sekolah76/syadagentic/bb-methodology

Bug Bounty Methodology: Workflow + Mindset

Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest.

PART 1: MINDSET (How to Think)

Core Principle

Hunting is not "find a bug" -- it is "prove an attack scenario." Think like an attacker with a specific goal, not a scanner looking for patterns.

Daily Discipline: Define, Select, Execute

Before touching any tool:

1. Define: "Today I target [feature/domain] to achieve [CIA impact]"
2. Select: Choose 1-2 vuln classes (IDOR, Race Condition, etc.)
3. Execute: Focus ONLY on selected techniques. No wandering.

5 Ultimate Goals (Pick One Per Session)

1. Confidentiality -- steal data the attacker shouldn't see
2. Integrity -- modify data the attacker shouldn't change
3. Availability -- disrupt service (app-level DoS only)
4. Account Takeover -- control another user's account
5. RCE -- execute commands on the server

4 Thinking Domains

1. Critical Thinking (deep analysis)

Question trust boundaries:

• Frontend control disabled? Send request directly via proxy
• user_role=user cookie? Change to admin
• price=1000 in POST? Change to 1
• <script> blocked? Try <img onerror=...>

Reverse-engineer developer psychology:

• Feature A has auth checks -> Similar feature B (newly added) probably doesn't
• Complex flows (coupon + points + refund) -> Edge cases have bugs
• /api/v2/user exists -> Does /api/v1/user still work with weaker auth?

What-If experiments:

• Skip checkout -> hit /checkout/success directly
• Skip 2FA -> navigate to /dashboard
• Send coupon request 10x simultaneously -> Race condition?
• Replace guid=f8a2... with id=100 on sibling endpoint -> IDOR?

2. Multi-Perspective (multiple angles)

3. Tactical Thinking (pattern detection)

• Naming anomaly: userId everywhere but suddenly user_id -> different dev, weaker security
• Error diff: Same 403 but different JSON structure -> different backend systems
• 200 but wrong body length/content: 200 OK with tiny response or "just a moment" text → WAF soft block, not a real response. Run bypass_403.sh to confirm and get baseline diff.
• Environment diff: Prod vs Dev/Staging -> debug headers, CSP disabled
• Version diff: JS file before/after update -> new endpoints, removed params
• Supply chain: Check framework/library versions for known CVEs
• Third-party integration: Stripe/Auth0/Intercom -> webhook signature missing?

4. Strategic Thinking (big picture)

• Asymmetry: Defender must patch ALL holes. You only need ONE.
• Intuition engineering: Log why something "feels wrong." Verify later. Update mental DB.
• Unknown management: Can't understand something? Add to "investigate later" list. Just-in-Time Learning.

5. AI-Assisted Thinking (model as a second analyst)

Use AI to expand hypotheses, not to declare verdicts. The model is a fast adversarial planner; the browser, proxy, and live requests are the proof layer.

• Decompose the feature: ask for actors, assets, entry points, state transitions, and trust boundaries.
• Generate sibling paths: versioned endpoints, mobile routes, legacy APIs, alternate roles, and admin-only variants.
• Build a role matrix: anonymous, user A, user B, stale session, fresh session, admin, service account.
• Ask for dev shortcuts: "Where would a tired developer skip a check or reuse a helper?"
• Ask for chains: "If this bug is real, what bug B and C sit next to it?"
• Turn ideas into requests: every AI suggestion must become a single reproducible HTTP experiment.
• Kill weak signals fast: if AI cannot point to a concrete request, response diff, or cross-account delta, the idea stays as a hypothesis.

High-signal prompts:

• "Given this endpoint and feature, list the 10 most likely trust-boundary mistakes."
• "What sibling endpoints, methods, or roles should I test next?"
• "Which bug class would a rushed implementation likely miss here?"
• "What does the smallest proof request look like?"
• "What would make this become a real report instead of a scanner hit?"

Amateur vs Pro: 7-Phase Comparison

Two Approach Routes

• Route A (Feature-based): "This feature is complex" -> deep-dive its input handling -> find vuln
• Route B (Vuln-based): "I want IDOR" -> find endpoints with sequential IDs -> test access control

Anti-Patterns (Stop Doing These)

• Program hopping: Stick with one target minimum 2 weeks / 30 hours
• Tool-only hunting: Automation finds duplicates. Manual testing finds unique bugs.
• Rabbit hole: Max 45 min per parameter. Set a timer. If stuck, sleep on it.
• No goal: "Just looking around" = wasted time. Always Define first.
• Architecture-as-vulnerability: Reporting standard platform architecture (public RPC endpoints, client env vars, CORS on token-auth APIs) as bugs. Run adversarial self-review BEFORE writing the report, not after. See triage-validation/references/web3-dapp-architecture-false-positives.md.
• Writing reports before adversarial review: Always run the 7-Question Gate + adversarial "assume this is wrong" pass BEFORE investing time in a full report. Saves 45+ min per false positive.

Adversarial Self-Review — 9-Category Counter-Argument Framework

When you have a candidate finding, assume the report is incorrect and run this pass BEFORE writing. Each category is a class of rejection that bug-bounty triagers use. If you cannot defeat every category, the finding is probably N/A — kill it before report-writing eats an hour.

1. Scope ambiguity — Does the affected asset actually fall inside the program scope, under any reasonable interpretation? "Internal admin tooling reachable on a public-internet hostname" is borderline; "demo page on a marketing site" usually isn't. State the strongest scope-in interpretation AND the strongest scope-out interpretation in the report; do not pretend ambiguity doesn't exist.

1. No demonstrated impact — Did you actually prove harm (data exfil, account compromise, code execution, privilege escalation), or only prove "endpoint is reachable"? Hypothetical impact ("if an attacker guessed credentials they could…") almost never pays. If your finding lives in "could/would/might" land, you owe the report a concrete demo path.

1. Default-credential / preconditions — Did you confirm default creds exist, or is "admin/admin might work" just a guess? Brute-force without proof of credential validity is not a finding — enumerate the username space and prove at least one valid user, or kill it.

1. Intended public exposure — Could a defender argue the configuration is a standard SaaS pattern (SSO callback, login from any IP, public status page)? If so, the bug must be the SSO bypass or the auth-bypass, not the reachability. Move the report onto the actually-exploitable primitive.

1. OOS by policy — Re-read the program's out-of-scope list. Mature programs (Tencent, Google, Meta) explicitly enumerate "no rate limit on non-critical forms," "admin panel can be brute forced," "information leakage without direct attack," "missing security headers." If your finding lands on one of those bullets, you can submit but expect rejection — and don't be surprised.

1. Behavioral / WAF realism — Did you test under realistic attack load (distributed, low-and-slow, bypass header order)? Behavioral WAFs (AEGIS, Akamai Bot Manager, Cloudflare ML) may pass a small burst then silently drop or fake-respond. A 30-request burst that all return 200 does NOT prove "no rate limit" — it proves "30 sequential requests from one IP weren't rate-limited."

1. Honeypot / decoy possibility — Could the endpoint be a deliberate trap that logs all attempts and bans in real-time? Auth endpoints behind behavioral detection sometimes return uniform success/fail errors while quietly correlating with a security team. State the assumption explicitly; if you can't rule it out, soften the impact claim.

1. Duplicate / known-issue risk — Mature programs with 100+ reports submitted are likely to have triaged your exact issue before. Search Hacktivity, GitHub issues, changelogs. If you find evidence the team already knows about it, do not resurface it — find a sibling or chain instead.

1. Sensitive-data exposure (the missing piece) — Does the bug actually leak credentials, PII, or money? "Endpoint reachable" + "internal service name leaked" + "no auth" by themselves do not pay. The escalation to "this name reveals a credential / enables bypass / grants access" is what carries the bounty. If no escalation exists, downgrade to N/A.

Output: After the pass, list each category as PASS / FAIL / UNKNOWN. Any FAIL → kill the finding or rebuild it as a different chain. UNKNOWN → either gather the missing evidence or scope down the claim. The 9-category framework is reusable across web2, web3, cloud, and mobile bug classes — see references/adversarial-self-review-checklist.md for the printable checklist and worked examples.

PART 2: WORKFLOW (What to Do)

The 5-Phase Non-Linear Flow

+-------------------------------------------------+
|                                                 |
|  +----------+    +----------+    +----------+   |
|  | 1. RECON |---+| 2. MAP   |---+| 3. FIND  |  |
|  +----------+    +-----+----+    +-----+-----+  |
|       ^                |               |         |
|       |                v               v         |
|       |          +----------+    +----------+    |
|       +----------| 4. PROVE |---+| 5. REPORT|   |
|                  +----------+    +----------+    |
|                                                  |
|  Non-linear: stuck at any phase -> go back       |
|  New API found at phase 3 -> return to phase 2   |
|  WAF blocks at phase 4 -> origin IP from phase 1 |
+-------------------------------------------------+

THIS IS NOT LINEAR. Move freely between phases. When stuck, return to a previous phase.

Output Style Constraint (User Preference)

• Ultra terse, technical, no filler. 1 line if possible.
• Drop conjunctions. Strip "Sure!"/"Of course!".
• Code first, explanation minimal.
• If unsure: state it, proceed. No hedging.

Phase 0: SESSION START (Every Time)

Before touching any tool, answer these: