skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-misc

Identify and exploit miscellaneous vulnerabilities in SaaS platforms and authentication flows.

3|1|Updated Jul 2, 2026
Search Tags:#privilege escalation#pentesting#bug bounty#recon#auth bypass#offsec
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-misc-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-misc
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-misc
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-misc-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying complex, non-standard vulnerabilities like privilege escalation, session logic flaws, and configuration errors that automated scanners consistently miss.

Core Features & Use Cases

  • Methodological Hunting: Provides a structured, 12-step approach to testing role boundaries, invitation flows, and internal API surfaces.
  • Chain Composition: Teaches how to combine individual primitives into high-impact exploit chains like SAML XSW or session-persistence bypasses.
  • Real-World Application: Use this when auditing SaaS platforms, multi-tenant systems, or enterprise auth flows to find bugs that lead to account takeover or cross-tenant data exposure.

Quick Start

Use the hunt-misc skill to initiate a deep hunt for privilege escalation and session logic vulnerabilities on the target domain.

Frequently Asked Questions about hunt-misc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find privilege escalation and access control bugs that automated scanners miss?▼

Manual privilege escalation hunting systematically tests role boundaries, invitation flows, and internal API endpoints to uncover access control failures that automated scanners consistently miss.

What is the best way to hunt for session logic bugs in enterprise authentication flows?▼

The best way to hunt for session logic bugs in enterprise auth flows is applying a structured methodology to test internal endpoints and construct impact-driven exploit chains like session-persistence bypasses.

How do I test for cross-tenant data exposure in multi-tenant SaaS platforms?▼

Testing for cross-tenant data exposure in multi-tenant SaaS platforms requires systematically probing role boundaries and internal API surfaces to identify configuration errors and authorization bypasses.

Can I use this methodology to chain individual primitives into high-impact exploit chains?▼

Yes, chain composition combines individual vulnerability primitives into high-impact exploit chains, such as SAML XSW or session-persistence bypasses, during manual security assessments.

Does manual misc vulnerability hunting require specific dependencies or environments to start?▼

Manual misc vulnerability hunting requires no specific dependencies or environments, relying entirely on a structured 12-step approach to systematically test target domains for configuration errors and logic flaws.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

Community
Intermediate
EntroVyxEntroVyx
3

hunt-ato

Identify and validate account takeover vulnerabilities in OAuth, JWT, and password reset flows.

Community
Advanced
chatbotkitchatbotkit
13

hunt-saml

Test SAML endpoints for XSW, NameID manipulation, signature stripping, and XXE vulnerabilities.

Official
Advanced
huangwb8huangwb8
47

security-specialist

Identify and mitigate security risks through threat modeling and compliance checks.

Community
Advanced