skills.rest
Carlos-Reyes-UTP
Carlos-Reyes-UTPCOMMUNITY
Explore all skills by this author →
GitHub

hunt-misc

Probe role boundaries, auth flows, and token scope enforcement for misc vulnerabilities.

2|Updated Apr 11, 2025
Search Tags:#multi-tenant#access control#SSRF#vulnerability hunting#auth bypass#token scope#SSO SAML
One-click install
npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-misc-carlos-reyes-utp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-misc
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/hunt-misc
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-misc-carlos-reyes-utp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you quickly uncover high-impact “misc” vulnerabilities such as broken access control, auth/session logic flaws, information disclosure, and risky misconfigurations that often lead to real business compromise.

Core Features & Use Cases

  • Role and permission boundary probing: Tests how different user roles behave across API and UI surfaces to spot bypasses and desyncs.
  • Invitation, token, and auth-flow testing: Evaluates invitation acceptance, post-removal access, SSO/SAML handling, password reset, and token scope enforcement.
  • Config and integration abuse detection: Checks whether admin-set integration fields (e.g., webhooks/Sentry) can be abused for SSRF or credential exfiltration.
  • Multi-tenant and internal API access checks: Attempts cross-tenant resource access and hunts for internal/undocumented endpoints.

Quick Start

Run the hunt-misc skill against your target and follow its steps to map role boundaries, test invitations and token scope enforcement, and validate any claimed bypass with body-diff evidence.

Frequently Asked Questions about hunt-misc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find broken access control and multi-tenant authorization bypasses?▼

To find broken access control and multi-tenant authorization bypasses, probe role boundaries across API and UI surfaces to spot permission desyncs and attempt cross-tenant resource access using response-body differentials.

What is the best way to test SSO SAML callback and token scope enforcement?▼

Testing SSO SAML callback and token scope enforcement involves evaluating invitation acceptance, post-removal access, and password reset flows while verifying any claimed bypass using response-body differentials rather than status-code-only signals.

Can I detect SSRF vulnerabilities in admin-managed integrations like webhooks and Sentry?▼

You can detect SSRF vulnerabilities in admin-managed integrations like webhooks and Sentry by checking whether admin-set integration fields can be abused for server-side request forgery or credential exfiltration.

Why does hunting for auth bypass require response-body differentials instead of status codes?▼

Hunting for auth bypass requires response-body differentials because status-code-only signals are unreliable; verifying bypass claims demands strict reproducibility and unique marker discipline for reflections to confirm true access control failures.

Does vulnerability hunting for misc web bugs work on internal and undocumented API endpoints?▼

Vulnerability hunting for misc web bugs works on internal and undocumented API endpoints by systematically probing risky configuration surfaces and evaluating session flows to uncover information disclosure and misconfigurations.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

access-idor

Detect IDOR vulnerabilities across REST, GraphQL, gRPC, and WebSocket APIs.

Community
Advanced
hpsgdhpsgd

write-bug-report

Generate structured bug reports from raw descriptions with mandatory sections.

Official
Advanced
EntroVyxEntroVyx
3

hunt-saml

Analyze SAMLResponse XML signatures to identify authentication bypass vulnerabilities.

Community
Advanced
bpnrockstarbpnrockstar

hunt-misc

Detect access-control and logic bugs in web applications.

Community
Advanced