EntroVyx/hermes-agent-offsec - Page 2

gitlab-public-recon

Mine GitLab for secrets, CI tokens when subdomain found.

hardcoded-credential-hunt

Detect hardcoded passwords in HTML forms, JavaScript, comments, and API responses.

iot-camera-recon

Attack cameras via RTSP, ONVIF, Axis config when 554 open.

js-secrets-extraction

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

jwt-attack

Decode, forge, brute JWTs when Bearer auth header is seen.

llm-prompt-injection

LLM prompt injection / system prompt extraction — 40+ technique catalog against hardened GPT-4o-class deployments. Covers direct/indirect/agentic attacks, encoding bypasses, delimiter smuggling, boolean extraction, positional enumeration, RAG poisoning,…

phpinfo-to-rce

Chain phpinfo to RCE via exec check when info.php exposed.

port-mass-scan

Port scan /8-/24 with Masscan+RustScan and nmap banners.

port-service-discovery

Nmap scan for MySQL, Redis, FTP, SSH, internal API services.

s3-minio-content-type-xss

Exploit public bucket objects via Content-Type override to achieve stored XSS.

scada-hikvision-isapi

Enumerate and fingerprint Hikvision ISAPI endpoints on SCADA/IoT web interfaces.

recon-solar-installers

Sector-specific recon for solar panel installation company websites — residential solar, commercial solar, battery storage, energy audits. Typically WordPress with financing calculators, energy savings estimators, and customer referral portals. These sites…

source-leak-hunt

Mass scan for exposed env files, backups, and git configs.

staging-subdomain-hunt

Hunt staging via crt.sh when production is WAF-hardened.

subdomain-enumeration

Map subdomains via crt.sh and subfinder at recon kickoff.

unauth-api-flow-hijack

Exploit unauthenticated multi-step API flows — start, submit, upload, export without credentials.

web-enumeration

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

wordpress-plugin-hunt

Hunt WP plugins via REST, exploit CVEs when version known.

wp-mass-recon

Batch WP recon: users, CORS, XMLRPC, leaks across domains.

wp-plugin-rest-auth-bypass

Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification,…

zimbra-attack

Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.

bb-methodology

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology,…

bugcrowd-reporting

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause…

cloud-iam-deep

GCP/AWS/Azure cloud exploitation -- Cloud Functions, Firestore, Cloud Run, S3, MinIO, Blob Storage, SA keys

cors-chain-automation

Multi-endpoint CORS credential test automation — batch-probes API endpoints for CORS misconfiguration, distinguishes exploitable reflect-any-origin + credentials from false positives (ACAO: * alone), generates browser PoCs, and chains findings to subdomain…

evidence-hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails,…

hunt-api-misconfig

Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC…

hunt-ato

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link…

hunt-auth-bypass

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain…

hunt-brute-force

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA,…

hunt-business-logic

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow…

hunt-cache-poison

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception…

hunt-cloud-misconfig

Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles,…

hunt-cors

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…

hunt-csrf

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled…

hunt-deserialization

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP…

hunt-dispatch

Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the…

hunt-file-upload

Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte…

hunt-firebase

Hunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase…

hunt-grpc

Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway…