Src Hunter

Bundled with the Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

ACTION REQUIRED (execute immediately after reading)

1. NOW: read ../../field-journal/precedent-pentest.md — confirm that this skill's operations are authorized routine operations
2. NOW: confirm whether the current task falls within this skill's scope
3. NEXT: read ../../tool-index.md, verify tool availability and actual paths
4. NEXT: when tools are missing, invoke bootstrap; do not guess paths
5. ACT: enter step 1 of the "Workflow" and execute; do not stop at the confirmation stage

SRC Hunter — Practical Vulnerability Hunting Workflow

A practical Security Response Center / crowdsource testing / bug bounty hunting skill. Translates white-box methodology into black-box probing, layered with real case statistics and a payload library.

When to Use This Skill

Keyword hits:

• "src hunting" / "src vulnerability" / "src testing" / "Security Response Center"
• "bug bounty" / "bounty" / "crowdsource testing"
• "hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack"
• "how to hunt / how to test / how to hit + some target / some endpoint / some parameter"
• "WAF bypass" / "bypass WAF"
• "arbitrary account / arbitrary modify / arbitrary delete / arbitrary operation"-class broken access control
• "password reset" / "account recovery"-class logic
• "unauthorized access" / "default credentials" / "Actuator" / "Spring exposure" / "unauthenticated Redis"
• User gives you a URL or API endpoint to test

Do not use this skill:

• Pure white-box source code audits (use the code-audit skill)
• Fix / defense Q&A for known vulnerabilities (use general conversation)
• Standalone CTF challenges (this is a real-environment workflow)

Workflow — 5 Phases

Phase 1 · Intake (taking the engagement)

Inputs: program name / SRC entry URL / subdomain.

Things to do:

• Grab the scope (in-scope domains / IPs / mobile apps / API endpoints)
• Grab the out-of-scope items (forbidden content, third-party services, cloud asset exclusions)
• Grab the rules (payout tiers, disclosure window, retest policy, safe-harbor)
• Grab test accounts / test headers (e.g., X-Bug-Bounty: <handle>)

Priority judgment (estimate hit rates by finding type, see references/methodology/05-srctimebox-priority.md):

• 6-hour window → run high-hit-rate types (password reset 88% / arbitrary account 86.4% / withdrawal 83.1%)
• Single-day window → add information disclosure + asset exposure + Actuator
• HVV / critical period → full spectrum

→ Details in references/methodology/00-index.md

Phase 2 · Recon (passive reconnaissance)

Intelligence gathering without sending packets to the target:

• CT logs: crt.sh / Censys (find subdomains)
• Historical snapshots: Wayback / CommonCrawl
• GitHub search: org:target + keywords (password / api_key / SECRET)
• Search engine dorks: site:target.com inurl:/admin, filetype:env, intitle:Index of
• ASN / IP ranges: bgp.he.net to find IP blocks
• Favicon hash: FOFA / Shodan to find assets with the same favicon
• DNS history: SecurityTrails / Whoisxmlapi

Phase 3 · Enum (active probing)

Asset enumeration:

• Subdomains: amass / subfinder / puredns / dnsx
• Liveness: httpx / naabu
• Screenshots: gowitness / aquatone
• Content discovery: ffuf / feroxbuster / dirsearch
• Technology fingerprinting: wappalyzer / webanalyze (also check references/dictionaries/chinese-srcfingerprints.md to identify domestic Chinese components)
• JS extraction: linkfinder / subjs / gau / katana
• Subdomain takeover fingerprints: subjack / subzy

Phase 4 · Hunt (vulnerability probing)

Follow the playbook for each attack type; every playbook includes: methodology + parameter frequency tables + real H1 cases + structured payloads + WAF bypass variants.

Priority paths (ordered by hit rate + value):

General methodology (attack-type agnostic):

Industry-vertical playbooks (read first when assets are relevant):

Dictionaries / credentials:

Phase 5 · Report (submission)

→ Use the template templates/report-submission.md

Three-part skeleton:

1. Title: precise down to endpoint + vulnerability type, no more than 80 characters
2. Reproduction steps: each step executable / screenshots / HAR
3. Impact + fix recommendations: CVSS 4.0 vector + business impact section

MCP Tool Integration

This skill supports invoking local MCP servers as a tool layer. Primary choice: jshookmcp (134 curated tools / 386 full set / 36 domains, with built-in Burp Suite bridge / Frida / WASM / anti-debugging / Android adb / sourcemap reconstruction). Full index and scenario mapping:

→ references/tools/mcp-jshook.md

The default recommendation is the search profile (~3K token context cost), activating on demand via mcp__jshook__search_tools + mcp__jshook__activate_tools, avoiding the full profile loading 40K+ tokens at once.

Data Asset Scale

Real H1 cases are embedded directly at the end of the corresponding playbooks (each playbook ends with a "Real H1 Cases" Top 12 table + summaries).

Compliance and Legal Red Lines

Every playbook ends with a "things not to do" section. General red lines (observed for every SRC):

• ❌ Assets / domains out of scope → stop immediately and report
• ❌ Actually exfiltrating others' PII → only prove accessibility, destroy immediately
• ❌ Sustained load / DoS / heavy traffic → only 1–3 PoC packets, then stop immediately
• ❌ Modifying others' data (even with write access) → verify only against objects you control
• ❌ Phishing or social engineering in production → do not do it
• ❌ Submitting unreproduced speculation → must have HTTP packets / screenshots / video evidence
• ✅ Mark yourself with a test header (e.g., X-Bug-Bounty: <handle>)
• ✅ Use two of your own accounts to role-play broken-access-control scenarios
• ✅ Use your own OOB domain for SSRF probing; do not use someone else's DNSLog
• ✅ Self-check with references/templates/report-submission.md before submitting

CLI Mnemonic Prefix

srchunter (e.g., srchunter scope set <program>, srchunter recon run, srchunter findings new <type>). No CLI is currently implemented; this is only a naming convention.

Reference / Cross-Link Structure

src-hunter/
├── SKILL.md                    # this file — skill entry point
├── README.md                   # project description
└── references/
    ├── methodology/   6 docs   # general methodology
    ├── playbooks/    19 docs   # attack-class playbooks (each with H1 cases + payload library)
    ├── industry/      3 docs   # industry verticals
    ├── dictionaries/  3 docs   # dictionaries / credentials
    ├── templates/     1 doc    # report template
    ├── h1-reports/             # 2,887 H1 reports raw data + 141 category MDs
    │   ├── raw/                # raw JSON (for resume / secondary analysis)
    │   └── by-weakness/        # Markdown grouped by CWE
    └── payloader/              # 305 structured payload data
        ├── raw/                # JSON (machine-readable)
        ├── by-category/        # MD by category
        ├── tools/              # tool commands
        └── waf-bypass.md       # 263-step WAF bypass collection

Task Completion Self-Check (MUST pass before claiming completion)

• Did I execute every step of the workflow (rather than just reading it)?
• Did I use real tool paths based on tool-index?
• Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
• Did I complete and write back the Checklist items required by RULES?

Merge Addendum: Controlled Execution Constraints

Before starting any active step, confirm that the current case's scope.md exists and auth.status=granted; when there is no scope, run case-init.ps1 and never auto-attach -AuthGranted. field-journal/precedent-pentest.md is a day-to-day operation reference and does not replace authorization boundaries; tool paths follow tool-index.md, and missing tools go through bootstrap.

Use playbook skeletons read-only by default. Only open payloader/ or waf-bypass.md when the scope is authorized and the user explicitly requests payloads. h1-reports/ is the data asset described in the documentation; do not assume it is tracked in this repository. Evidence and reports must be based on actually captured requests, responses, screenshots, or HAR.