/bb-methodology

name: bb-methodology
description: Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

Bug Bounty Methodology: Workflow + Mindset

Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest.

---

PART 1: MINDSET (How to Think)

Core Principle

Hunting is not "find a bug" -- it is "prove an attack scenario." Think like an attacker with a specific goal, not a scanner looking for patterns.

Daily Discipline: Define, Select, Execute

Before touching any tool:

1. **Define**: "Today I target [feature/domain] to achieve [CIA impact]" 2. **Select**: Choose 1-2 vuln classes (IDOR, Race Condition, etc.) 3. **Execute**: Focus ONLY on selected techniques. No wandering.

5 Ultimate Goals (Pick One Per Session)

1. **Confidentiality** -- steal data the attacker shouldn't see 2. **Integrity** -- modify data the attacker shouldn't change 3. **Availability** -- disrupt service (app-level DoS only) 4. **Account Takeover** -- control another user's account 5. **RCE** -- execute commands on the server

4 Thinking Domains

1. Critical Thinking (deep analysis)

**Question trust boundaries:**

• Frontend control disabled? Send request directly via proxy
• `user_role=user` cookie? Change to `admin`
• `price=1000` in POST? Change to `1`
• `<script>` blocked? Try `<img onerror=...>`

**Reverse-engineer developer psychology:**

• Feature A has auth checks -> Similar feature B (newly added) probably doesn't
• Complex flows (coupon + points + refund) -> Edge cases have bugs
• `/api/v2/user` exists -> Does `/api/v1/user` still work with weaker auth?

**What-If experiments:**

• Skip checkout -> hit `/checkout/success` directly
• Skip 2FA -> navigate to `/dashboard`
• Send coupon request 10x simultaneously -> Race condition?
• Replace `guid=f8a2...` with `id=100` on sibling endpoint -> IDOR?

2. Multi-Perspective (multiple angles)

| Perspective | What to check | |------------|---------------| | Horizontal (same role) | User A's token + User B's ID -> IDOR | | Vertical (different role) | Regular user -> `/admin/deleteUser` | | Data flow (proxy view) | Hidden params in JSON: `debug=false`, `discount_rate` | | Time/State | Race conditions, post-delete session reuse | | Client environment | Mobile UA -> legacy API with weaker auth | | Business impact | "What's the $ damage if this breaks?" |

3. Tactical Thinking (pattern detection)

• **Naming anomaly**: `userId` everywhere but suddenly `user_id` -> different dev, weaker security
• **Error diff**: Same 403 but different JSON structure -> different backend systems
• **200 but wrong body length/content**: `200 OK` with tiny response or "just a moment" text → WAF soft block, not a real response. Run `bypass_403.sh` to confirm and get baseline diff.
• **Environment diff**: Prod vs Dev/Staging -> debug headers, CSP disabled
• **Version diff**: JS file before/after update -> new endpoints, removed params
• **Supply chain**: Check framework/library versions for known CVEs
• **Third-party integration**: Stripe/Auth0/Intercom -> webhook signature missing?

4. Strategic Thinking (big picture)

• **Asymmetry**: Defender must patch ALL holes. You only need ONE.
• **Intuition engineering**: Log why something "feels wrong." Verify later. Update mental DB.
• **Unknown management**: Can't understand something? Add to "investigate later" list. Just-in-Time Learning.

5. AI-Assisted Thinking (model as a second analyst)

Use AI to expand hypotheses, not to declare verdicts. The model is a fast adversarial planner; the browser, proxy, and live requests are the proof layer.

• **Decompose the feature**: ask for actors, assets, entry points, state transitions, and trust boundaries.
• **Generate sibling paths**: versioned endpoints, mobile routes, legacy APIs, alternate roles, and admin-only variants.
• **Build a role matrix**: anonymous, user A, user B, stale session, fresh session, admin, service account.
• **Ask for dev shortcuts**: "Where would a tired developer skip a check or reuse a helper?"
• **Ask for chains**: "If this bug is real, what bug B and C sit next to it?"
• **Turn ideas into requests**: every AI suggestion must become a single reproducible HTTP experiment.
• **Kill weak signals fast**: if AI cannot point to a concrete request, response diff, or cross-account delta, the idea stays as a hypothesis.

High-signal prompts:

• "Given this endpoint and feature, list the 10 most likely trust-boundary mistakes."
• "What sibling endpoints, methods, or roles should I test next?"
• "Which bug class would a rushed implementation likely miss here?"
• "What does the smallest proof request look like?"
• "What would make this become a real report instead of a scanner hit?"

Amateur vs Pro: 7-Phase Comparison

| Phase | Amateur | Pro | |-------|---------|-----| | Recon | Main domain only | Shadow IT, dev environments, all assets | | Discovery | Look for errors | Look for design contradictions, business logic flaws | | Exploit | Give up when blocked | Build filter-bypass payloads | | Escalation | Report the phenomenon only | Chain to real harm (session steal, ATO) | | Feasibility | Include unrealistic conditions | Minimize attack prerequisites | | Reporting | State facts only | Quantify business risk | | Retest | Check if old PoC fails | Analyze fix method, find incomplete patches |

Two Approach Routes

• **Route A (Feature-based)**: "This feature is complex" -> deep-dive its input handling -> find vuln
• **Route B (Vuln-based)**: "I want IDOR" -> find endp