src-hunter

Begin with the intake phase: extract the program scope, out-of-scope assets, payout rules, and test accounts. Then run passive recon (CT logs, Wayback, GitHub dorks) before active enumeration with tools like subfinder, httpx, and ffuf, and only then enter the hunt phase.

Prioritize by high-severity hit rate: password reset flaws (88% high-severity), arbitrary account takeover (86.4%), payment and amount tampering (74-83%), then unauthorized access, default credentials, and IDOR. The Skill's timebox templates map these to 6-hour, single-day, and month-long engagements.

Yes, it includes a bypass toolkit covering SQLi, XSS, command injection, path traversal, and SSRF filter evasion, plus 263 WAF/EDR bypass steps across 23 web attack classes. It covers protocol-layer tricks like HPP, chunked encoding, and content-type confusion.

No. The Skill enforces strict rules of engagement: only test assets within an authorized program scope, use self-registered accounts for authorization testing, take minimal data samples, and never exfiltrate real user PII or leave webshells. Unauthorized testing is illegal.

Every claim needs reproducible HTTP captures, differential proof (true vs false condition requests), and observable side effects such as OOB callbacks. The Skill provides a CVSS 4.0 report template and a pre-submission checklist covering reproduction rate, screenshots, and PII redaction.

Avoid it for pure white-box source code audits, defensive remediation questions, or standalone CTF challenges, since the workflow assumes black-box authorized testing of real targets. It is also unsuitable for any target outside a defined program scope.