SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssrc-hunter

src-hunter

Security & auditing

View repository

Updated 10-16 13:53

About this skill

SRC Hunter — Practical Vulnerability Hunting Workflow

This is a workflow with mandatory checkpoints, not a reference manual. Each phase has MUST outputs; do not proceed to the next phase without passing. Detailed payloads / playbooks / H1 cases are Read on demand; generating them from memory is not allowed.

For data scale, directory tree, and tool index, see README.md. This file only covers "what to do / when to do it / when to read which file".

Trigger Conditions

Triggered if any of the following is hit:

  • "src 挖洞 / 漏洞赏金 / bug bounty / 众测 / hackerone / Security Response Center"
  • "如何挖 / 怎么测 / 怎么打 + a certain target / a certain interface / a certain parameter"
  • "WAF 绕过 / 任意账号 / 任意修改 / 密码重置 / 未授权访问 / 默认凭据"
  • The user gives you a URL / API endpoint / APK to test

Should not trigger: pure white-box source code audit → code-audit skill; vulnerability remediation Q&A → general conversation; CTF → general conversation.

Anti-Hallucination Hard Constraints (applicable throughout)

  1. Do not produce payloads from memory. Before giving any payload for SQLi/RCE/SSRF/XSS, first Read the corresponding references/playbooks/<type>.md(or <type>/00-index.md + specific subfiles, see table below). Phase 4 payloads must be traceable to a source in the files.
  2. Do not fabricate case numbers. Before citing H1/WooYun cases, you must Read the actual files under references/h1-reports/by-weakness/ . If you cannot state the file path, do not cite it.
  3. Do not draw conclusions without evidence. Without HTTP packets/screenshots/videos, you may only write "to be verified / hypothesis", not "confirmed / vulnerability found".
  4. Stop immediately when out of scope. At any time, if you find that the asset to be tested is not in the in-scope list confirmed in Phase 1 → stop immediately and return to Phase 1 for re-verification.

Phase 1 · Intake

Entry condition: The user gives a target / program name / URL for the first time.

MUST output checkpoint (all four items are required to enter Phase 2; ask the user for whatever is missing; do not assume):

  • [ ] In-scope: testable domains / IP ranges / apps / endpoints (list item by item)
  • [ ] Out-of-scope: prohibited items (list item by item)
  • [ ] Rules: payout tier / disclosure window / safe-harbor / testing header (e.g., X-Bug-Bounty:<handle>)
  • [ ] Time box: 6h / single day / HVV / monthly

Only when the user asks "which is most worth testing first" → Read references/methodology/05-srctimebox-priority.md.

Phase 2 · Recon (Passive Reconnaissance)

Entry condition: All four Phase 1 checkpoint items pass.

Prohibited: any active packet sending (port scanning / path brute-forcing / payload testing).

MUST output: asset inventory + historical information obtained without sending packets to the target, from ≥3 sources:

  • CT logs (crt.sh / Censys)
  • Wayback / CommonCrawl historical snapshots
  • GitHub dorks(org:target + password|api_key|SECRET|.env)
  • FOFA / Shodan favicon hash
  • SecurityTrails / DNS history
  • ASN / IP ranges (bgp.he.net)

Phase 3 · Enum (active probing)

Entry condition: Phase 2 asset list is non-empty.

MUST output: live asset matrix—域 → 端口 → 服务 → 指纹 → JS endpoint.

Condition-triggered Read (read if hit; do not read if not hit):

Hit signal MUST Read
Fingerprint contains weaver/seeyon/tongda/landray/yongyou/kingdee/hikvision/dahua references/dictionaries/chinese-srcfingerprints.md + references/dictionaries/default-credentials-cn.md

Phase 4 · Hunt (vulnerability probing)

Entry condition: Phase 3 matrix ≥1 candidate target.

Mandatory process (run once per candidate target):

  1. Look at the target signal, select 1 playbook from the table below
  2. Read that playbook file (do not skip, do not substitute from memory)
  3. Use the playbook's "parameter frequency table" to pick entry points
  4. Probe using the playbook's "payload library"—payloads come from the file, not from training memory
  5. Blocked by WAF → Read references/methodology/02-bypass-toolkit.md decision tree
  6. On hit, immediately save the HTTP packet / screenshot → proceed to Phase 5 candidates
Entry signal MUST Read
Actuator / Swagger / default port / weak password references/playbooks/unauth-access.md
.git / .svn / .env / heapdump / path enumeration references/playbooks/info-disclosure.md
User-space ID enumerable / arbitrary X privilege escalation references/playbooks/arbitrary-x-authz.md
Password reset / payment / verification code / order / withdrawal references/playbooks/logic-flaws/00-index.md
OAuth / SAML / JWT / redirect_uri references/playbooks/oauth-saml-jwt/00-index.md
REST API / BOLA / Mass Assignment / rate references/playbooks/api-rest/00-index.md
Any user input into DB references/playbooks/sqli.md
Deserialization / SSTI / XXE / prototype chain / framework RCE references/playbooks/rce/00-index.md
URL input parameter / cache / Host injection references/playbooks/ssrf-cache-host/00-index.md
File path input parameter / LFI / RFI references/playbooks/path-traversal/00-index.md
Upload point + parsing vulnerability references/playbooks/file-upload/00-index.md
User input reflected into HTML / JS references/playbooks/xss/00-index.md
Reverse proxy + Content-Length / TE references/playbooks/http-smuggling.md
GraphQL endpoint / introspection references/playbooks/graphql.md
Concurrency / TOCTOU references/playbooks/race-conditions.md
ReDoS / unbounded resource / algorithmic explosion references/playbooks/dos.md
APK / IPA / mobile references/playbooks/mobile.md
LLM agent / prompt entry / tool invocation references/playbooks/llm-prompt-injection/00-index.md
Shell / credentials / internal network already obtained references/playbooks/intranet-postexp/00-index.md

Two-step Read mode (already-split playbooks): For playbooks in directory form (rce/ / oauth-saml-jwt/ / ssrf-cache-host/ / api-rest/ / logic-flaws/ / file-upload/ / path-traversal/ / xss/ / llm-prompt-injection/ / intranet-postexp/) in the first step only Read 00-index.md—it contains the sub-file routing table and general methodology. Do not use 00-index as a payload library; after locating the specific scenario via the sub-file routing, then Read the corresponding sub-file (e.g., rce/14-ssti.md / oauth-saml-jwt/12-jwt.md). For playbooks in single-file form (sqli.md / xxx.md) just Read directly.

General methodology (Read only when stuck; do not preload):

  • Don't know what to attack next → references/methodology/01-attack-priority.md
  • Blocked by WAF / EDR → references/methodology/02-bypass-toolkit.md
  • Suspect your own hallucination / want to check the evidence chain → references/methodology/03-evidence-discipline.md
  • Cannot find a vulnerability point → references/methodology/04-control-gap-hunting.md

Phase 5 · Report (submission)

Entry condition: In Phase 4, at least one finding already has a reproducible HTTP packet / screenshot / video.

MUST process (execute in order):

  1. Read references/compliance.md check compliance red lines (do not skip)
  2. Read references/templates/report-submission.md Get template
  3. Three-part output:
    • Title: ≤80 characters, precise to endpoint + vulnerability type
    • Reproduction steps: each step executable, with HTTP packet / curl / screenshot
    • Impact + remediation recommendations: CVSS 4.0 vector + business impact paragraph

MCP Tool Integration

Default mcp__jshook__search_tools + mcp__jshook__activate_tools Activate on demand (~3K tokens). Full index is Read only when the user asks "what tool to use / Burp / Frida / adb":references/tools/mcp-jshook.md。