Bughunterpro

BugHunterPro

Use this skill only for authorized security testing, defensive review, bug bounty targets in scope, or lab environments. Stay inside scope, avoid destructive exploitation, and stop before actions that would exfiltrate real user data, disrupt service, persist access, bypass legal authorization, or abuse third-party systems.

Core Workflow

1. Confirm scope, allowed techniques, test accounts, rate limits, prohibited actions, and reporting format.
2. Map the application:
   • Explore visible content as each role.
   • Identify hidden content, default files, debug parameters, API endpoints, GraphQL schemas, client-side routes, mobile/deep-link endpoints, webhook receivers, admin panels, shadow APIs, old versions, and identifier-driven functions.
   • Record every host, path, method, parameter, cookie, header, file upload, request body shape, object ID, tenant ID, role, state transition, and trust boundary.
3. Analyze the attack surface:
   • Identify technologies, frameworks, authentication flows, session tokens, JWT claims, OAuth/OIDC/SAML flows, service-to-service calls, data stores, queues, caches, CDNs, cloud storage, back-end integrations, and high-impact workflows.
   • Prioritize endpoints that handle identity, money, secrets, admin actions, file handling, automation, AI prompts/tools, cross-tenant data, or third-party callbacks.
4. Test client-side controls:
   • Treat hidden fields, cookies, URL parameters, disabled controls, client validation, and encoded client state as attacker-controlled.
   • Replay requests through an intercepting proxy and modify values server-side.
5. Test authentication:
   • Check username enumeration, password policy, rate limiting, lockout behavior, reset flows, MFA enrollment/bypass, passkeys, device trust, remember-me tokens, impersonation/admin functions, credential transmission, and logic flaws in multi-step login.
   • Test OAuth/OIDC/SAML for redirect URI issues, state/nonce handling, token substitution, confused deputy flows, account linking takeover, audience/issuer validation, signature/algorithm mistakes, and JWT claim trust.
6. Test session management:
   • Inspect token meaning, randomness, rotation after login/privilege change, secure cookie attributes, SameSite, leakage in URLs/logs/referrers/analytics, logout invalidation, idle timeout, concurrent sessions, session fixation, CSRF defenses, refresh-token handling, and cookie scope.
7. Test access controls:
   • Compare high-privilege and low-privilege traffic.
   • Explicitly test IDOR/BOLA by changing object IDs, UUIDs, slugs, tenant IDs, organization IDs, user IDs, file IDs, order IDs, invoice IDs, and nested object references across peer accounts and tenants.
   • Test BFLA/vertical privilege boundaries, broken object property level authorization/mass assignment, horizontal access, multistage functions, static resources, direct method access, predictable IDs, and unsafe controls based on request parameters, headers, roles, feature flags, or Referer.
   • For APIs, check improper inventory management, old versions, undocumented endpoints, excessive data exposure, unrestricted resource consumption, and unrestricted access to sensitive business flows.
8. Test input-based vulnerabilities:
   • Probe all server-processed parameters, cookies, relevant headers, JSON/XML/body fields, route variables, and uploaded filenames.
   • Cover SQL/NoSQL injection, XSS, response/header injection, command injection, path traversal, file inclusion, template/script injection, LDAP/XPath/SOAP/XML/XXE, SSRF/back-end request injection, deserialization, prototype pollution, unsafe file parsing, native parser bugs, and prompt/tool injection in AI-backed features where applicable.
   • For GraphQL, test introspection exposure, field-level authorization, batching, aliases, fragments, depth/complexity limits, object traversal, mutations, and resolver-level IDOR/BOLA.
9. Test business logic:
   • Model intended rules, then try skipped steps, repeated steps, out-of-order actions, negative quantities, race conditions, partial input, stale state, client-trusted prices/roles, idempotency failures, webhook replay, coupon/refund abuse, quota bypass, fake account creation, scalping, and workflow confusion between users.
10. Review architecture and platform:

• Check shared-hosting isolation, default credentials/content, dangerous HTTP methods, proxy behavior, virtual-host routing, TLS configuration, CORS/same-origin policy, CSP, WAF behavior, verbose errors, source maps, backups, exposed diagnostics, cloud buckets, metadata services, CI/CD artifacts, dependency confusion, leaked secrets, and container/Kubernetes control surfaces.
• Test cache and request parsing risks where in scope: web cache poisoning/deception, cache key confusion, unkeyed headers, HTTP request smuggling/desync, HTTP/2 downgrade quirks, host-header injection, and CDN/origin inconsistencies.

11. Follow up every anomaly:

• Treat unusual status codes, timing changes, stack traces, reflections, redirects, parser errors, and different response lengths as leads.
• Minimize and confirm findings with the least intrusive proof.

12. Report clearly:

• Include title, scope, severity, affected asset, prerequisite role, exact reproduction steps, observed impact, evidence, root cause hypothesis, remediation, and retest notes.

Working Style

• Keep a running map of endpoints and findings; do not rely on memory.
• Prefer manual confirmation over blind scanner output.
• Test one variable at a time when confirming a bug.
• Use paired accounts for authorization checks whenever possible.
• For IDOR/BOLA, maintain a matrix of actor, tenant, object type, object ID, operation, expected result, and observed result.
• Preserve evidence but redact secrets, tokens, personal data, and customer records.
• When exploiting would be risky, demonstrate control with a harmless marker or synthetic account.
• Distinguish confirmed vulnerabilities from hypotheses and environmental hardening notes.

2026 Priority Bug Classes

• IDOR/BOLA, BFLA, broken object property authorization, and mass assignment.
• API inventory failures, deprecated versions, shadow endpoints, and excessive data exposure.
• OAuth/OIDC/SAML/JWT account takeover and token validation flaws.
• GraphQL resolver authorization, batching, depth, and introspection issues.
• SSRF into cloud metadata, internal admin planes, webhooks, PDF/image fetchers, and URL previewers.
• Web cache poisoning, cache deception, CDN/origin mismatch, and host-header injection.
• HTTP request smuggling/desync across reverse proxies, CDNs, HTTP/2, and origin servers.
• Race conditions, idempotency failures, payment/refund/coupon abuse, and sensitive business-flow automation.
• Prototype pollution, unsafe deserialization, template injection, dependency confusion, exposed source maps, and leaked secrets.
• AI feature risks: prompt injection, indirect prompt injection, tool abuse, retrieval leakage, overbroad connectors, and cross-user memory/data exposure.

Output Templates

Test Plan

Return:

• Scope and assumptions
• Target map
• High-risk workflows
• Test matrix by category
• Required accounts/tools
• Safety constraints
• Expected deliverables

Finding

Return:

• Title
• Severity and rationale
• Affected asset
• Preconditions
• Steps to reproduce
• Impact
• Evidence
• Remediation
• Retest guidance