hunt-misc

Map every role level from owner to guest, then test whether lower roles can call endpoints meant for higher roles via direct API requests. The methodology requires a response body differential, not just a status code change, to claim a privilege bypass.

Capture a valid SAMLResponse, then try stripping the Signature element, injecting a sibling unsigned Assertion with a victim NameID, or exploiting parser differentials between the signature checker and business logic. These techniques target XML canonicalization and namespace confusion flaws.

Most rejections come from status-code-only claims without body differences, server-policy blocklists mistaken for file-existence oracles, or missing concrete impact. The Gate 0 validation requires a concrete attacker action, a real victim asset loss, and 10-minute reproducibility.

Yes, when removal only updates the membership table without invalidating the session store or revoking issued tokens. Test by capturing a session before removal, then replaying API calls afterward to check for continued access to customer data.

Some platforms validate PAT or OAuth scopes only when the token is created, while individual API handlers trust middleware and skip re-checking. A read-only token can then perform write actions on endpoints missing scope enforcement.

Avoid reporting when you cannot demonstrate concrete impact such as cross-tenant data reads or admin actions, when the behavior is a server-side blocklist rather than a real oracle, or when reproduction requires unrealistic preconditions or luck-based race conditions.