src-hunter

name	src-hunter
description	Bug-bounty/SRC vulnerability-hunting workflow: five-phase methodology (intake, recon, enumeration, hunt, report) with attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, CSRF, path traversal, and file upload.
risk	offensive
source	https://github.com/zhaoxuya520/reverse-skill
source_repo	zhaoxuya520/reverse-skill
source_type	community
date_added	2026-08-25
license	MIT
license_source	https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to Use

• Hunting vulnerabilities in bug-bounty programs within program policy.
• Following a disciplined methodology instead of ad-hoc testing.

何时使用本 skill

关键词命中：

• "src 挖洞" / "src 漏洞" / "src 测试" / "Security Response Center"
• "bug bounty" / "漏洞赏金" / "众测"
• "hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack"
• "如何挖 / 怎么测 / 怎么打 + 某目标 / 某接口 / 某参数"
• "WAF 绕过" / "绕过 WAF" / "WAF bypass"
• "任意账号 / 任意修改 / 任意删除 / 任意操作" 类越权
• "密码重置" / "找回密码" 类逻辑
• "未授权访问" / "默认凭据" / "Actuator" / "Spring 暴露" / "Redis 未授权"
• 用户给一个 URL 或 API endpoint 让你测

不应使用本 skill：

• 纯白盒源码审计（用 code-audit skill）
• 已知漏洞的修复 / 防御问答（用通用对话）
• 单独的 CTF 题目（这是真实环境工作流）

---

工作流 — 5 阶段

Phase 1 · Intake（接单）

输入：程序名 / SRC 入口 URL / 子域。

要做的事：

• 抓 Scope（in-scope domains / IPs / mobile apps / API endpoints）
• 抓 Out-of-scope（禁测内容、第三方服务、cloud assets exclusions）
• 抓规则（payout tiers、disclosure window、retest policy、safe-harbor）
• 抓测试账号 / 测试 header（如 X-Bug-Bounty: <handle>）

优先级判断（基于命中类型预估命中率，参考 references/methodology/05-srctimebox-priority.md）：

• 6 小时窗口 → 跑高命中率类型（密码重置 88% / 任意账号 86.4% / 提现 83.1%）
• 单日窗口 → 加上信息泄露 + 资产暴露 + Actuator
• HVV / 重点期 → 全谱

→ 详见