/hunt

description: Active vulnerability hunt against a target by invoking tools/hunt.py (which calls vuln_scanner.sh against recon/<target>/). Auto-runs recon first if no recon dir exists. Usage: /hunt target.com

/hunt

Active vulnerability hunting on a target. **Always invoke the production script directly** — do not re-interpret the methodology below as instructions to execute step-by-step. The methodology is reference material; the script is the entry point.

Run This (the only required step)

# If recon/<target>/ already exists, scan only:
python3 tools/hunt.py --target target.com --scan-only

# If no recon yet, run the full pipeline (recon then scan):
python3 tools/hunt.py --target target.com

# Quick mode (fewer checks, faster):
python3 tools/hunt.py --target target.com --quick

That's it. The script: 1. Reads `recon/<target>/` (subdomains, live hosts, URLs, gf-classified candidates). 2. Runs `tools/vuln_scanner.sh recon/<target>/` — XSS (dalfox), SQLi (linear-scaling verifier), SSTI math-canary probes, race conditions, RCE PoC, MFA/SAML checks. 3. Writes results to `findings/<target>/` with a `summary.txt`.

Output you should see (not a loop):

██████  ██████  ██   ██ ██   ██ ███   █ ███████
██   ██ ██   ██ ██   ██ ██   ██ ████  █   ███
██████  ██████  ███████ ██   ██ ██ ██ █   ███
██████  ██████  ███████ ██   ██ ██  ███   ███
██   ██ ██   ██ ██   ██ ██   ██ ██   ██   ███
██████  ██████  ██   ██ ███████ ██   ██   ███

+ Recon. Hunt. Validate. Report. +

┌──────────────────────────────────────────────────────┐
│ Target  target.com                                   │
│ Mode    full                                         │
│ Output  recon/target.com/                            │
│ Auth    session loaded                               │
└──────────────────────────────────────────────────────┘

 ● local   Ready   type /hunt to begin

bbhunt v4.3

[*] Running vulnerability scanner on target.com...
[+] XSS pipeline: N candidates
[+] SQLi verifier: ...
[+] SSTI canary: ...
[✓] HUNT COMPLETE — Summary Dashboard

Pass `--no-banner` for piped / CI output. Pipe through `python3 tools/dashboard.py --tail --kind scan --target target.com` for a live phase-by-phase progress dashboard instead of streaming logs.

Usage

/hunt target.com                       (full hunt — recon then scan)
/hunt target.com --quick               (fewer checks; faster)
/hunt target.com --vuln-class idor     (manual deep-dive — see methodology below)
/hunt target.com --source-code ./repo  (static + live)
/hunt target.com --chrome              (browser-based — needs Chrome MCP)
/hunt targets.txt                      (multi-target — one domain per line)

`--vuln-class`, `--source-code`, `--chrome`, and multi-target are manual-mode flags that switch you out of the scripted pipeline and into the methodology below. They are not arguments to `tools/hunt.py`.

Troubleshooting: "/hunt is looping / not actually hunting"

Symptom: `/recon` finishes, `recon/<target>/` is populated, but `/hunt target.com` just re-reads files, re-plans, and never invokes any scanner. Common on free / weaker models.

Cause: The model is reading the methodology prose below and trying to re-implement it step-by-step instead of running the production script.

Fix (run this directly in a shell — no prompt needed):

python3 tools/hunt.py --target target.com --scan-only

If `tools/vuln_scanner.sh` reports missing tools, install them first:

bash tools/install_tools.sh

If you're on a free OpenRouter model and the agent keeps narrating instead of executing, add this to your prompt: > Run `python3 tools/hunt.py --target target.com --scan-only` and report the output. Do not re-implement the steps. Do not narrate the methodology. Run the command.

Session Isolation

**One session per target.** Claude accumulates context — testing two targets in one session causes cross-contamination where payloads, assumptions, and findings from target A affect target B.

claude  →  /hunt targetA.com   # Terminal 1
claude  →  /hunt targetB.com   # Terminal 2 (separate process)

Multi-Target

Create a `targets.txt` with one domain per line:

api.target.com
app.target.com
admin.target.com

Then loop the script:

while read -r t; do
  python3 tools/hunt.py --target "$t" --quick
done < targets.txt

Source Code Mode (--source-code)

`tools/hunt.py` does not consume source code directly. For `--source-code`, treat it as a manual workflow:

1. Grep for hardcoded secrets and API keys. 2. Map routes → controllers; flag endpoints missing auth decorators. 3. Grep for dangerous sinks: `eval`, `exec`, `unserialize`, raw SQL concat. 4. Cross-reference findings against the live endpoints in `recon/<target>/live/urls.txt`.

Chrome MCP Mode (--chrome)

Requires Chrome MCP configured in Claude Code settings. Enables flows the headless scanner can't reach:

• OAuth / SSO / 2FA flows that require JS
• DOM-based XSS (invisible to curl probes)
• WebSocket endpoints
• SPA route discovery (React/Vue/Angular)
• Real file upload and form submission

This is manual; not driven by `tools/hunt.py`.

---

Reference Methodology (manual deep-dive — only when `--vuln-class` or `--source-code` is set)

Everything below is reference material for the manual flow. **Do not execute these as steps when running plain `/hunt target.com`** — the production script above already covers them. Use this section only when working a specific endpoint, bug class, or chain by hand.

Phase 1: Read Before Touching (15 min)

Read Program Scope

1. Go to program page (HackerOne/Bugcrowd/Intigriti) 2. Note ALL in-scope domains — only test these 3. Note ALL out-of-scope domains — never test these 4. Note impact types accepted (some exclude "low" severity) 5. Check average bounty — signals program generosity

Read Disclosed Reports (Intel)

HackerOne Hacktivity for this program:

• `https://hackerone.com/TARGET_NAME/hackt