Src Hunter

SRC Bug Bounty Hunting

Overview

Security Response Centers (SRCs, 安全应急响应中心) run scoped, rules-based bug bounty programs with payout tables, explicit out-of-scope lists, and strict compliance red lines. Hunting them productively is a staged campaign — intake, recon, enumeration, hunt, report — where the highest-value failures are scope violations and evidence gaps, not missed vulnerabilities.

This skill encodes that campaign structure plus China-specific asset fingerprinting (OA/中间件 identification, ICP-style asset mapping) and the compliance discipline SRC programs enforce. It complements general bug-hunting skills with the scope/payout discipline and time-boxed prioritization that SRC platforms demand.

Source: cherry-picked and translated from zhaoxuya520/reverse-skill (skills/pentest-tools/src-hunter, MIT license). Reference payload libraries are not bundled; this skill is the standalone workflow.

When to Use

Trigger phrases:

• "hunt on this SRC program"
• "SRC bounty campaign"
• "scope-in/scope-out for a Chinese SRC"
• "time-boxed vulnerability hunt"
• "report a finding to an SRC"
• "China asset fingerprinting for bounty"

Use this skill when:

• You are working a scoped SRC/bug bounty target with published rules and payout tables.
• You need a repeatable, evidence-disciplined campaign rather than ad hoc probing.
• Out-of-scope boundaries and compliance red lines must be respected.

Prerequisites

• Scope authorization for every asset tested (see red lines below).
• A recon toolset: subdomain enumeration, HTTP probing, directory/parameter fuzzing, and a vulnerability scanner for confirmation.
• The program's rules page: scope, out-of-scope, payout table, reporting format.

Workflow

Phase 1: Intake

• Record the scoped target list, the out-of-scope list, the rules, and the payout table in a campaign notes file.
• Note submission format and any "do not test" conditions (production hours, rate limits, WAF behavior).
• Define the campaign time box and the target classes in scope.

Phase 2: Recon

• Subdomain discovery: passive (certificate transparency, DNS) then active (brute force) enumeration; validate resolvable, live hosts.
• Perimeter mapping: CDN/WAF identification (knowledge-pass these — see red lines), origin discovery, cloud asset inventory.
• File-browser and API discovery: exposed directories, JS bundle endpoints, API documentation endpoints, and versioned API surfaces.
• China-specific fingerprinting: OA (office automation) systems, 中间件 (middleware: Weblogic, Tomcat, Nacos, Spring, etc.) version identification — these are frequent SRC fast wins.

Phase 3: Enumeration

• Directory probing: dictionary + wordlist against live hosts; log status code, size, and tech stack.
• Parameter dimension: enumerate parameters on interesting endpoints (including hidden/undocumented params), record param types.
• Functional audit: walk each in-scope feature (auth, upload, search, export, password reset) and note trust boundaries.
• Aim-tagging: tag each finding candidate with the vulnerability class it most plausibly maps to — this drives Phase 4 priority.

Phase 4: Hunt

Prioritize by payout × exploitability using the standard class table:

For each candidate:

• Confirm the class with a minimal proof (no destructive payloads).
• Capture evidence: request/response pair, time, affected asset, impact chain.
• Rule out false positives before moving on; a confirmed finding beats ten unconfirmed leads.

Phase 5: Report

• Evidence discipline: every claim maps to a reproducible request/response or trace — no screenshots of "trust me".
• Classification: state severity, vulnerability class, and business impact (which data/function is affected).
• Relation to known issues: search the program's public duplicates before submitting.
• Timeline: submission date, expected triage SLA, follow-up cadence.

Compliance Red Lines

• No production-damaging actions: no data destruction, no account takeover beyond the minimal proof, no load-generating tests without authorization.
• No privacy exfiltration: never download or exfiltrate real user data; use placeholders and minimal samples.
• No DoS: no volume/amplification testing.
• Authorization scope only: never test out-of-scope or third-party assets reachable from an in-scope host.
• CDN/WAF knowledge-pass: identify them in recon and route around rather than attacking the protection layer itself.
• Contact the SRC before testing anything unusual (origin discovery, production-adjacent assets, third-party integrations).

Hands-On Example

Quick reachability probe of in-scope assets before active fingerprinting (Phase 2 — Recon). With Python's httpx, installed via pip install httpx:

import httpx
for url in ["https://example.com"]:
    r = httpx.get(url, timeout=10, headers={"User-Agent": "probe"})
    print(url, r.status_code, len(r.content), r.headers.get("server"))
# https://example.com 200 559 cloudflare

Output above verified live (example.com 200, 559 bytes). A 200 from a CDN-backed asset is a probe result, not a finding: log it, fingerprint the origin — Kali's apt install nuclei installs nuclei 3.8+ — and only assets that survive scope + compliance red-line checks get active testing.

Verification

Run this self-check before claiming completion:

• Campaign notes contain scope, out-of-scope, rules, and payout table.
• Recon artifacts (subdomain list, live hosts, CDN/WAF map) exist and are reproducible.
• Every finding has a request/response evidence pair and an affected asset.
• Priority ordering followed payout × exploitability, not convenience.
• No red line was crossed; scope checks are documented per tested asset.
• Report includes classification, business impact, and duplicate check.

When NOT to Use

• Unscoped testing or assets without authorization — stop and get scope.
• Pure infrastructure/networking programs (no web surface) — use network pentest workflows.
• A program-agnostic hunt with no SRC rules or payout table — bug-hunting is the generic AI-orchestrated workflow.
• Long-running 24/7 scanning across many targets — continuous-hunter; SRC hunting is time-boxed by design.
• Long-horizon APT-style engagement — SRC hunting is time-boxed by design.

Anti-Rationalization Table