bug-bounty

Begin with the recon pipeline: enumerate subdomains with subfinder and assetfinder, probe live hosts with httpx, collect URLs via katana and waybackurls, then run nuclei for known vulnerabilities. Confirm the engagement scope and crown jewels before hunting specific vulnerability classes.

Create two accounts (attacker and victim), capture all object IDs in requests, then replay the attacker's requests with the victim's session. Test all ten variants including body parameters, GraphQL node queries, batch endpoints, method swapping, and version rollback.

The core toolkit uses Go binaries: subfinder for subdomain enumeration, httpx for host probing, dnsx for resolution, nuclei for template scanning, katana for crawling, and ffuf for fuzzing. Optional tools like sqlmap, trufflehog, and semgrep install on demand.

Most rejections come from theoretical bugs without demonstrated impact, status-code-only bypass claims without body diffs, and single-sample timing outliers. The 7-question gate and body-diff rule filter these before writing any report.

Yes, it covers AI/LLM testing mapped to the ASI01-ASI10 categories, including chatbot-based XSS chains and IDOR through LLM data access. It treats AI features as additional attack surface within the standard hunting phases.

Apply the 5-minute rule for unresponsive targets (all 401/403/404) and the one-hour rule for stalled progress. Time-box rabbit holes to 15 minutes and rotate vulnerability classes every 20 minutes when testing yields nothing.