hunt-hunting-methodology

# Hunting Methodology ## The 5-Phase Non-Linear Workflow ### Phase 1: Understand the Target (before touching anything) 1. Read program scope, policy, safe harbor 2. Read 5+ disclosed reports in hacktivity 3. Map crown jewels: what would hurt the company most? 4. Understand the business domain — what features handle money, PII, auth? ### Phase 2: Map the Surface 1. Subdomain enumeration → live hosts → tech stack detection 2. JS bundle analysis → API endpoints, secrets, internal URLs 3. Run `/surface` for P1/P2/Kill ranking ### Phase 3: Hunt (the actual testing) 1. Pick P1 target from surface ranking 2. Select vuln class based on tech stack: - Rails/Django/Laravel → IDOR, mass assignment - Express/Node → prototype pollution, path traversal - Spring Boot → Actuator, SSTI - Next.js → SSRF via Server Actions - GraphQL → introspection, IDOR via node(), mutation auth bypass 3. Test with concrete payloads (see /hunt) 4. Apply the Sibling Rule on every endpoint 5. 20-minute rotation if no progress 6. Build a **depth matrix** before declaring a class exhausted: - Dimensions: `entrypoint × method × content-type × encoding × bypass` - Minimum 30 combinations on P1 surface (seed with `uv run python3 $CLAUDE_PROJECT_DIR/tools/intel_engine.py matrix <class>`) - Do not stop at the first blocked payload — mutate and continue 7. Run **cross-context variants** for every promising input: - URL / query, JSON, form-urlencoded, multipart, GraphQL variables - Header / cookie mirrors, reflected values, stored values, async jobs / webhooks 8. Execute **encoding ladders** systematically: - raw → URL → double-URL → unicode escape → mixed-case / separator insertion - Keep the semantic payload constant through each ladder step - Then **stack encodings** in a single payload: `html-entity+URL` (`%26lt%3Bscript%26gt%3B`), `URL+html-entity`, `unicode-escape+URL`, `base64+URL`. WAFs typically decode once; targets decode twice, so a payload that looks benign after a single decode still executes at the sink. 9. Execute **auth-state permutations**: - unauthenticated, low-priv user A, low-priv user B, high-priv, expired token, stale session, cross-tenant - Compare response deltas (status, length, timing), not only status codes 10. Treat every bypass as a **family**, not a one-off: - For WAF / filter blocks, try separator insertion, case toggling, alternate delimiters, parser differentials, and protocol / host normalization tricks 11. **Log negative evidence** (what failed and why) via `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> recon "coverage-<class>" "<details>"` so autopilot resume avoids repeating exhausted paths. ### Phase 4: Validate + Chain 1. Run 7-Question Gate on any signal 2. If PASS → check A→B chain table 3. If CHAIN REQUIRED → build the chain or drop it 4. If KILL → move on immediately ### Phase 5: Report + Submit 1. Quality check (score ≥ 7) 2. Dupcheck against hacktivity 3. Submit with PoC + evidence + CVSS 4.0 ## Wide vs Deep Route Selection **Wide route** (recon-heavy): New target, unknown surface, no prior data. - Run `/pipeline` for broad coverage first - Then `/surface` to prioritize **Deep route** (hunt-heavy): Known target, mapped surface, returning hunter. - Run `/resume` to see what's untested - Pick the highest-ROI untested endpoint - Go deep on one vuln class ## Developer Psychology Developers make CLASS mistakes, not random ones: - If they forgot auth on endpoint A, they probably forgot on B and C - If they use sequential integer IDs anywhere, they use them everywhere - If input validation is weak in one form, check ALL forms - New features (< 30 days) have the weakest security - Acquired companies (different code, different team) = fresh attack surface ## Time Management | Rule | Action | |---|---| | 5-minute rule | No interesting signals after 5 min → skip target | | 20-minute rotation | No progress in 20 min → rotate vuln class or endpoint | | 1-hour rule | Stuck on one target for 1 hour → switch programs entirely | | A→B time box | 20 min per B candidate, max 3 candidates | | Exhaustion rule | A class is "exhausted" only after the depth matrix baseline + sibling coverage (see Phase 3 steps 6-11) | ## ROI Ranking by Bug Class | Bug Class | Competition | Avg Payout | Verdict | |---|---|---|---| | IDOR | Medium | High | Best ROI — always test first | | Auth bypass | Medium | High | Second priority | | Business logic | Low | High | Unique to each target | | Race conditions | Low | Medium-High | Under-tested | | OAuth/OIDC chains | Low | High | Complex but high payoff | | SSRF → cloud | Medium | Very High | If you find DNS callback | | Cache poisoning | Low | High | Rare skill | | XSS | Very High | Medium | Skip unless you have a chain | | Open redirect | Very High | Low | Only with OAuth chain | | Missing headers | Infinite | $0 | Never submit |