← all publishers

h-mmer

@h-mmer source repo

Report this profile Claim this profile

• 117 skills
• 0 followers
• 1 day ago last updated

1. ▌
   Race Condition · h-mmer

   Race Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.
   0
   installs
2. ▌
   Info Disclosure · h-mmer

   Information Disclosure specialist (H1 #18, CWE-200/209/215/538/668/798). Use for finding exposed sensitive data: stack traces, debug endpoints, config files, environment variables, API keys, .git/.env exposure, Spring Actuator surfaces, source code leaks. Standalone is feeder-class — must chain to be reportable.
   0
   installs
3. ▌
   Browser Verifier · h-mmer

   Mandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
   0
   installs
4. ▌
   Sast File Ranker · h-mmer

   Source file attack surface ranker. Reads a repository, scores every source file 1-5 by exploitability. Outputs ranked JSON for per-file hunting. Use via /sast command.
   0
   installs
5. ▌
   Sast Flow Tracer · h-mmer

   Traces data flow from entry points to dangerous operations. Cross-file reasoning to determine which entries can reach which dangers, and what validation exists in between. MUST run on Opus for reasoning depth. Use via /sast command.
   0
   installs
6. ▌
   Sast Entry Mapper · h-mmer

   Maps entry points where untrusted data enters a source file. Lists every function that receives external input with data type, size constraints, and initial validation. Use via /sast command.
   0
   installs
7. ▌
   Sast Gap Analyzer · h-mmer

   Analyzes validation gaps in data flows. Takes traced flows and identifies where checks are missing, insufficient, or bypassable. The 'interaction reasoning' step — finds bugs that exist in the gaps between individually correct-looking code. MUST run on Opus. Use via /sast command.
   0
   installs
8. ▌
   Sast Danger Mapper · h-mmer

   Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.
   0
   installs
9. ▌
   Subdomain Takeover · h-mmer

   Subdomain Takeover specialist (H1 #145). Use for finding dangling DNS records pointing to unclaimed cloud resources, expired services, or deprovisioned infrastructure.
   0
   installs
10. ▌
    Dast Devils Advocate · h-mmer

    Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
    0
    installs
11. ▌
    Privilege Escalation · h-mmer

    Privilege Escalation specialist (H1 #26). Use for testing vertical and horizontal privilege escalation, role manipulation, admin endpoint access, and permission boundary violations.
    0
    installs
12. ▌
    Sast Devils Advocate · h-mmer

    Adversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.
    0
    installs
13. ▌
    Sast Exploit Builder · h-mmer

    Builds working exploits from confirmed SAST findings. Takes a confirmed crash, develops it into a full exploit. Tier 1 (DoS) → Tier 5 (code execution). Use via /sast command after PoC confirmation.
    0
    installs
14. ▌
    Browser Stealth Agent · h-mmer

    Stealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
    0
    installs
15. ▌
    Pentest Agents Sast Methodology · h-mmer

    SAST Methodology
    0
    installs
16. ▌
    Pentest Agents Hunting Methodology · h-mmer

    Hunting Methodology
    0
    installs
17. ▌
    Hunt Xss · h-mmer bundle

    Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta verified against NVD — DOMPurify nesting mXSS (CVE-2024-47875, GHSA-gx9m-whjm-85jf), DOMPurify depth-bypass family (CVE-2024-45801, GHSA-mmhx-hmjr-r674), DOMPurify mXSS via Re-Contextualization (GHSA-h8r8-wccr-v5f2), Auth0 nextjs-auth0 returnTo (CVE-2025-67716, GHSA-mr6f-h57v-rpj5), React Server Components DoS family (CVE-2025-67779/55184, GHSA-5j59-xgg2-r9c4), markdown-to-jsx iframe XSS (CVE-2024-21535), listmonk stored XSS → Admin ATO (GHSA-jmr4-p576-v565, CVSS 8.0). Use when hunting DOM XSS, stored XSS, reflected XSS, postMessage XSS, mXSS, sanitizer bypass (DOMPurify / sanitize-html / bleach), OAuth redirect_uri XSS, prototype pollution → XSS gadgets, markdown renderer XSS, Server Components content injection, agentic LLM output injection.
    0
    installs