| name | autonomous-research-loops |
| description | Structured autonomous-research methodology for when standard phases stop yielding findings -- six research loops (technology-driven, disclosed-report mining, research-blog learning, behavior-driven fuzzing, passive asset intelligence, business-logic/privilege attacks) plus a hypothesis-driven ideate/evaluate/weaponize/cascade research cycle modeled on Kettle's HTTP Terminator approach. Converted from master-pentest-prompt.md Phases 32.5 and 32.6. Use when all standard phases are exhausted with no new findings across two full passes, or when a technology has no matching playbook. |
Autonomous expansion mode & AI-augmented research
When to use
Trigger conditions: all standard phases/skills have run with no new
findings across two full passes; a fingerprinted technology has no
matching playbook; a partial finding needs a custom exploit built for
it; unusual behavior suggests a vuln class nothing else covers. This is
the engagement's escape hatch from checklist-driven testing into
genuinely open-ended research -- not a replacement for the phased
skills, a continuation once they're exhausted.
Run 3 full loops from the six below; each loop must end with at least
one new curl test actually executed against the target, not just
research read. Stop only when 3 consecutive loops yield nothing new or
the Tier-2 tool-call budget (budget_guard.py) is hit.
The six research loops
Loop A -- technology-driven research: for every fingerprinted
technology, search "<tech> <version> vulnerability <year>", "<tech> CVE exploit writeup", "site:hackerone.com <framework>",
"site:medium.com <framework> bug bounty",
"site:portswigger.net/research <tech>". Fetch the best article in
full, extract the exact technique, adapt it to the target, test it with
curl, log the result. Never read without acting on it.
Loop B -- disclosed report mining: search "hackerone disclosed reports <company>", "site:hackerone.com/reports <tech>",
"site:medium.com <company> bug bounty". For each report found, extract
the specific pattern (parameter type, endpoint shape, triggering
behavior) and hunt the same pattern on the current target. If a bug hit
API v1, test v2 too.
Loop C -- research-blog learning, in priority order: PortSwigger
(web-security academy + research), HackerOne disclosed reports,
Assetnote, ProjectDiscovery blog, Bishop Fox, WatchTowr Labs, SRC:INC,
Intigriti Bug Bytes, GitHub CVE PoCs, Medium bug-bounty tags. Read,
extract the technique, then implement it manually against the live
target (replicate Burp-only techniques by hand in curl).
Loop D -- behavior-driven fuzzing:
- Response-time anomaly: baseline first, then
SLEEP(5)/WAITFOR DELAY/pg_sleep/Thread.sleep/MongoDB $where sleep. A delta over
4s against baseline signals an injection point.
- Undocumented params: POST a body with every plausible hidden flag at
once (
debug, verbose, test, admin, internal, preview,
bypass, override, dev, force, all true); any response change
reveals an undocumented param worth testing fully.
- Type confusion: string->int/array/object, null, negative, zero, an
oversized 10k-char string, float, unicode, empty, whitespace-only.
Document any 500/stack-trace/behavior change.
- HTTP verb tampering on every endpoint (GET/POST/PUT/PATCH/DELETE/
OPTIONS/HEAD/TRACE/CONNECT) -- flag any 200 where 405 was expected,
and flag data differences per method.
Loop E -- passive asset intelligence:
- JS deep dive: grep bundles for staging/dev/internal/qa/test hostnames,
S3 buckets, hardcoded creds, client-controlled feature flags
(
isAdmin=false sent from the client), commented-out endpoints,
postMessage handlers, DOM sinks, exposed source maps.
- Subdomain intel via search:
site:target.com, inurl:api|admin| internal|staging, filetype:pdf|xlsx|docx.
- Wayback Machine: fetch
web.archive.org/web/*/target.com/api/* --
old endpoints often lack current patches, so test deleted endpoints
anyway rather than assuming they're gone.
- GitHub recon:
"site:github.com <domain> api key|secret|token",
config/env/credential file searches, Pastebin/Gist for company
keywords; validate any leaked creds directly against the live API.
Loop F -- business logic & privilege attacks (the hall-of-fame
category):
- Price/quantity abuse: negative quantity, zero price,
0.001, integer
overflow, currency-swap tricks, discount/coupon stacking, gift-card
reuse, refund abuse.
- Workflow step-skipping: map every multi-step flow (checkout,
onboarding, 2FA, verification, plan upgrade) and call step N+2
directly without completing step N.
- Mass assignment: send read-only fields back in POST/PUT (
role: admin, isAdmin: true, plan: enterprise), including inside nested
objects.
- Cross-tenant/org access: with 2 accounts in 2 separate orgs, use Org
B's session to access Org A's resources (projects, members, invoices)
across numeric, UUID, and slug identifiers -- a hit here is a critical
tenant-isolation bug.
- Rate limit & brute-force: OTP brute force (10 codes with no lockout is
brute-forceable), reset-token brute force (especially numeric/short
tokens), login brute force -- always document the exact evidence.
AI-augmented autonomous research (the HTTP Terminator cycle)
Model any genuinely novel-attack hunt on this four-stage cycle, credited
to Kettle's HTTP Terminator research approach:
- Ideation: generate hypotheses (novel desync classes, parser
differentials, cache-key gaps, framework-specific quirks) as
structured candidates, scored by impact x likelihood x test-cost.
Pull new idea sources from recent PortSwigger research, framework
release notes, CVE diffs, and HackerOne disclosed reports for the
same stack.
- Evaluation: for each hypothesis, build the minimal single-request
probe that discriminates it, run it against the live target, and
record the exact request, response, and diff against baseline.
- Weaponization: on any positive signal, chain it into real impact
(smuggling -> request-queue poisoning/cache poison -> stored XSS;
CRLF desync -> request splitting -> victim session hijack; internal
cache poison -> account-agnostic page takeover) and re-test
end-to-end with a real browser where possible.
- Cascade: after one success, generate the next family of
candidates from it -- a 0.CL win implies probing CL.0/H2.TE next; a
cache-key gap implies probing unkeyed header families; a parser
differential implies probing the mirror-image discrepancy. Never stop
testing at the first hit.
Budget discipline: hard-cap probes per hypothesis (default 20); each
loop must end with at least one logged curl test; stop when 3
consecutive loops yield no new signal. Log every candidate, result, and
decision into the report. Tooling: Burp's HTTP Request Smuggler v3.0 /
HTTP Terminator output can feed hypothesis candidates directly; feed
every discovered token/param back into the next loop automatically.
