Hunt briefs
One page per vulnerability class. The same composition hunt_brief returns over MCP, written for humans and crawlers.
Hunt briefs
SSRF huntingServer-side request forgery is a fetch you do not control. Prove the server made the request with a canary, then decide whether it is metadata, an internal app, or a file handler.XSS huntingFind every reflection, name the context, then execute. XSS is a gadget until it reads a session, a token, or an admin UI.IDOR and broken authorizationTwo accounts is the test. Replay object IDs, hidden verbs, batch exports, and GraphQL node(id) as the other user. One account is guessing.JWT attacksThe payload is a claim list. The header is the attack. Verify what the server actually verifies: alg, kid, jku, and whether role or tenant claims are trusted unsigned.OAuth and OIDCAllowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin. The code in the URL is the prize.GraphQL huntingThe schema is the app. Introspection off just means you reconstruct it. node(id), aliases, batch, and hidden mutations skip the UI.Web cache poisoningIf a header or query changes the response but is not in the cache key, you poison everyone who shares that key. Two clients. One poisons. The other must receive it.CSRF huntingCookie-authenticated state change without a token the browser cannot set. SameSite=Lax is not the whole story. JSON plus text/plain is the modern shape.SQL injection huntingTreat SQLi as a query-shape bug, not a dump script. Boolean and error on an owned row, then OAST if it is blind. Stop before information_schema of other tenants.XXE huntingA parser that loads a DTD from a URL you control is at least SSRF. Prove the fetch with OAST. Do not point it at metadata or local files first.SSTI huntingUser input that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with harmless arithmetic, then stop at the primitive.LFI to impactPath traversal that reads a file you can name is a primitive. It becomes RCE or secret theft when the include, log, or upload lands in an executable context.CORS exploitationACAO reflecting Origin plus ACAC true on a cookie-auth API is a read gadget against the victim session. ACAO: * without credentials is usually nothing.WebSocket huntingTreat the socket as an API with a worse auth story. Handshake, first message, then every subscribe. Cookie plus missing Origin is CSWSH.Race conditionsIf it should happen once, send it twice in one RTT. Coupons, invites, MFA, balances. Two sessions you own. HTTP/2 single-packet makes this cheap.HTTP request smugglingFront-end and origin disagree on Content-Length vs Transfer-Encoding. Prove with a harmless probe on a connection you own. Do not poison other users.SAML attacksSSO XML that is trusted more than the HTTP layer. Recipient, Audience, Destination, and wrapping are the gadgets. Pair with XXE on the same parser. Test tenant only.MFA / 2FA bypassMFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, backup codes, and the mobile app.File upload huntingSee which signal the server trusts: extension, declared type, or magic bytes. Then see how the file is served. Inert fixtures only.LLM and prompt injectionThe model is not the product. The tools it can call are. Indirect injection in retrieved docs plus a canary tool-call is the hunt.Open redirect chainsAn unvalidated next= is inventory, not a report, until it leaks an OAuth code, a session token, or feeds a server-side fetch.postMessage gadgetsMap every listener and every wildcard sender. Origin checks that use indexOf or startsWith, plus a DOM or auth sink, are the classic SPA gadget.