Bundled with the Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

ACTION REQUIRED (execute immediately after reading)

NOW: read ../../field-journal/precedent-pentest.md — confirm that this skill's operations are authorized routine operations
NOW: confirm whether the current task falls within this skill's scope
NEXT: read ../../tool-index.md, verify tool availability and actual paths
NEXT: when tools are missing, invoke bootstrap; do not guess paths
ACT: enter step 1 of the "Workflow" and execute; do not stop at the confirmation stage

SRC Hunter — Practical Vulnerability Hunting Workflow

A practical Security Response Center / crowdsource testing / bug bounty hunting skill. Translates white-box methodology into black-box probing, layered with real case statistics and a payload library.

When to Use This Skill

Keyword hits:

"src hunting" / "src vulnerability" / "src testing" / "Security Response Center"
"bug bounty" / "bounty" / "crowdsource testing"
"hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack"
"how to hunt / how to test / how to hit + some target / some endpoint / some parameter"
"WAF bypass" / "bypass WAF"
"arbitrary account / arbitrary modify / arbitrary delete / arbitrary operation"-class broken access control
"password reset" / "account recovery"-class logic
"unauthorized access" / "default credentials" / "Actuator" / "Spring exposure" / "unauthenticated Redis"
User gives you a URL or API endpoint to test

Do not use this skill:

Pure white-box source code audits (use the code-audit skill)
Fix / defense Q&A for known vulnerabilities (use general conversation)
Standalone CTF challenges (this is a real-environment workflow)

Workflow — 5 Phases

Phase 1 · Intake (taking the engagement)

Inputs: program name / SRC entry URL / subdomain.

Things to do:

Grab the scope (in-scope domains / IPs / mobile apps / API endpoints)
Grab the out-of-scope items (forbidden content, third-party services, cloud asset exclusions)
Grab the rules (payout tiers, disclosure window, retest policy, safe-harbor)
Grab test accounts / test headers (e.g., X-Bug-Bounty: <handle>)

Priority judgment (estimate hit rates by finding type, see references/methodology/05-srctimebox-priority.md):

6-hour window → run high-hit-rate types (password reset 88% / arbitrary account 86.4% / withdrawal 83.1%)
Single-day window → add information disclosure + asset exposure + Actuator
HVV / critical period → full spectrum

→ Details in references/methodology/00-index.md

Phase 2 · Recon (passive reconnaissance)

Intelligence gathering without sending packets to the target:

CT logs: crt.sh / Censys (find subdomains)
Historical snapshots: Wayback / CommonCrawl
GitHub search: org:target + keywords (password / api_key / SECRET)
Search engine dorks: site:target.com inurl:/admin, filetype:env, intitle:Index of
ASN / IP ranges: bgp.he.net to find IP blocks
Favicon hash: FOFA / Shodan to find assets with the same favicon
DNS history: SecurityTrails / Whoisxmlapi

Phase 3 · Enum (active probing)

Asset enumeration:

Subdomains: amass / subfinder / puredns / dnsx
Liveness: httpx / naabu
Screenshots: gowitness / aquatone
Content discovery: ffuf / feroxbuster / dirsearch
Technology fingerprinting: wappalyzer / webanalyze (also check references/dictionaries/chinese-srcfingerprints.md to identify domestic Chinese components)
JS extraction: linkfinder / subjs / gau / katana
Subdomain takeover fingerprints: subjack / subzy

Phase 4 · Hunt (vulnerability probing)

Follow the playbook for each attack type; every playbook includes: methodology + parameter frequency tables + real H1 cases + structured payloads + WAF bypass variants.

Priority paths (ordered by hit rate + value):

Playbook	Entry Hints	File
Unauthorized access	Actuator/Swagger/default ports/weak passwords	`references/playbooks/unauth-access.md`
Information disclosure	.git/.svn/.env/heapdump/directory listing	`references/playbooks/info-disclosure.md`
Arbitrary X broken access control	User-state IDs enumerable/modifiable	`references/playbooks/arbitrary-x-authz.md`
Business logic	Password reset/payment/orders/CAPTCHA	`references/playbooks/logic-flaws.md`
OAuth/SAML/JWT	Auth flows/redirect_uri/tokens	`references/playbooks/oauth-saml-jwt.md`
REST API	BOLA/Mass Assignment/rate limits	`references/playbooks/api-rest.md`
SQLi	Any user input reaching the DB	`references/playbooks/sqli.md`
RCE	Deserialization/SSTI/XXE/prototype pollution/frameworks	`references/playbooks/rce.md`
SSRF	URL parameters/caching/Host injection	`references/playbooks/ssrf-cache-host.md`
Path traversal	File path parameters/LFI/RFI	`references/playbooks/path-traversal.md`
File upload	Upload points + parsing flaws	`references/playbooks/file-upload.md`
XSS	Any user input reaching HTML/JS	`references/playbooks/xss.md`
HTTP smuggling	Reverse proxy + Content-Length	`references/playbooks/http-smuggling.md`
GraphQL	introspection/nesting	`references/playbooks/graphql.md`
Race conditions	Concurrent requests / TOCTOU	`references/playbooks/race-conditions.md`
DoS	ReDoS / unthrottled resources / algorithmic blowup	`references/playbooks/dos.md`
Mobile	Android / iOS APKs	`references/playbooks/mobile.md`
LLM Agent	Prompt injection / tool calls	`references/playbooks/llm-prompt-injection.md`
Intranet post-exploitation	Credentials / lateral movement / domain	`references/playbooks/intranet-postexp.md`

General methodology (attack-type agnostic):

Document	Key Content
`methodology/01-attack-priority.md`	RCE>file write>auth bypass>injection>info disclosure value ordering
`methodology/02-bypass-toolkit.md`	Universal bypass decision tree + encoding / obfuscation / WAF
`methodology/03-evidence-discipline.md`	Black-box evidence rules + anti-hallucination + compliance
`methodology/04-control-gap-hunting.md`	9 classes of sensitive operations → expected controls → probe for gaps
`methodology/05-srctimebox-priority.md`	6h / single-day / HVV / monthly timebox templates

Industry-vertical playbooks (read first when assets are relevant):

Industry	Document	When to Use
Banking / payments / finance	`industry/banking-finance.md`	Target includes payments / online banking / third-party payment aggregation
Telecom / ISP	`industry/telecom-isp.md`	Target is a carrier / BOSS / network management / IoT SIM cards

Dictionaries / credentials:

Document	Purpose
`dictionaries/default-credentials-cn.md`	Domestic Chinese credentials for Seeyo / Tongda / Wanhu / Weaver / Yonyou / Kingdee / Huawei / ZTE / Hikvision, etc.
`dictionaries/chinese-srcfingerprints.md`	Domestic Chinese OA / middleware fingerprints + high-frequency parameters + one-shot detection commands

Phase 5 · Report (submission)

→ Use the template templates/report-submission.md

Three-part skeleton:

Title: precise down to endpoint + vulnerability type, no more than 80 characters
Reproduction steps: each step executable / screenshots / HAR
Impact + fix recommendations: CVSS 4.0 vector + business impact section

MCP Tool Integration

This skill supports invoking local MCP servers as a tool layer. Primary choice: jshookmcp (134 curated tools / 386 full set / 36 domains, with built-in Burp Suite bridge / Frida / WASM / anti-debugging / Android adb / sourcemap reconstruction). Full index and scenario mapping:

→ references/tools/mcp-jshook.md

The default recommendation is the search profile (~3K token context cost), activating on demand via mcp__jshook__search_tools + mcp__jshook__activate_tools, avoiding the full profile loading 40K+ tokens at once.

Data Asset Scale

Category	Scale
Attack-class playbooks	19
General methodology documents	6
Industry-vertical playbooks	2 (banking / telecom)
Dictionaries / credentials	3
Report templates	1
Structured payloads	305 (177 web + 128 intranet)
WAF / EDR bypass variants	263 steps, covering 23 classes of web attacks
Tool command quick reference	114 (Nmap/SQLMap/Burp/MSF/...)
Real HackerOne cases (disclosed High/Critical)	2,887, grouped by weakness into 141 category MDs
WooYun historical case statistics (non-renewable)	88,636 entries

Real H1 cases are embedded directly at the end of the corresponding playbooks (each playbook ends with a "Real H1 Cases" Top 12 table + summaries).

Compliance and Legal Red Lines

Every playbook ends with a "things not to do" section. General red lines (observed for every SRC):

❌ Assets / domains out of scope → stop immediately and report
❌ Actually exfiltrating others' PII → only prove accessibility, destroy immediately
❌ Sustained load / DoS / heavy traffic → only 1–3 PoC packets, then stop immediately
❌ Modifying others' data (even with write access) → verify only against objects you control
❌ Phishing or social engineering in production → do not do it
❌ Submitting unreproduced speculation → must have HTTP packets / screenshots / video evidence
✅ Mark yourself with a test header (e.g., X-Bug-Bounty: <handle>)
✅ Use two of your own accounts to role-play broken-access-control scenarios
✅ Use your own OOB domain for SSRF probing; do not use someone else's DNSLog
✅ Self-check with references/templates/report-submission.md before submitting

CLI Mnemonic Prefix

srchunter (e.g., srchunter scope set <program>, srchunter recon run, srchunter findings new <type>). No CLI is currently implemented; this is only a naming convention.

Reference / Cross-Link Structure

src-hunter/
├── SKILL.md                    # this file — skill entry point
├── README.md                   # project description
└── references/
    ├── methodology/   6 docs   # general methodology
    ├── playbooks/    19 docs   # attack-class playbooks (each with H1 cases + payload library)
    ├── industry/      3 docs   # industry verticals
    ├── dictionaries/  3 docs   # dictionaries / credentials
    ├── templates/     1 doc    # report template
    ├── h1-reports/             # 2,887 H1 reports raw data + 141 category MDs
    │   ├── raw/                # raw JSON (for resume / secondary analysis)
    │   └── by-weakness/        # Markdown grouped by CWE
    └── payloader/              # 305 structured payload data
        ├── raw/                # JSON (machine-readable)
        ├── by-category/        # MD by category
        ├── tools/              # tool commands
        └── waf-bypass.md       # 263-step WAF bypass collection

Task Completion Self-Check (MUST pass before claiming completion)

Did I execute every step of the workflow (rather than just reading it)?
Did I use real tool paths based on tool-index?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?

Merge Addendum: Controlled Execution Constraints

Before starting any active step, confirm that the current case's scope.md exists and auth.status=granted; when there is no scope, run case-init.ps1 and never auto-attach -AuthGranted. field-journal/precedent-pentest.md is a day-to-day operation reference and does not replace authorization boundaries; tool paths follow tool-index.md, and missing tools go through bootstrap.

Use playbook skeletons read-only by default. Only open payloader/ or waf-bypass.md when the scope is authorized and the user explicitly requests payloads. h1-reports/ is the data asset described in the documentation; do not assume it is tracked in this repository. Evidence and reports must be based on actually captured requests, responses, screenshots, or HAR.

src-hunter

SKILL.mdskills/src-hunter/SKILL.md