Hunt Checklists
28 checklists. Tick through them on a live target instead of rereading a blog.
Hunt Checklists index
- First hour on a new program - Do this before you fire nuclei. Most wasted hunts skip the paper.
- JavaScript review - Treat the frontend as source. Most P1s on modern apps start here.
- Authorization / IDOR - If you only have one account you are guessing. Two accounts is the test.
- Authentication / ATO - Account takeover is a chain. Inventory every step of how an identity becomes a session.
- SSRF - Canary first. Metadata second. File handlers last.
- XSS - Marker first. Context second. Execute third. Cookie/CSP last.
- API / GraphQL - The UI is a subset of the schema. Hunt the schema.
- Cache - Two clients. One poisons. The other must receive it.
- Before you submit - Skeptic pass. If you cannot kill your own finding, the triager will.
- Cloud / SaaS extras - Public buckets and metadata still pay. Most of the work is proving it is theirs.
- SQL injection - Boolean and error first. Blind time second. OAST last. Never dump a customer table.
- GraphQL - The schema is the app. Introspection off just means you reconstruct it.
- WebSockets - Handshake, first frame, then every subscribe. Treat it as an API with a worse auth story.
- JWT / session tokens - The payload is a claim list. The header is the attack. Verify what the server actually verifies.
- Race / TOCTOU - If it should happen once, send it twice in one RTT.
- Agents, tools, and retrieval - The finding is an authority gap. A prompt that only confuses the model is not the report. Use mcp-tool-trust and rag-document-trust for the test.
- Passkeys and WebAuthn - A passkey is only as strong as registration, recovery, and the session it mints. Map the ceremony before you treat passwordless as finished.
- Tenant isolation - A tenant is a boundary, not a label in the UI. Replay objects you own across two organisations and record which identifier the server actually trusts.
- Session cookie inventory - Inventory every cookie the app sets, then decide which ones are the session. Flags, scope, and rotation matter more than the cookie name.
- Cache deception - Deception is a disagreement about what is safe to store. A second client must receive the private response before you call it cached.
- Modern OAuth and OIDC - PKCE and DPoP only help if the token endpoint requires them. Read the metadata, then compare it with one login you complete yourself.
- Dependency and CI supply chain - Treat the build as an app. The question is which identity can publish, which workflow can read secrets, and which package name the install trusts.
- MCP and agent tools - The model is not the boundary. Inventory every tool the agent can call, the credentials that tool uses, and what a document you own can convince it to pass along.
- RAG retrieval boundaries - Retrieval is an authorization decision. If the index returns another user's chunk, the model did not cause that, the query did.
- Mobile links and app association - A link is an API entry. Read the association files, then open a link for your own account and record which app and which request result.
- Parser differentials - Two parsers often disagree. Record what the edge accepts, what the app stores, and what a later viewer renders, using a harmless file you created.
- Exports and webhooks - Exports and webhooks are delayed APIs. The job id, the file, and the callback URL each need an owner.
- Exception and debug paths - Failures are a second API. Compare a normal response with a handled error and record what the error adds: a stack, a tenant, a token, or a route that skips a check.