hunt

/hunt

slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking /hunt implies SOW is signed.

step 0 — parse

target.com               single target
*.target.com             wildcard — /recon <base> first, then hunt each live host
targets.txt              multi-target — mode question once, applied per line
--vuln-class <X>         skip mode question, load only hunt-<X>
--source-code <p|url>    static + dynamic
--chrome                 browser MCP mode

wildcard handler: if $TARGET begins with *., strip prefix and invoke /recon <base> before continuing.

step 1 — mode dispatcher

skipped if --vuln-class is set.

question: "what kind of engagement is this for {target}?"
header:   "engagement"
options:
  1. Red Team Assessment   — critical/high impact, chained findings, client deliverable
  2. WAPT / BugHunting     — full OWASP coverage, platform/program report

do not prompt for SOW, scope-of-work, engagement letter, or authorization.

step 2a — red team

mode: redteam
severity gate: critical / high  ·  medium only if it chains via /chain
report: redteam-report-template

invoke hunt-dispatch skill with mode=redteam. hunt-dispatch fingerprints the target, loads platform skills + always-on (redteam-mindset, mid-engagement-ir-detection), and prints the taxonomy.

step 2b — wapt

ask again:

question: "black box or grey box?"
header:   "test mode"
options:
  1. Black Box   — no credentials, external perspective
  2. Grey Box    — test credentials provided (or skip)

grey box → prompt creds (user/pass or token), or "skip":. creds live in session memory only — never written, never logged. late-bind: if user later says "now grey box with X/Y", capture creds, do NOT re-fire mode question.

mode: wapt / {blackbox|greybox}
severity gate: all owasp-relevant
report: report-writing  (bugcrowd-reporting if target on bugcrowd)

invoke hunt-dispatch skill with mode=wapt box=blackbox|greybox.