skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

deep-hunt

Generates manual attack plans for business workflows in authorized bug bounty and pentest engagements.

7|4|Updated Jun 22, 2026
Search Tags:#manual testing#web security#business logic#pentest#bug bounty#burp suite#attack methodology
One-click install
npx skills add https://github.com/dbx0/skills --skill deep-hunt-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deep-hunt
Source: https://github.com/dbx0/skills/tree/main/skills/methodology/workflows/deep-hunt
Command: npx skills add https://github.com/dbx0/skills --skill deep-hunt-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shallow endpoint scanning misses the high-impact business logic flaws that live inside workflows like billing, invites, and account recovery. This Skill turns a single workflow name into a deep, structured manual testing plan covering actors, objects, states, shapes, timing, and side effects. ## Core Features & Use Cases - Workflow Playbooks: Pre-built attack priorities and first tests for 15 workflows including recovery, invite, billing, graphql, import, export, roles, ai, race, oauth, saml, upload, and webhook. - Six-Boundary Test Loop: Systematically covers actor, object, state, shape, time, and side-effect boundaries so no class of business logic flaw is skipped. - Actionable Output Contract: Produces an attack matrix, first 10 manual tests, chain candidates, evidence list, and stop conditions ready to run in Burp or Caido. - Use Case: During a bug bounty engagement, invoke /deep-hunt billing to get targeted tests like refund-without-entitlement-revocation, coupon race conditions, and stale idempotency key reuse instead of generic endpoint fuzzing. ## Quick Start Ask the agent to run /deep-hunt billing against your authorized target and execute the returned first ten manual tests in Burp Suite.

Frequently Asked Questions about deep-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test business logic flaws in a bug bounty target?▼

Pick one business workflow and test it across six boundaries: actor, object, state, shape, time, and side effects. This Skill generates the attack matrix and first ten manual tests for workflows like billing, recovery, and invites so you can run them directly in Burp or Caido.

What workflows does deep-hunt support?▼

It supports recovery, invite, billing, graphql, import, export, roles, support, ai, race, oauth, saml, upload, webhook, and a generic fallback. Unrecognized workflow names are mapped to the closest supported playbook with the mapping stated.

How do I find race condition vulnerabilities in web apps?▼

Target check-then-act gaps, duplicate value issuance, and stale worker authorization by sending parallel requests from two sessions. Test pairs like approve/delete, pay/cancel, and refund/consume, and replay webhooks and idempotency keys while observing delayed workers.

Can I use this for unauthorized targets or scanning?▼

No, the Skill is explicitly scoped to authorized bug bounty and pentest work and produces manual test plans, not automated exploitation. It is a methodology for deep manual testing, not a scanner, so it requires an operator running Burp or Caido.

When is a workflow considered fully tested?▼

A workflow is not done until all six boundaries have at least one concrete test result. The completion standard also requires identifying the strongest primitive, the best next pivot, missing proof for reportability, and whether to invoke /attack-chain.

Related Skills

Explore More Software Engineering Skills→
matlee0409matlee0409

web-pentest

Map web application attack surfaces and plan authorized penetration tests.

Community
Advanced
rocklambrosrocklambros
2

writing-pentest-finding

Generate client-deliverable penetration-test findings with CVSS v3.1 vectors and remediation.

Community
Advanced
defconxtdefconxt

Red Team — Web Application

Identify and exploit web application vulnerabilities with commands for SQL injection and API flaws.

Community
Advanced
AgentSecOpsAgentSecOps
183

dast-ffuf

Fuzz web applications to uncover hidden directories and endpoints with ffuf.

Official
Advanced