skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

hunt-misc

Detect access-control and logic bugs in web applications.

Updated Jul 1, 2026
Search Tags:#access control#web security#misconfiguration#bug hunting#session persistence
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-misc-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-misc
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-misc
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-misc-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill unit aids in identifying and exploiting complex security issues like post-removal access persistence, invitation bypasses, and misconfigurations in web applications.

Core Features & Use Cases

  • Post-Removal Access Hunting: Detects access control bugs where user sessions are not properly invalidated upon removal.
  • Invitation Bypass Hunting: Finds vulnerabilities in invitation or SSO flows that can be exploited without verification.
  • Misconfiguration Detection: Identifies common security misconfigurations, such as CRLF injection and token exfiltration vectors.
  • Use Case: For example, it can identify cases where a user's session token persists even after being removed from an organization, potentially leading to unauthorized access.

Quick Start

Activate the hunt-misc skill within your Claude Code session to start hunting for access control and logic bugs within your target application.

Frequently Asked Questions about hunt-misc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for post-removal session persistence in web applications?▼

This Skill detects post-removal access persistence by identifying access-control bugs where user sessions and tokens are not properly invalidated upon removal from an organization, potentially leading to unauthorized access.

What security vulnerabilities exist in SAML and SSO invitation flows?▼

SSO and SAML invitation flows can contain bypass vulnerabilities allowing exploitation without verification. This Skill identifies these logic bugs alongside misconfigurations like CRLF injection and token exfiltration vectors.

How do I detect access control misconfigurations and token exfiltration vectors?▼

Detect access control misconfigurations by utilizing a suite of tools and methodologies to identify common security issues like CRLF injection, token exfiltration vectors, and SSRF vulnerabilities in web applications.

Can I use this for bug hunting SSO flows and invitation bypasses?▼

Yes, this Skill is designed for bug hunting SSO flows and invitation bypasses, specifically finding vulnerabilities in invitation or SSO flows that can be exploited without verification.

What is post-removal access persistence and why is it a security risk?▼

Post-removal access persistence is an access-control bug where user sessions remain active after account removal. It is a security risk because lingering tokens allow unauthorized access to organization resources.

Do I need any dependencies to start hunting for session persistence bugs?▼

No dependencies are required. You activate the Skill within your Claude Code session to begin identifying access-control and logic bugs in your target application.

Related Skills

Explore More Software Engineering Skills→
DicklesworthstoneDicklesworthstone
70

claude-chrome

Automate authenticated browser tasks in a real Chrome session via Claude Code CLI and MCP.

Community
Advanced
Prohao42Prohao42
120

dangling-markup-injection

Exfiltrate CSRF tokens and session data via dangling HTML markup.

Community
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
harperaaharperaa
15

authentication-authorization-vulnerabilities-ai-code

Identify and remediate authentication and authorization vulnerabilities in AI-generated code.

Community
Intermediate