/hunt

/hunt

slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking /hunt implies SOW is signed.

step 0 — parse

target.com               single target
*.target.com             wildcard — /recon <base> first, then hunt each live host
targets.txt              multi-target — mode question once, applied per line
--vuln-class <X>         skip mode question, load only hunt-<X>
--source-code <p|url>    static + dynamic
--chrome                 browser MCP mode

wildcard handler: if $TARGET begins with *., strip prefix and invoke /recon <base> before continuing.

step 1 — mode dispatcher

skipped if --vuln-class is set.

question: "what kind of engagement is this for {target}?"
header:   "engagement"
options:
  1. Red Team Assessment   — critical/high impact, chained findings, client deliverable
  2. WAPT / BugHunting     — full OWASP coverage, platform/program report

do not prompt for SOW, scope-of-work, engagement letter, or authorization.

step 2a — red team

mode: redteam
severity gate: critical / high  ·  medium only if it chains via /chain
report: redteam-report-template

invoke hunt-dispatch skill with mode=redteam. hunt-dispatch fingerprints the target, loads platform skills + always-on (redteam-mindset, mid-engagement-ir-detection), and prints the taxonomy.

step 2b — wapt

ask again:

question: "black box or grey box?"
header:   "test mode"
options:
  1. Black Box   — no credentials, external perspective
  2. Grey Box    — test credentials provided (or skip)

grey box → prompt creds (user/pass or token), or "skip":. creds live in session memory only — never written, never logged. late-bind: if user later says "now grey box with X/Y", capture creds, do NOT re-fire mode question.

mode: wapt / {blackbox|greybox}
severity gate: all owasp-relevant
report: report-writing  (bugcrowd-reporting if target on bugcrowd)

invoke hunt-dispatch skill with mode=wapt box=blackbox|greybox.

step 3 — sibling delegation

before any HTTP touch    →  /scope     (mandatory pre-flight)
recon empty | wildcard   →  /recon <target>
5+ live hosts surfaced   →  /surface   (P1/P2/Kill list)
confirmed finding        →  /chain     (A→B table lives here, NOT in /hunt)
before any report        →  /validate  (7-Question Gate)
findings ready           →  /report    (suggest, never auto)
session end              →  /remember  (silent)

step 4 — active testing

hand off to the loaded hunt-* skills. each skill has its own probes, payloads, validation. do not duplicate that logic here. on every confirmed finding, invoke /chain to check the A→B signal table.

modes

--source-code <path|url> — adds hardcoded-secret grep, route mapping, dangerous-function scan before live testing. --chrome — browser MCP for SPA / OAuth / DOM-XSS / WebSocket / file upload. --vuln-class <X> — load only hunt-<X>, skip mode question.

pacing & isolation

20-min rotation: every 20 min ask "am i making progress?" no → rotate. stop signals: 403 everywhere · 20+ payloads identical response · 5+ preconditions · 30+ min stuck on one endpoint.

one session per target. for targets.txt, mode question fires once; findings scoped per-target in hunt memory.

privacy

never prompt for, log, or echo SOW / scope-of-work / engagement-letter content. never persist grey box credentials to disk. client data lives only in .gitignored targets/<target>/SESSION.md.

at session end, invoke /remember silently (non-fatal).