autonomous-research-loops

name

autonomous-research-loops

description

Structured autonomous-research methodology for when standard phases stop yielding findings -- six research loops (technology-driven, disclosed-report mining, research-blog learning, behavior-driven fuzzing, passive asset intelligence, business-logic/privilege attacks) plus a hypothesis-driven ideate/evaluate/weaponize/cascade research cycle modeled on Kettle's HTTP Terminator approach. Converted from master-pentest-prompt.md Phases 32.5 and 32.6. Use when all standard phases are exhausted with no new findings across two full passes, or when a technology has no matching playbook.

Autonomous expansion mode & AI-augmented research

When to use

Trigger conditions: all standard phases/skills have run with no new findings across two full passes; a fingerprinted technology has no matching playbook; a partial finding needs a custom exploit built for it; unusual behavior suggests a vuln class nothing else covers. This is the engagement's escape hatch from checklist-driven testing into genuinely open-ended research -- not a replacement for the phased skills, a continuation once they're exhausted.

Run 3 full loops from the six below; each loop must end with at least one new curl test actually executed against the target, not just research read. Stop only when 3 consecutive loops yield nothing new or the Tier-2 tool-call budget (budget_guard.py) is hit.

The six research loops

Loop A -- technology-driven research: for every fingerprinted technology, search "<tech> <version> vulnerability <year>", "<tech> CVE exploit writeup", "site:hackerone.com <framework>", "site:medium.com <framework> bug bounty", "site:portswigger.net/research <tech>". Fetch the best article in full, extract the exact technique, adapt it to the target, test it with curl, log the result. Never read without acting on it.

Loop B -- disclosed report mining: search "hackerone disclosed reports <company>", , . For each report found, extract the specific pattern (parameter type, endpoint shape, triggering behavior) and hunt the same pattern on the current target. If a bug hit API v1, test v2 too.