks "how to hunt a specific target / how to test an API / how to bypass WAF".
argument-hint: "<target-or-program-or-phase>"
level: 2
---

## ACTION REQUIRED (Execute immediately upon reading)

1. `NOW`: Verify that `scope.md` exists for the current case and that `auth.status=granted`. If scope is missing → `arsenal scripts case-init`; automatically setting `-AuthGranted` is **STRICTLY PROHIBITED**.
2. `NOW`: Read `skill://webapp-pentest-tools/support/field-journal/precedent-pentest.md` — daily operational guidelines; does not replace scope.
3. `NOW`: Confirm whether the current task falls within the scope of this skill.
4. `NEXT`: Verify tool availability and paths; invoke bootstrap when tools are missing; do not guess paths.
5. `ACT`: Enter workflow. Read only playbook skeletons by default; open `skill://webapp-web-offensive-waf-bypass` only when scope is granted and the user explicitly requests payloads.
6. `MUST NOT` treat "2887 H1 reports" as tracked repository directories (`h1-reports/` is not in the tree).
7. `MUST NOT` disable antivirus/EDR protections due to payload corpus alerts.

# SRC Hunter — Practical Vulnerability Hunting Workflow

Practical Security Response Center / Crowdsourced Security / Bug Bounty hunting skill. Translates white-box methodologies into black-box discovery, reinforced by real-world case statistics and payload libraries.

---

## When to Use This Skill

**Keyword Matches**:
- "src hunting" / "src vulnerability" / "src testing" / "Security Response Center"
- "bug bounty" / "vulnerability bounty" / "crowdsourced security"
- "hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack"
- "how to hunt / how to test / how to exploit + target / endpoint / parameter"
- "WAF bypass" / "bypass WAF"
- "arbitrary account / arbitrary modification / arbitrary deletion / arbitrary operation" authorization bypasses
- "password reset" / "account recovery" logic flaws
- "unauthorized access" / "default credentials" / "Actuator" / "Spring exposed" / "Redis unauthorized access"
- The user provides a URL or API endpoint for testing

**When NOT to Use This Skill**:
- Pure white-box source code audits (use `code-audit` skill)
- Remediation / defensive inquiries for known vulnerabilities (use general chat)
- Standalone CTF challenges (this skill targets production environments)

---

## Workflow — 5 Phases

### Phase 1 · Intake

Input: Program name / SRC portal URL / Subdomain.

Actions:
- Extract Scope (in-scope domains / IPs / mobile apps / API endpoints)
- Extract Out-of-scope (restricted assets, third-party services, cloud asset exclusions)
- Extract Rules (payout tiers, disclosure window, retest policy, safe-harbor)
- Extract test accounts / test headers (e.g., `X-Bug-Bounty: <handle>`)

**Priority Assessment** (Estimated hit rate by attack type):
- 6-hour window → Target high hit-rate classes (Password Reset 88% / Arbitrary Account 86.4% / Withdrawal 83.1%)
- 1-day window → Add Information Disclosure + Asset Exposure + Actuator endpoints
- Red Team / Focus period → Full-spectrum assessment

→ For details, see `skill://webapp-pentest-tools/references/pentest-loop.md`
### Phase 2 · Recon (Passive Reconnaissance)

Intelligence gathering without sending packets to the target:

- **CT Logs**: crt.sh / Censys (subdomain discovery)
- **Historical Snapshots**: Wayback / CommonCrawl
- **GitHub Search**: `org:target` + keywords (password / api_key / SECRET)
- **Search Engine Dorks**: `site:target.com inurl:/admin`, `filetype:env`, `intitle:Index of`
- **ASN / IP Ranges**: bgp.he.net for IP blocks
- **Favicon Hash**: FOFA / Shodan to find matching favicon assets
- **DNS History**: SecurityTrails / Whoisxmlapi

### Phase 3 · Enum (Active Enumeration)

**Asset Enumeration**:
- Subdomains: amass / subfinder / puredns / dnsx
- Host Alive Check: httpx / naabu
- Screenshots: gowitness / aquatone
- Content Discovery: ffuf / feroxbuster / dirsearch
- Technology Fingerprinting: wappalyzer / webanalyze (cross-reference domestic Chinese software/middleware fingerprints)
- JS Analysis: linkfinder / subjs / gau / katana
- Subdomain Takeover Fingerprinting: subjack / subzy

### Phase 4 · Hunt (Vulnerability Probing)

Execute the corresponding playbook by attack type. **Each playbook includes**: Methodology + Parameter frequency tables + Real H1 cases + Structured payloads + WAF bypass variants.

**Priority Path** (Ranked by hit rate + impact value):

| Playbook | Entry Indicator | Canonical Skill |
|---|---|---|
| **Unauthorized Access** | Actuator/Swagger/Default ports/Weak passwords | `skill://webapp-testing-api-authentication-weaknesses` |
| **Information Disclosure** | .git/.svn/.env/heapdump/Directory listing | `skill://webapp-testing-for-sensitive-data-exposure` |
| **Arbitrary X Authorization Bypass** | Enumerable/Mutable user-level IDs | `skill://webapp-authorization-testing` |
| **Business Logic** | Password reset/Payment/Orders/SMS CAPTCHA | `skill://webapp-business-logic-testing` |
| **OAuth/SAML/JWT** | Auth flow/redirect_uri/token | `skill://webapp-auth-offensive-jwt` / `skill://webapp-auth-offensive-oauth` |
| **API REST** | BOLA/Mass Assignment/Rate limiting | `skill://webapp-api-security` |
| **SQLi** | Any user input reaching the DB | `skill://webapp-web-offensive-sqli` |
| **RCE** | Deserialization/SSTI/XXE/Prototype pollution/Frameworks | `skill://webapp-web-offensive-rce` |
| **SSRF** | URL parameter/Cache/Host injection | `skill://webapp-web-offensive-ssrf` |
| **Path Traversal** | File path parameter/LFI/RFI | `skill://webapp-exploiting-client-side-path-traversal` |
| **File Upload** | Upload endpoints + Parsing/Execution flaws | `skill://webapp-web-offensive-file-upload` |
| **XSS** | Any user input entering HTML/JS context | `skill://webapp-web-offensive-xss` |
| **HTTP Request Smuggling** | Reverse proxy + Content-Length discrepancies | `skill://webapp-web-offensive-request-smuggling` |
| **GraphQL** | Introspection/Nested queries | `skill://webapp-web-offensive-graphql` |
| **Race Conditions** | Concurrent requests / TOCTOU | `skill://webapp-web-offensive-race-condition` |
| **DoS** | ReDoS / Uncapped resource requests / Algorithmic complexity | `skill://webapp-testing-for-regex-dos-redos` |
| **Mobile** | Android / iOS APK analysis | `skill://mobile-conducting-mobile-app-penetration-test` |
| **LLM Agent** | Prompt injection / Tool call abuse | `skill://webapp-testing-llm-prompt-injection-and-jailbreaks` |
| **Internal Post-Exploitation** | Credentials / Lateral movement / Domain exploitation | `skill://webapp-conducting-internal-network-penetration-test` |
**General Methodology** (Cross-attack-type):

| Document / Discipline | Core Content | Canonical Reference |
|---|---|---|
| **Attack Priority** | Value prioritization: RCE > File Write > Auth Bypass > Injection > Information Disclosure | `skill://webapp-pentest-tools/references/pentest-loop.md` |
| **Bypass Toolkit** | Universal bypass decision tree + Encoding / Obfuscation / WAF evasion | `skill://webapp-web-offensive-waf-bypass` |
| **Evidence Discipline** | Black-box evidence rules + Anti-hallucination verification + Compliance | `arsenal scripts append-evidence` |
| **Control Gap Hunting** | 9 critical operation categories → Required controls → Control gap discovery | `skill://webapp-security-control-differential-testing` |
| **Timebox Priority** | 6h / 1-day / Red Team / Monthly timebox templates | `skill://webapp-pentest-tools/references/recon-pipeline.md` |

**Industry Vertical Playbooks** (Prioritize when target aligns with domain):

| Industry | Focus Surface | When to Use |
|---|---|---|
| Banking / Payment / Finance | Transaction tampering, rate limiting, BOLA | Target involves payments, online banking, or payment aggregators |
| Telecom / ISP | API gateways, administrative consoles, routing protocols | Target is an ISP, BOSS, Network Management System (NMS), or IoT SIM provider |

**Dictionaries / Credentials**:

| Resource | Purpose |
|---|---|
| Default Credentials | Default credentials for enterprise OA, middleware, routers, and cameras |
| Asset Fingerprints | Chinese OA / Middleware fingerprints + High-frequency parameters + One-liner detection commands |
### Phase 5 · Report

→ Use template `skill://webapp-pentest-tools/templates/findings.md`

**Three-Part Structure**:
1. **Title**: Specific endpoint + Vulnerability type, under 80 characters.
2. **Reproduction Steps**: Step-by-step executable instructions / Screenshots / HAR file.
3. **Impact + Remediation**: CVSS 4.0 vector + Business impact section.

---

## MCP Tool Integration

This skill supports calling local MCP servers as the tool layer. **Primary choice: jshookmcp** (134 curated tools / 386 full suite / 36 domains, featuring built-in Burp Suite bridge / Frida / WASM / Anti-debugging / Android adb / Sourcemap reconstruction). Full index and scenario mappings:

→ JSHook MCP Integration: use `mcp__jshook__search_tools` and `mcp__jshook__activate_tools`

Recommended default: `search` profile (~3K context token overhead). Activate on demand via `mcp__jshook__search_tools` + `mcp__jshook__activate_tools` to avoid loading 40K+ tokens at once with the `full` profile.

---

## Dataset Scale

| Category | Volume |
|---|---|
| Attack Playbooks | 19 |
| General Methodology Documents | 6 |
| Industry Vertical Playbooks | 2 (Banking / Telecom) |
| Dictionaries / Credentials | 3 |
| Report Templates | 1 |
| Structured Payloads | **305 entries** (177 web + 128 internal) |
| WAF / EDR Bypass Variants | **263 steps**, covering 23 Web attack classes |
| Tool Command Cheatsheets | 114 entries (Nmap/SQLMap/Burp/MSF/...) |
| HackerOne Real-World Cases (Disclosed High/Critical) | **2,887 reports**, categorized across 141 weakness Markdown files |
| WooYun Historical Case Statistics (Non-reproducible) | 88,636 entries |

Real-world H1 cases are **directly embedded at the end of each playbook** (each playbook concludes with a Top 12 "H1 Real-World Cases" table + summary).

---

## Compliance and Legal Boundaries

Every playbook contains a "What NOT to Do" section at the end. General red lines (mandatory across all SRC programs):

- ❌ Out-of-scope assets / domains → Stop testing immediately and report to program.
- ❌ Extracting third-party PII → Only demonstrate proof-of-access, destroy data immediately.
- ❌ Sustained load / DoS / Excessive traffic → Send only 1–3 PoC requests, terminate immediately.
- ❌ Modifying third-party data (even with write access) → Validate only on attacker-controlled test objects.
- ❌ Phishing or social engineering in production environments → Prohibited.
- ❌ Submitting unverified assumptions → HTTP requests / Screenshots / Video proof required.
- ✅ Use custom test headers to identify traffic (e.g., `X-Bug-Bounty: <handle>`).
- ✅ Use two self-registered accounts to demonstrate horizontal/vertical privilege escalation.
- ✅ Use dedicated Out-of-Band (OOB) domains for SSRF probing; avoid public third-party DNSLog services.
- ✅ Perform pre-submission self-check using `skill://webapp-pentest-tools/templates/findings.md`.

---

## CLI Mnemonic Prefix

`srchunter` (e.g., `srchunter scope set <program>`, `srchunter recon run`, `srchunter findings new <type>`). This CLI is not yet implemented; provided as a naming convention only.

---

## Reference / Cross-Link Structure

```
src-hunter/
├── SKILL.md                    # This file — skill entry point
├── README.md                   # Project description
└── references/
    ├── methodology/   6 docs   # General methodologies
    ├── playbooks/    19 docs   # Attack playbooks (each contains H1 cases + Payload library)
    ├── industry/      3 docs   # Industry verticals
    ├── dictionaries/  3 docs   # Dictionaries / Credentials
    ├── templates/     1 doc    # Report templates
    ├── h1-reports/             # 2,887 H1 raw reports + 141 weakness-categorized MDs
    │   ├── raw/                # Raw JSON (for resuming / secondary analysis)
    │   └── by-weakness/        # Markdown files categorized by CWE
    └── payloader/              # 305 structured payload entries
        ├── raw/                # JSON (machine-readable)
        ├── by-category/        # Category-based MDs
        ├── tools/              # Tool execution commands
        └── waf-bypass.md       # 263-step WAF bypass repository
```


## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Have I executed each step of the workflow (rather than merely reading)?
- [ ] Have I used real tool paths based on `tool-index`?
- [ ] Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
- [ ] Have I completed and updated all checklist items required by RULES?