Web Hunting

SQLi Hunter

SQL and NoSQL injection across ORM raw fragments, GraphQL resolvers, OIDC-proxy backends, and SOQL. Built from 12 disclosed reports including CVE-2021-22911 and CVE-2024-53900.

XSS Hunter

Cross-site scripting across DOM, reflected, stored, and mutation-based patterns. Built from 174 public bug bounty reports.

SSRF Hunter

Server-side request forgery including cloud metadata endpoint exfiltration, internal network pivoting, and webhook abuse patterns.

RCE Hunter

Remote code execution via deserialization, template injection, command injection, and unsafe eval patterns derived from real disclosures.

IDOR Hunter

Insecure direct object references including BOLA in REST/GraphQL, ID enumeration, and horizontal privilege escalation. Built from 26 reports.

CSRF Hunter

Cross-site request forgery including SameSite bypass, token fixation, and JSON-based CSRF in single-page apps.

SSTI Hunter

Server-side template injection across Jinja2, Twig, Freemarker, Velocity, and Pebble with RCE escalation paths.

XXE Hunter

XML external entity injection including blind OOB exfiltration, file read via error messages, and XXE-to-SSRF chains.

File Upload Hunter

Unrestricted file upload bypasses — MIME type spoofing, extension trickery, polyglots, path traversal via filename.

Cache Poison Hunter

Web cache poisoning via unkeyed headers, parameter cloaking, fat GET exploitation, and cache-key normalization bugs.

HTTP Smuggling Hunter

HTTP request smuggling — CL.TE, TE.CL, TE.TE variants with bypass and response queue poisoning escalation.

Race Condition Hunter

Race condition exploitation on payment flows, coupon redemption, rate-limit bypass, and parallel request amplification.

Business Logic Hunter

Business logic flaws — price manipulation, workflow bypass, state machine abuse, and trust boundary violations.

GraphQL Hunter

GraphQL introspection abuse, batching attacks, IDOR through aliases, nested query DoS, and authorization bypass.

LLM/AI Hunter

LLM-integrated application vulnerabilities — prompt injection, insecure tool use, training data extraction, and model denial of service.

Dispatch Hunter

Smart target triage and hunting path dispatch — routes to the right skill based on reconnaissance signals.

Misc Vuln Hunter

Catch-all for open redirect, CRLF injection, clickjacking, host header injection, and other frequently disclosed low-to-medium classes.

ASP.NET Hunter

ASP.NET-specific attack surface — ViewState deserialization, __EVENTTARGET manipulation, IIS short filename disclosure, and Razor injection.

Bug Bounty Planner

Structured methodology for scoping, prioritizing, and executing a bug bounty engagement from program selection to final submission.

BB Methodology

End-to-end bug bounty methodology — recon, attack surface mapping, vulnerability testing order, and triage workflow.

Local Toolkit

Local toolchain setup for bug bounty — ffuf, nuclei, sqlmap, burp configurations, and wordlist management.

Security Arsenal

Curated command arsenal for web security testing — one-liner reference for recon, fuzzing, exploitation, and post-exploitation.