SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssrc-hunter

src-hunter

Security & auditing

View repository

Updated 10-16 06:47

About this skill

ACTION REQUIRED (execute immediately after reading)

  1. NOW: Confirm that the current case's scope.md exists and auth.status=granted. No scope → case-init.ps1，forbiddenautomatic -AuthGranted
  2. NOW: Read ../../field-journal/precedent-pentest.md — daily operating instructions, does not replace scope
  3. NOW: Confirm whether the current task falls within the applicable scope of this skill
  4. NEXT: Read ../../tool-index.md, verify tool availability and actual paths
  5. NEXT: When tools are missing, call bootstrap; do not guess paths
  6. ACT: Enter the workflow. By default, read only the playbook skeleton;payloader/、waf-bypass.md open only when scope has been granted and the user explicitly requests payloads
  7. MUST NOT treat the "2887 H1 report" as a directory already tracked in this repo (h1-reports/ is not in the tree)
  8. MUST NOT disable protection because the payload corpus triggers antivirus alerts; prioritize verifying Git blob/hash and docs/SECURITY-REVIEW-2026-09-03.md
SRC Hunter — Practical Vulnerability Hunting Workflow

Practical Security Response Center / crowdtesting / Bug bounty hunting skill. Translates white-box methodology into black-box probing, layered with real case statistics and a payload library.

When to use this skill

Keyword matches：

  • "src hunting" / "src vulnerability" / "src testing" / "Security Response Center"
  • "bug bounty" / "vulnerability bounty" / "crowdtesting"
  • "hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack"
  • "how to hunt / how to test / how to attack + a target / an endpoint / a parameter"
  • "WAF bypass" / "bypass WAF" / "WAF bypass"
  • "any account / arbitrary modification / arbitrary deletion / arbitrary operation" type privilege escalation
  • "password reset" / "password recovery" type logic
  • "unauthorized access" / "default credentials" / "Actuator" / "Spring exposure" / "Redis unauthorized"
  • User gives a URL or API endpoint for you to test

When this skill should not be used：

  • Pure white-box source code audit (use code-audit skill）
  • Fix/defense Q&A for known vulnerabilities (use general chat)
  • Standalone CTF challenges (this is a real-environment workflow)

Workflow — 5 phases

Phase 1 · Intake

Input: program name / SRC entry URL / subdomain.

Things to do:

  • Capture Scope (in-scope domains / IPs / mobile apps / API endpoints)
  • Capture Out-of-scope (prohibited testing content, third-party services, cloud assets exclusions)
  • Capture rules (payout tiers, disclosure window, retest policy, safe-harbor)
  • Capture test accounts / test headers (e.g. X-Bug-Bounty: <handle>）

Priority assessment(estimate hit rate based on matched type; refer to references/methodology/05-srctimebox-priority.md）：

  • 6-hour window → run high-hit-rate types (password reset 88% / any account 86.4% / withdrawal 83.1%)
  • Single-day window → add information disclosure + asset exposure + Actuator
  • HVV / peak period → full spectrum

→ See details in references/methodology/00-index.md

Phase 2 · Recon (passive reconnaissance)

Intelligence gathering without sending packets to the target:

  • CT logs: crt.sh / Censys (find subdomains)
  • Historical snapshots：Wayback / CommonCrawl
  • GitHub search：org:target + Keywords (password / api_key / SECRET)
  • Search engine dorks：site:target.com inurl:/admin、filetype:env、intitle:Index of
  • ASN / IP ranges: bgp.he.net to find IP blocks
  • Favicon hash: FOFA / Shodan to find assets with the same favicon
  • DNS history：SecurityTrails / Whoisxmlapi

Phase 3 · Enum (active probing)

Asset enumeration：

  • Subdomains: amass / subfinder / puredns / dnsx
  • Liveness: httpx / naabu
  • Screenshots: gowitness / aquatone
  • Content discovery: ffuf / feroxbuster / dirsearch
  • Tech fingerprinting: wappalyzer / webanalyze (also check references/dictionaries/chinese-srcfingerprints.md to hit domestic components)
  • JS extraction: linkfinder / subjs / gau / katana
  • Subdomain takeover fingerprints: subjack / subzy

Phase 4 · Hunt (vulnerability probing)

Follow the corresponding playbook by attack type,every playbook includes: methodology + parameter frequency table + real H1 cases + structured payload + WAF bypass variants.

Priority paths(sorted by hit rate + value):

Playbook Entry hints File
Unauthorized access Actuator/Swagger/default ports/weak passwords references/playbooks/unauth-access.md
Information disclosure .git/.svn/.env/heapdump/path listing references/playbooks/info-disclosure.md
Arbitrary X privilege escalation User-space IDs enumerable/modifiable references/playbooks/arbitrary-x-authz.md
Business logic Password reset/payment/order/verification code references/playbooks/logic-flaws.md
OAuth/SAML/JWT Auth flow/redirect_uri/token references/playbooks/oauth-saml-jwt.md
API REST BOLA/Mass Assignment/rate references/playbooks/api-rest.md
SQLi Any user input into DB references/playbooks/sqli.md
RCE Deserialization/SSTI/XXE/prototype chain/framework references/playbooks/rce.md
SSRF URL parameters/cache/Host injection references/playbooks/ssrf-cache-host.md
Path traversal File path parameters/LFI/RFI references/playbooks/path-traversal.md
File upload Upload point + parsing vulnerability references/playbooks/file-upload.md
XSS Any user input into HTML/JS references/playbooks/xss.md
HTTP smuggling Reverse proxy + Content-Length references/playbooks/http-smuggling.md
GraphQL introspection/nesting references/playbooks/graphql.md
Race condition Concurrent requests / TOCTOU references/playbooks/race-conditions.md
DoS ReDoS / unlimited resource rate / algorithmic explosion references/playbooks/dos.md
Mobile Android / iOS APK references/playbooks/mobile.md
LLM Agent Prompt injection / tool invocation references/playbooks/llm-prompt-injection.md
Internal network post-exploitation Credentials / lateral movement / domain references/playbooks/intranet-postexp.md

General methodology(not divided by attack type):

Document Key content
methodology/01-attack-priority.md RCE>file write>auth bypass>injection>information disclosure value ranking
methodology/02-bypass-toolkit.md General bypass decision tree + encoding / obfuscation / WAF
methodology/03-evidence-discipline.md Black-box evidence rules + anti-hallucination + compliance
methodology/04-control-gap-hunting.md 9 types of sensitive operations → expected controls → probe for absence
methodology/05-srctimebox-priority.md 6h / single-day / HVV / monthly time-box templates

Industry vertical playbooks(prioritize when asset-related):

Industry Document When to use
Banking / payment / finance industry/banking-finance.md Target involves payment / online banking / third-party payment aggregation
Telecom / ISP industry/telecom-isp.md Target is a carrier / BOSS / network management / IoT SIM

Dictionaries / credentials：

Documentation Purpose
dictionaries/default-credentials-cn.md Domestic credentials for Seeyon / Tongda / Wanhu / Weaver / Yonyou / Kingdee / Huawei / ZTE / Hikvision, etc.
dictionaries/chinese-srcfingerprints.md Domestic OA / middleware fingerprints + high-frequency parameters + one-click detection commands

Phase 5 · Report (Submission)

→ Use template templates/report-submission.md

three-part skeleton：

  1. Title: precise to endpoint + vulnerability type, no more than 80 characters
  2. Reproduction steps: each step executable / screenshots / HAR
  3. Impact + remediation recommendations: CVSS 4.0 vector + business impact paragraph

MCP tool integration

This skill supports calling a local MCP server as the tool layer.Primary choice jshookmcp(134 curated tools / 386 full set / 36 domains, built-in Burp Suite bridge / Frida / WASM / anti-debugging / Android adb / sourcemap reconstruction). Full index and scenario mapping:

→ references/tools/mcp-jshook.md

Default recommendation search profile (context cost ~3K tokens), via mcp__jshook__search_tools + mcp__jshook__activate_tools activated on demand, avoiding full profile loading 40K+ tokens all at once.

Data asset scale

Category Magnitude
Attack playbooks 19
General methodology documents 6
Industry vertical playbooks 2 (banking / telecom)
Dictionaries / credentials 3
Report templates 1
Structured payloads 305 entries(177 web + 128 intranet)
WAF / EDR bypass variants 263 steps, covering 23 types of Web attacks
Tool command quick reference 114 entries (Nmap/SQLMap/Burp/MSF/...)
HackerOne real cases (disclosed High/Critical) 2887 reports, categorized by weakness into 141 classification MD files
WooYun historical case statistics (non-renewable) 88,636 entries

H1 real cases have beendirectly embedded at the end of the corresponding playbooks(each playbook ends with a "H1 real cases" Top 12 table + summary).

Compliance and legal red lines

Each playbook has a "things not to do" section at the end. General red lines (observed by any SRC):

  • ❌ Assets / domains out of scope → stop immediately and report
  • ❌ Actually exfiltrating others' PII → only prove accessibility, destroy immediately
  • ❌ Sustained load / DoS / high traffic → only 1–3 PoC packets, stop immediately
  • ❌ Modifying others' data (even with write permission) → verify only on objects you control
  • ❌ Phishing or social engineering in production → do not do it
  • ❌ Submitting unreproduced guesses → must have HTTP packets / screenshots / video evidence
  • ✅ Mark yourself in test headers (e.g. X-Bug-Bounty: <handle>）
  • ✅ Use your own two accounts to stage privilege escalation scenarios yourself
  • ✅ Use OOB domains for SSRF probing, do not use someone else's DNSLog
  • ✅ Before submission, use references/templates/report-submission.md for self-check

CLI mnemonic prefix

srchunter(e.g.:srchunter scope set <program>、srchunter recon run、srchunter findings new <type>). The CLI is currently not implemented; this is only a naming convention.

References / Cross-chain structure

src-hunter/
├── SKILL.md                    # 本文件 — skill 入口
├── README.md                   # 项目说明
└── references/
    ├── methodology/   6 docs   # 通用打法
    ├── playbooks/    19 docs   # 攻击类 playbook（每个含 H1 案例 + Payload 库）
    ├── industry/      3 docs   # 行业垂直
    ├── dictionaries/  3 docs   # 字典 / 凭据
    ├── templates/     1 doc    # 报告模板
    ├── h1-reports/             # 2887 份 H1 报告原始数据 + 141 类 MD
    │   ├── raw/                # 原始 JSON（resume / 二次分析用）
    │   └── by-weakness/        # 按 CWE 分类的 Markdown
    └── payloader/              # 305 条结构化 payload 数据
        ├── raw/                # JSON（机读）
        ├── by-category/        # 按分类的 MD
        ├── tools/              # 工具命令
        └── waf-bypass.md       # 263 步骤 WAF 绕过集

Task completion self-check (MUST pass before claiming completion)

  • Did I execute every step in the workflow (rather than just reading it)?
  • Did I base this on tool-index and use the real tool path?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Did I complete and write back the Checklist items required by RULES?