Results for “hunter”

Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.

• Mapping an organization's externally exposed assets
• Recording evidence sources and confidence levels
• Prioritizing exposures within a limited research budget

Assess enterprise sign-in environments that use Okta, from identifying tenants to reviewing authentication factors and connected applications. The skill provides security testing workflows, configuration checks, and guidance on validating findings within an authorized assessment.

• Identify Okta tenants used by corporate applications
• Review multi-factor authentication settings
• Check OIDC and SAML application configurations

Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.

• Discovering public subdomains, APIs, and cloud storage
• Investigating exposed API keys and other secrets
• Identifying SSO services and Microsoft 365 exposure

Track changes during authorized red-team testing by comparing response times, headers, and account lockouts. Preserve evidence before and after changes, investigate possible defensive actions or concurrent attacks, and turn observations into timestamped findings.

• Investigate why a confirmed vulnerability stops reproducing
• Record response changes that suggest defensive measures
• Examine newly appearing account lockouts

Review EVM and Solana meme coins for hidden minting, blocked sales, adjustable fees, and liquidity withdrawal risks. The skill guides source checks and on-chain verification to identify privileged controls that could enable a rug pull.

• Reviewing token risks before investing
• Checking Solana mint and freeze authorities
• Verifying liquidity pool lock claims

Assess Microsoft 365 and Entra ID authentication using tenant discovery, login error analysis, and browser-based verification. It provides attempt tracking and evidence templates to distinguish credential results from access-policy restrictions.

• Map tenants associated with corporate domains
• Interpret login errors and access-policy blocks
• Manage attempt limits during credential testing

Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.

• Assessing an iOS app in a bug bounty program
• Finding credentials and API endpoints inside an IPA
• Reviewing ATS settings and inspecting app traffic

Investigate XXE, an XML parsing flaw, in APIs and document uploads. The skill guides entry point discovery, external callback checks, and evidence collection to establish whether files or internal services are actually exposed.

• Check XML APIs for external entity processing
• Investigate SVG and Office document uploads
• Confirm blind XXE through external callbacks

Investigate cross-site scripting, where untrusted input executes as JavaScript in a web page. Check reflected, stored, and browser-side cases, distinguish escaped output from executable content, and validate reproducible behavior and user impact before reporting.

• Checking how search terms and URL parameters appear in pages
• Testing stored content in wikis and profile fields
• Reviewing JavaScript paths that insert input into pages

Assess WebSocket security in chat, notifications, and other live features. The skill covers connection checks, message permissions, tampering, and access to private channels, with validation steps to distinguish actual data exposure or state changes from misleading responses.

• Review WebSocket security in chat and notification features
• Check for cross-site access to another test account's data
• Test permissions for individual messages and private channels

Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.

• Review TLS certificates and encryption settings
• Assess DNS records for subdomain takeover
• Validate email spoofing evidence

Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.

• Finding DNS records that point to abandoned services
• Manually verifying automated takeover scan results
• Assessing effects on login flows and shared cookies

Investigate server-side template injection, where user input is interpreted as template code. The skill covers engine identification, testing email and PDF rendering, and checking whether an injection can lead to command execution on the server.

• Assessing email template rendering
• Testing PDF and report generators
• Reviewing authenticated CMS template editors

Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.

• Reviewing link previews and URL import features
• Assessing network access from PDF and screenshot generators
• Checking access to cloud metadata and internal APIs

Investigate SQL injection in search forms, filters, and APIs by choosing tests based on actual responses. The skill covers visible query results, response differences, and timing evidence, helping produce reproducible reports with concrete data impact.

• Inspect search and filter inputs for SQL injection
• Choose tests based on endpoint responses
• Review ORM query construction risks

Map a single-page application's backend API from its public JavaScript files, including routes loaded later. Compare unauthenticated responses with a protected endpoint to investigate missing authentication and access control using minimal evidence.

• Discovering backend API routes in public JavaScript
• Checking API authentication behind an SSO login
• Investigating routes in lazily loaded JavaScript files

Investigate exposed source maps, configuration files, Git history, and API specifications on websites. The skill guides source reconstruction and artifact inspection to identify leaked secrets, internal routes, and build details during the initial stages of security research.

• Checking source maps for exposed source code
• Inspecting public configuration files and Git history
• Mapping API routes from Swagger and OpenAPI specifications

Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.

• Assess anonymously accessible SharePoint endpoints
• Review legacy login paths and authentication controls
• Check conditions associated with ToolShell

Inventory old and undocumented API versions, then compare their authentication, request limits, input validation, and exposed fields with current versions. Uses API specifications and archived records to identify overlooked endpoints with weaker security controls.

• Finding API versions left reachable after deprecation
• Comparing old and current OpenAPI or Swagger specifications
• Checking security differences between API versions

Assess session management weaknesses, including sessions that survive logout or password changes, fixed session IDs, and refresh-token reuse. The skill uses two real sessions, response-body comparisons, and control checks to distinguish continued account access from misleading successful responses.

• Check whether old sessions survive logout
• Verify session invalidation after a password change
• Test refresh-token rotation and reuse detection

Review SAML single sign-on, where services exchange signed identity information, for signature and identity handling flaws. The skill guides testing and validation to determine whether altered assertions can change accounts, roles, or access decisions.

• Review SAML single sign-on flows
• Test signature validation and XML interpretation
• Check whether identity or role changes affect access

Review multi-factor authentication flows for skipped checks, reused one-time codes, weak backup paths, and verification races. It focuses on proving access to protected resources rather than relying on interface behavior or response codes alone.

• Check access before completing multi-factor authentication
• Test one-time code reuse and validation behavior
• Review backup codes and trusted-device cookies

Investigate HTTP request smuggling, where a proxy and server disagree on request boundaries. The skill guides checks for different server setups, HTTP/2 conversion issues, and evidence that the mismatch affects another client's requests.

• Plan checks for CDN and origin server setups
• Investigate HTTP/2 to HTTP/1.1 conversion issues
• Review evidence of cache poisoning or authentication bypass

Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.

• Review checkout prices and currency handling
• Check coupons and credits for repeated redemption
• Inspect email and phone verification flows