Hunt briefs
One page per class. The lists are the linked records, the same pack hunt_brief returns for that slug.
Hunt briefs
SSRF huntingServer-side request forgery is a fetch you do not control. Prove the server made the request with a canary, then decide whether it is metadata, an internal app, or a file handler.XSS huntingFind every reflection, name the context, then execute. XSS is a gadget until it reads a session, a token, or an admin UI.IDOR and broken authorizationTwo accounts is the test. Replay object IDs, hidden verbs, batch exports, and GraphQL node(id) as the other user. One account is guessing.JWT attacksThe payload is a claim list. The header is the attack. Verify what the server actually verifies: alg, kid, jku, and whether role or tenant claims are trusted unsigned.OAuth and OIDCAllowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin. The code in the URL is the prize.GraphQL huntingThe schema is the app. Introspection off just means you reconstruct it. node(id), aliases, batch, and hidden mutations skip the UI.Web cache poisoningIf a header or query changes the response but is not in the cache key, you poison everyone who shares that key. Two clients. One poisons. The other must receive it.CSRF huntingCookie-authenticated state change without a token the browser cannot set. SameSite=Lax is not the whole story. JSON plus text/plain is the modern shape.SQL injection huntingTreat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.XXE huntingA parser that loads a DTD from a URL you control is at least SSRF. Prove the fetch with OAST. Do not point it at metadata or local files first.SSTI huntingUser input that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with harmless arithmetic, then stop at the primitive.LFI to impactPath traversal that reads a file you can name is a primitive. It becomes RCE or secret theft when the include, log, or upload lands in an executable context.CORS exploitationACAO reflecting Origin plus ACAC true on a cookie-auth API is a read gadget against the victim session. ACAO: * without credentials is usually nothing.WebSocket huntingTreat the socket as an API with a worse auth story. Handshake, first message, then every subscribe. Cookie plus missing Origin is CSWSH.Race conditionsIf it should happen once, send it twice in one RTT. Coupons, invites, MFA, balances. Two sessions you own. HTTP/2 single-packet makes this cheap.HTTP request smugglingFront-end and origin disagree on Content-Length vs Transfer-Encoding. Prove with a harmless probe on a connection you own. Do not poison other users.SAML attacksSSO XML that is trusted more than the HTTP layer. Recipient, Audience, Destination, and wrapping are the gadgets. Pair with XXE on the same parser. Test tenant only.MFA / 2FA bypassMFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, backup codes, and the mobile app.File upload huntingSee which signal the server trusts: extension, declared type, or magic bytes. Then see how the file is served. Inert fixtures only.Agents, tools, and retrievalThe finding is an authority gap: a tool token wider than the tool, or another tenant's text in a context you are allowed to see. A prompt that only confuses the model is not the report.Open redirect chainsAn unvalidated next= is inventory, not a report, until it leaks an OAuth code, a session token, or feeds a server-side fetch.postMessage gadgetsMap every listener and every wildcard sender. Origin checks that use indexOf or startsWith, plus a DOM or auth sink, are the classic SPA gadget.Passkey and WebAuthnPasskeys are only as strong as the path that skips them. Inventory recovery, backup factors, and credential registration that issue a session without a WebAuthn assertion.Tenant boundariesA tenant id on an export, a job, or a file is a label until a second tenant can read the object. Test membership on the worker that builds the file, not only on the request that queued it.Web cache deceptionWeb cache deception is path confusion that stores a private response at a URL the cache thinks is static. It is not cache poisoning: poisoning is unkeyed input that changes what other users receive.Session and cookie scopeSession bugs are scope, lifetime, and which cookie jar the server trusts. A parent-domain cookie, a missing Partitioned attribute, or a refresh token that survives logout is inventory until it becomes someone else's session.Supply chain and CIOWASP Top 10:2025 puts software supply chain failures at A03, covering dependencies, CI, registries, and update channels. pull_request_target runs in the context of the base repository and is dangerous when it checks out pull request code.MCP and tool trustAn MCP finding is tool-trust: a token wider than the tool, or a credential shared across tenants. A prompt trick without that authority gap is not the report.RAG retrieval boundariesRAG cross-tenant exposure is an authorization bug on retrieved chunks, not a prompt-injection bug. If the index returns another tenant's text into a context you are allowed to see, the filter failed before the model spoke.Mobile app linksApp links are a host claim: the association file says which app may open which https paths. A claim that is too broad, or a fallback to an unverified custom scheme, becomes token theft when that path carries an auth callback.Parsers and archivesArchive and document parsers turn entry names and links into filesystem paths. An entry that resolves outside the extract root is the primitive, and impact starts when the service later reads or writes that path.Security misconfigurationOWASP Top 10:2025 ranks security misconfiguration at A02: defaults, exposed surfaces, and features left on. A check that fails open when a dependency errors is A10, mishandling of exceptional conditions, and SSRF now sits under broken access control rather than in that old slot.Webhook authenticityA webhook is an authenticated call from another system, and the signature is what makes it authenticated. If the signature is optional, missing, or ignored when verification throws, the body is the only authority for the event.Email identityEmail is an identity string that signup, the mailer, and the SSO claim may each parse differently. Compare those views with mailboxes you own, and treat a mismatch as identity confusion rather than a cosmetic alias.Business logicA logic bug is a workflow that accepts a state the product tried to forbid: a skipped step, a replayed step, or a price the client chose. Scanners do not model that rule. You do, from the flow in front of you.Subdomain takeoverA takeover candidate is a name the company still publishes that points at a service they no longer claim. The proof is the unclaimed fingerprint plus ownership of the parent name. Claiming the service is a program decision, not the first step.Prototype pollutionPrototype pollution is a property written onto a shared object. It is a lead until you can name the sink that property reaches, on an object you own. A polluted field with no sink is inventory.Mass assignmentMass assignment is a field the server binds and the UI never sends: role, tenant, price, or a verified flag. The test is one extra field on an object you own, and whether the stored record changes.Reset and magic linksA reset or magic link is a bearer token in mail. Record who receives it, whether a second browser can use it, and whether it still works after the first use. Use a mailbox you own.ClickjackingClickjacking is a framed page that still performs a state change. Read the framing policy first. The note is the missing policy plus the action a click would complete, on an account you own.Cloud object storageObject storage is its own boundary. Prove the bucket is theirs before you call a public object a finding. A marketing file is not one. Metadata is a later step, and only after a server-side fetch is already shown and the program allows it.Provisioning and invitesProvisioning is who is allowed to create a user, change a role, or accept an invite. Test SCIM, directory sync, and invite acceptance with two orgs you belong to. An invite token in a URL is a lead, not a takeover.Billing and creditsMoney movement is the price, credit, refund, or quantity the server stores. The client price is a claim. The finding is a ledger state the product should have rejected, on an object you own.