---
name: Hunting Methodology
slug: hunting-methodology
category: Quality
description: Hunting Methodology guides a non-linear bug bounty workflow from recon and surface mapping through payload testing, validation, chaining, and reporting. Use it to prioritize targets, cover variants, and avoid repeating exhausted paths.
github: "https://github.com/H-mmer/pentest-agents/tree/main/skills/hunting-methodology"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunting-methodology ~/.claude/skills/hunting-methodology"
installs_to: ~/.claude/skills/hunting-methodology
source_path: skills/hunting-methodology/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:31.616Z
last_synced: 2026-08-22T05:22:31.616Z
canonical_url: "https://dirskills.com/skills/hunting-methodology"
---

# Hunting Methodology

Hunting Methodology guides a non-linear bug bounty workflow from recon and surface mapping through payload testing, validation, chaining, and reporting. Use it to prioritize targets, cover variants, and avoid repeating exhausted paths.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunting-methodology ~/.claude/skills/hunting-methodology
```

## README

# Hunting Methodology

## The 5-Phase Non-Linear Workflow

### Phase 1: Understand the Target (before touching anything)
1. Read program scope, policy, safe harbor
2. Read 5+ disclosed reports in hacktivity
3. Map crown jewels: what would hurt the company most?
4. Understand the business domain — what features handle money, PII, auth?

### Phase 2: Map the Surface
1. Subdomain enumeration → live hosts → tech stack detection
2. JS bundle analysis → API endpoints, secrets, internal URLs
3. Run `/surface` for P1/P2/Kill ranking

### Phase 3: Hunt (the actual testing)
1. Pick P1 target from surface ranking
2. Select vuln class based on tech stack:
   - Rails/Django/Laravel → IDOR, mass assignment
   - Express/Node → prototype pollution, path traversal
   - Spring Boot → Actuator, SSTI
   - Next.js → SSRF via Server Actions
   - GraphQL → introspection, IDOR via node(), mutation auth bypass
3. Test with concrete payloads (see /hunt)
4. Apply the Sibling Rule on every endpoint
5. 20-minute rotation if no progress
6. Build a **depth matrix** before declaring a class exhausted:
   - Dimensions: `entrypoint × method × content-type × encoding × bypass`
   - Minimum 30 combinations on P1 surface (seed with `uv run python3 $CLAUDE_PROJECT_DIR/tools/intel_engine.py matrix <class>`)
   - Do not stop at the first blocked payload — mutate and continue
7. Run **cross-context variants** for every promising input:
   - URL / query, JSON, form-urlencoded, multipart, GraphQL variables
   - Header / cookie mirrors, reflected values, stored values, async jobs / webhooks
8. Execute **encoding ladders** systematically:
   - raw → URL → double-URL → unicode escape → mixed-case / separator insertion
   - Keep the semantic payload constant through each ladder step
   - Then **stack encodings** in a single payload: `html-entity+URL`
     (`%26lt%3Bscript%26gt%3B`), `URL+html-entity`, `unicode-escape+URL`,
     `base64+URL`. WAFs typically decode once; targets decode twice, so a
     payload that looks benign after a single decode still executes at the
     sink.
9. Execute **auth-state permutations**:
   - unauthenticated, low-priv user A, low-priv user B, high-priv, expired token, stale session, cross-tenant
   - Compare response deltas (status, length, timing), not only status codes
10. Treat every bypass as a **family**, not a one-off:
    - For WAF / filter blocks, try separator insertion, case toggling, alternate delimiters, parser differentials, and protocol / host normalization tricks
11. **Log negative evidence** (what failed and why) via `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> recon "coverage-<class>" "<details>"` so autopilot resume avoids repeating exhausted paths.

### Phase 4: Validate + Chain
1. Run 7-Question Gate on any signal
2. If PASS → check A→B chain table
3. If CHAIN REQUIRED → build the chain or drop it
4. If KILL → move on immediately

### Phase 5: Report + Submit
1. Quality check (score ≥ 7)
2. Dupcheck against hacktivity
3. Submit with PoC + evidence + CVSS 4.0

## Wide vs Deep Route Selection

**Wide route** (recon-heavy): New target, unknown surface, no prior data.
- Run `/pipeline` for broad coverage first
- Then `/surface` to prioritize

**Deep route** (hunt-heavy): Known target, mapped surface, returning hunter.
- Run `/resume` to see what's untested
- Pick the highest-ROI untested endpoint
- Go deep on one vuln class

## Developer Psychology

Developers make CLASS mistakes, not random ones:
- If they forgot auth on endpoint A, they probably forgot on B and C
- If they use sequential integer IDs anywhere, they use them everywhere
- If input validation is weak in one form, check ALL forms
- New features (< 30 days) have the weakest security
- Acquired companies (different code, different team) = fresh attack surface

## Time Management

| Rule | Action |
|---|---|
| 5-minute rule | No interesting signals after 5 min → skip target |
| 20-minute rotation | No progress in 20 min → rotate vuln class or endpoint |
| 1-hour rule | Stuck on one target for 1 hour → switch programs entirely |
| A→B time box | 20 min per B candidate, max 3 candidates |
| Exhaustion rule | A class is "exhausted" only after the depth matrix baseline + sibling coverage (see Phase 3 steps 6-11) |

## ROI Ranking by Bug Class

| Bug Class | Competition | Avg Payout | Verdict |
|---|---|---|---|
| IDOR | Medium | High | Best ROI — always test first |
| Auth bypass | Medium | High | Second priority |
| Business logic | Low | High | Unique to each target |
| Race conditions | Low | Medium-High | Under-tested |
| OAuth/OIDC chains | Low | High | Complex but high payoff |
| SSRF → cloud | Medium | Very High | If you find DNS callback |
| Cache poisoning | Low | High | Rare skill |
| XSS | Very High | Medium | Skip unless you have a chain |
| Open redirect | Very High | Low | Only with OAuth chain |
| Missing headers | Infinite | $0 | Never submit |