# Web, API, SaaS, and network field manual

Original research cutoff: 11 September 2026; targeted content review: 14 September 2026. Commands below are examples, not scans performed during this research. Operational budgets and report thresholds are recommended field practice; each program's written policy overrides them.

## 1. Turn scope into executable boundaries

Record an authorization tuple for every candidate: `program + asset identifier + owner + environment + scheme/protocol + port + path + permitted accounts + permitted techniques + exclusions + policy timestamp`. Keep **discovered**, **ownership-attributed**, **authorized**, **reward-eligible**, and **tested** as separate states. A CNAME, certificate, repository reference, ASN association, or company logo proves none of the later states by itself.

The following interpretations deliberately avoid silently expanding a program's words. A program-specific definition can broaden or narrow any row.

| Scope expression | Working interpretation | Gate before expansion |
|---|---|---|
| Exact URL `https://app.example.com/report` | Listed scheme, host, port, and resource | Confirm whether query variants, child paths, and sibling routes are covered |
| Path prefix `https://app.example.com/api/v2/` | Listed origin and documented path subtree | `/api/v20`, `/admin`, redirects, alternative encodings, and rewritten paths require independent evaluation |
| Exact hostname `api.example.com` | That hostname, with the program's permitted protocols/ports | Neither siblings nor its resolved IP as a general network target follows automatically |
| Apex `example.com` | The apex hostname | Subdomains are separate unless expressly included |
| Wildcard `*.example.com` | Hostnames matching the policy's wildcard definition | Do not assume apex inclusion, unlimited depth, every port, or third-party hosted services |
| IP `192.0.2.10` | This IP and allowed services | No automatic entitlement to other IPs, other virtual hosts, provider control planes, or every tenant |
| CIDR `192.0.2.0/28` | Addresses within the prefix, subject to exclusions | Verify ownership and service restrictions; no ASN-wide expansion |
| Port `:8443` / TCP / UDP | The specified transport and port | TCP/443 permission does not imply UDP/443, SSH, SMTP, or an origin backend |
| Staging, demo, or sandbox | Named deployment and test account context | Shared identity, payment, telemetry, and production backends remain separate boundaries |
| SaaS tenant / workspace | Authorized tenant and stated cross-tenant test setup | Other customers and vendor infrastructure are not automatically authorized |
| Repository or self-hosted product | Eligible code/version and your controlled deployment | Public deployments of that software need their own authorization |

Implement exclusions before inclusions and fail closed on malformed URLs, credentials in URLs, ambiguous encodings, unsupported schemes, and unresolved ownership. Compare parsed hosts, not substring matches: `example.com.attacker.test` is unrelated to `example.com`. Normalize IDNs and trailing DNS dots consistently. For path-limited scope, record the exact request target and any proxy normalization; do not let an allowlist's normalization disagree with the client that sends the request. Recheck each redirect and every discovered URL before sending a new request.

Use WSTG for testing procedures and ASVS for expected controls. Pin references: the WSTG project identifies 4.2 as a released version and 5.0 as development; ASVS identifies 5.0.0, released 30 May 2025. Neither framework makes every failed control a payable bounty. [OWASP WSTG](https://owasp.org/www-project-web-security-testing-guide/), [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/).

## 2. Recon that produces hypotheses

**Pass 1 — third-party discovery.** Read program documentation, public API references, repository references, certificate-transparency results, historical URL indexes, and already collected search-engine/network-index records. Save source and collection time; stale records are leads. Searching an existing Shodan/Censys record is different from requesting a fresh scan. Third-party discovery can disclose the target name to a provider even when it does not probe the target.

**Pass 2 — allowlist review.** Resolve candidates into exact permitted origins/resources. Do not pipe passive output directly into a scanner. Retain excluded and uncertain candidates in a review queue. Separate broad wildcard inventory from a single-app campaign: the latter needs route and workflow discovery more than another million hostnames.

**Pass 3 — active validation.** DNS resolution is a network operation and recursive resolution may reach authoritative infrastructure. HTTP requests, TLS handshakes, screenshots, crawling, directory discovery, port scans, DNS brute force, and vulnerability checks are active. Use the program's identification header and rate limit. If no rate is specified, begin manually; a conservative automation starting point is one worker and at most one request/second, only where automation is permitted. This is a proposed budget, not a universal authorization.

**Pass 4 — application mapping.** Exercise normal workflows through an intercepting proxy. Inventory method, path, operation name, object IDs, role, tenant, side effects, upload/download behavior, integrations, and request source. Compare UI traffic with OpenAPI schemas, SDKs, JavaScript and source maps. Old versions, undocumented operations, export jobs and background tasks become hypotheses, not automatic findings.

```bash
# Third-party discovery only: do not add -active/-nW.
# Review installed config and available provider credentials first.
subfinder -d example.com -silent -o candidates.txt

# Human-reviewed file: exact URLs, explicit schemes and permitted ports.
# Use a reviewed empty YAML config to prevent inherited scan options.
httpx -config scope-httpx.yaml -l approved-origins.txt \
  -nfs -sc -title -location -json -threads 1 -rate-limit 1 \
  -retries 0 -timeout 10 -disable-update-check -o inventory.jsonl

# Single approved URL; -q first ignores inherited curlrc options.
# No -L/--location: inspect any Location before a separate request.
curl -q --proto '=https' --connect-timeout 5 --max-time 15 \
  --dump-header evidence/headers.txt --output evidence/body.txt \
  'https://app.example.com/approved-path'
```

`scope-httpx.yaml` should contain `{}`; `evidence/` must already exist. These commands assume tools are installed. `httpx` here means ProjectDiscovery's binary. Its `-nfs` preserves the input scheme; `-nf` has different behavior. Omit redirect-following, screenshot, TLS-domain, CSP-domain, favicon, additional-port, and extra-path probing flags. `-fhr` limits redirects to the same host, **not** to the same port/path. `-allow/-deny` are IP/CIDR controls, not URL scope enforcement. For exact-path scope, prefer a reviewed single request until client behavior is confirmed. [Subfinder usage](https://docs.projectdiscovery.io/opensource/subfinder/usage), [httpx usage](https://docs.projectdiscovery.io/opensource/httpx/usage), [curl manual](https://curl.se/docs/manpage.html).

Automated vulnerability checks come after mapping. Review each selected template's requests, methods, payload count, redirects, extracted targets, code/headless behavior, callbacks and cleanup. A severity label is not a safety classification. A low rate does not make a destructive request safe. Do not use “run all templates” as a discovery stage.

## 3. Authorization: two identities, two tenants, controlled objects

Create accounts A and B and tenants T1 and T2 where permitted. Initially A owns T1 and B owns T2. Seed distinguishable synthetic objects O1 and O2. For within-tenant checks, temporarily add B to T1 with a documented limited role, then revoke that membership. Use separate browser profiles and token stores. Additional administrator identities improve coverage when available, but are not required to start.

Record expected behavior from documentation and normal use before testing. “Not visible in the UI” alone does not establish a forbidden action. Different status codes are not proof: inspect response data, resulting state, audit events, and eventual background-job output. [PortSwigger access control](https://portswigger.net/web-security/access-control).

| Actor/context | Resource/action | Expected result to validate |
|---|---|---|
| Anonymous | Private O1 read/export | No private content or downloadable artifact |
| A in T1 | O1 normal operations | Authorized baseline succeeds |
| B, T2 only | O1 read, update, delete, share | Denied across tenants |
| B as T1 viewer | O1 modification, invite, billing, token creation | Restricted by role |
| B as T1 member | A's explicitly private object | Restricted by ownership or sharing policy |
| B after removal | Old token, existing socket, queued export | Access follows documented revocation semantics |
| A using T2 identifier | O2 nested resource and batch operation | Server checks tenant/object relation |
| A with restricted API key | Administrator function or forbidden field | Key permissions apply independently of UI permissions |

For each operation, test three independent dimensions: **object** (whose record), **function** (which action), and **property** (which fields may be read or written). Substitute only known IDs from your controlled accounts; include IDs in paths, JSON bodies, query parameters, headers, nested objects, arrays, export IDs, download tokens and WebSocket subscriptions. Verify list/search/count routes as well as direct reads. Do not enumerate strangers' IDs to demonstrate scale.

**Report threshold:** a reproducible violation of the intended permission boundary on controlled data. Save a baseline request, the minimally modified request, both identities' roles, expected rule, response/state evidence and cleanup. **Stop:** once the first unauthorized read/write is proven; do not turn one record into a mass export. If real customer data appears, preserve the minimum necessary metadata and stop that path.

## 4. Protocol branches

| Surface | Focused checks | Evidence and stopping rule |
|---|---|---|
| REST / JSON | Methods, versions, nested resources, server-owned fields, batch operations, pagination, alternate content types | Compare two controlled identities; prove changed server state or private output, not merely HTTP 200 |
| GraphQL | Resolver and field authorization, nodes/global IDs, mutations, subscriptions, aliases with tiny batches | An exposed schema alone is usually a lead; prove forbidden data/action. Avoid depth/complexity exhaustion |
| gRPC | Known `.proto` methods, channel versus per-call credentials, tenant metadata, unary/stream authorization | Capture method, metadata and gRPC status/trailers; HTTP 200 alone says little. Reflection alone is not privilege escalation |
| WebSocket | Handshake authentication, Origin handling, per-message authorization, room subscription, logout/revocation | A controls the sender, B the recipient. Prove unauthorized subscription/action with a marker; stop after one message |

GraphQL introspection helps map a schema, but public APIs may intentionally expose it. Prefer observed operations and small schema queries before broad introspection; authorization still belongs at the resolver/object/field boundary. [PortSwigger GraphQL](https://portswigger.net/web-security/graphql).

gRPC distinguishes channel credentials from call credentials, and reflection exposes service descriptors for tooling. Test the real trust boundary rather than reporting the existence of either mechanism. Avoid assuming a token valid for one service may be forwarded to another. [gRPC authentication](https://grpc.io/docs/guides/auth/), [gRPC reflection](https://grpc.io/docs/guides/reflection/).

WebSocket checks must cover messages after the handshake, including existing connections after membership changes. Cross-site WebSocket hijacking requires a browser-feasible connection and meaningful unauthorized interaction; an accepted arbitrary Origin header in a proxy is insufficient by itself. [PortSwigger WebSockets](https://portswigger.net/web-security/websockets).

## 5. Authentication, federation, and session lifecycle

Build a state diagram in notes: registration → email verification → login → MFA → sensitive reauthentication → recovery → account linking → logout/revocation. Test alternate entry points, mobile/API clients, and identity changes using your own inboxes. Check that a password reset changes the intended account, consumed tokens cannot be replayed, and email changes do not silently inherit an old verified identity.

For sessions, compare pre-login and post-login identifiers, privilege-change rotation, inactivity/absolute expiry, logout, reset, MFA change, device removal, API-key revocation and tenant removal. Distinguish browser logout from server-side invalidation; assess residual validity against promised behavior and impact rather than assuming every token must instantly disappear. [OWASP Session Management](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html).

For OAuth, test authorization-response binding to the initiating browser, exact approved redirect handling, authorization-code reuse, PKCE behavior, account-linking confirmation and issuer mix-up boundaries. Missing `state` alone is not conclusive if another valid binding mechanism exists. RFC 9700 is the current OAuth security BCP, published January 2025. [RFC 9700](https://www.rfc-editor.org/rfc/rfc9700.html), [PortSwigger OAuth](https://portswigger.net/web-security/oauth).

For OIDC, verify signature trust, issuer, audience, expiry and nonce when applicable; distinguish an ID token identifying a user from an access token authorizing API use. For SAML in an authorized test identity provider/service provider setup, examine signature coverage, trusted certificates, audience/recipient/destination, request correlation and assertion replay. **Report threshold:** demonstrate login, linking, privilege or session access as the wrong controlled identity. **Stop:** no identity-provider-wide attacks or takeover of real users. [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html), [OWASP SAML Security](https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html).

## 6. Business logic and bounded concurrency

Write invariants before payloads: “Only an owner can transfer ownership”; “one invitation creates one membership”; “a cancelled subscription cannot create new privileged credentials”; “a discount applies once”; “an export belongs to the requesting tenant.” Trace intermediate states and repeat, reorder, skip or replay one transition at a time. Include asynchronous workers, webhook delivery, stale links, retries, negative/zero quantities, precision/currency conversion, and price inputs where the program provides a nonfinancial sandbox. [PortSwigger business logic](https://portswigger.net/web-security/logic-flaws).

For a race, first run the sequence serially and record the expected state. Preconditions: explicit permission for concurrency, a reversible test object, a way to inspect durable state, and no real money/inventory impact. Start with **two** synchronized requests and a fixed small experiment budget; do not assume this budget is safe for every endpoint. Compare with serial controls and inspect committed state after jobs settle. Two success responses may still represent one committed operation. **Report threshold:** a duplicate transition or violated invariant that survives completion. **Stop:** at first proof, increased errors, queue growth, or unintended side effects; restore your test object. Practice timing techniques locally before production. [PortSwigger race conditions](https://portswigger.net/web-security/race-conditions).

## 7. Focused vulnerability test cards

Each card assumes the exact endpoint and technique are authorized, a baseline exists, and synthetic data is available.

| Class | Bounded action | Evidence / report threshold | Stop or defer |
|---|---|---|---|
| SQL / NoSQL injection | Change one input with paired controls; confirm input reaches a query/operator context | Reproducible query-semantic change tied to input; syntax errors alone remain leads | No database dumps, destructive statements, or unbounded timing probes |
| Command / template injection | In a local replica first, use a harmless expression/marker appropriate to the sink | Distinguish template evaluation from client rendering and reflection; show relevant execution impact | Stop at minimal proof; no shell persistence or environment-secret collection |
| XSS | Determine HTML/attribute/JS/DOM context; demonstrate a benign marker executing for controlled B | Another permitted user's browser executes in the affected origin with realistic delivery | No cookie/token exfiltration; avoid content visible to real users |
| Upload | Test filename, content type, file content, ownership, retrieval and processing independently | Unauthorized controlled-file access, unsafe interpretation, traversal, or executable handling | No web shells, overwriting application files, archive bombs, or expensive documents |
| Path traversal | Use an owner-provided canary or file planted in your local replica outside the allowed directory | Read/write outside intended path boundary with a known harmless file | Do not retrieve production configuration, keys or user files |
| SSRF / XXE | Send a unique callback to infrastructure you control; separate DNS from HTTP observations | Show unintended server-side request and reachable policy boundary; intended URL fetching is not automatically SSRF | No cloud credential retrieval, internal sweeps or unrelated destinations; ask owner for an internal canary if needed |
| CSRF | From your controlled origin, make B's real browser perform one reversible protected action | Ambient credentials plus attacker-deliverable request cause unauthorized state change | Missing token alone is insufficient; do not involve real users |
| CORS | From controlled origin, read a private response in B's browser with realistic credential behavior | Browser actually exposes sensitive controlled data cross-origin | `Access-Control-Allow-Origin: *` with public content is not a finding; wildcard plus credentials is not automatically browser-exploitable |
| Cache poisoning / deception | Use a demonstrably isolated cache key and controlled marker/accounts | Another controlled client receives poisoned content or A's private data from shared cache | Unique query strings may be ignored in cache keys; stop if isolation is uncertain |
| Request parsing / smuggling | Reproduce proxy/backend disagreement in a lab or program-approved isolated endpoint | Demonstrate a request-boundary mismatch with controlled paired traffic | Production desynchronization can affect unrelated users; no broad probes or response-queue capture |

Technical references for the respective cards: [SQL injection](https://portswigger.net/web-security/sql-injection), [NoSQL injection](https://portswigger.net/web-security/nosql-injection), [template injection](https://portswigger.net/web-security/server-side-template-injection), [XSS](https://portswigger.net/web-security/cross-site-scripting), [uploads](https://portswigger.net/web-security/file-upload), [path traversal](https://portswigger.net/web-security/file-path-traversal), [SSRF](https://portswigger.net/web-security/ssrf), [CSRF](https://portswigger.net/web-security/csrf), [CORS](https://portswigger.net/web-security/cors), [cache poisoning](https://portswigger.net/web-security/web-cache-poisoning), [request smuggling](https://portswigger.net/web-security/request-smuggling).

## 8. Network, DNS, TLS, and email branches

Use the dedicated [Network services playbook](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html) for the full DNS, TLS, email, database, queue, VPN and appliance workflow.

Only use this branch when the service/IP/port is covered. A website scope does not automatically authorize its hosting provider's network. An open port identifies a reachable service, not a vulnerability; an observed version can be backported, masked or misidentified. Nmap service detection sends protocol probes and can have side effects; even its documentation excludes printer port 9100 by default for that reason. Select individual services before deeper interrogation. [Nmap port states](https://nmap.org/book/man-port-scanning-basics.html), [Nmap version detection](https://nmap.org/book/man-version-detection.html).

For DNS, inspect A/AAAA/CNAME/NS/MX/TXT relationships. Public DNS lookups differ from passive historical DNS searches. A dangling CNAME is evidence of a configuration lead, not proof that the referenced resource is claimable. Resource claiming can change production routing; obtain the program-approved proof method before registration. Zone transfer, dynamic updates, recursion abuse and amplification testing require a specific allowed branch.

For TLS, connect using the intended SNI and verify the intended hostname; a wrong default certificate from an IP-only connection may simply reflect virtual hosting. Certificate SANs provide candidates, not added scope. Avoid treating a scanner's “old cipher” label as meaningful impact without the program's eligibility criteria. [OWASP TLS](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html).

```bash
# Active DNS queries; only after the applicable discovery gate.
dig +time=2 +tries=1 app.example.com A
dig +time=2 +tries=1 app.example.com AAAA

# Active handshake to an approved hostname and port.
timeout 15 openssl s_client -connect app.example.com:443 \
  -servername app.example.com -verify_hostname app.example.com \
  -verify_return_error -brief </dev/null
```

The DNS and TLS commands use their official documented query/connection options. Hostname verification and SNI are separate controls. [BIND manual](https://bind9.readthedocs.io/en/latest/manpages.html), [OpenSSL s_client](https://docs.openssl.org/3.5/man1/openssl-s_client/).

For SMTP/IMAP, distinguish the domain's mail configuration from an authorized mail-server service. Review SPF/DKIM/DMARC findings against program exclusions and actual spoofing/identity impact. Any relay or delivery test needs explicit scope and researcher-controlled mailboxes; do not send messages to staff to prove delivery. An MX pointing to a provider does not authorize that provider. For SSH, databases, queues, object stores and administration panels, start with service identity and authentication requirements; never jump from a banner to default-password spraying or reading datasets.

## 9. Exit checklist

- [ ] Policy snapshot and exact asset/technique authorization recorded; exclusions applied.
- [ ] Every candidate has an ownership and scope decision; redirects and dependencies reviewed.
- [ ] Synthetic accounts, two tenants, role transitions and cleanup plan established.
- [ ] Endpoints include background jobs, exports, integrations and alternate protocols.
- [ ] Object, function and property authorization checked independently.
- [ ] Authentication and revocation tested across UI/API/socket paths.
- [ ] High-value business invariants have serial controls before concurrency tests.
- [ ] Browser findings verified in a real browser; server findings have controlled differential evidence.
- [ ] Finding has a reproducible boundary violation, not only a scanner label or missing hardening control.
- [ ] Sensitive evidence minimized; timestamps, requests, relevant responses and state changes preserved.
- [ ] Test records removed, tokens revoked, callbacks stopped and report submitted privately.

## Identity and protocol coverage review — 14 September 2026

The shared procedures now distinguish **account lifecycle**, **authenticator proof**, **federation trust**, and **API transport**. Complete the applicable branch for the deployed feature; unavailable access is an untested branch, not a passed check.

| Observed feature | Additional checks | Reusable procedure |
|---|---|---|
| Email verification, invitations, account merging | Pending identity, stale links, cancelled invitations, retained sessions | [Identity lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) |
| MFA, passkeys, recovery codes | Factor binding, replacement, replay, verification policy | [Authenticator lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) |
| OAuth, OIDC, SAML | Transaction binding, token purpose, issuer/audience, signature coverage | [Federation and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) |
| Enterprise SSO and SCIM | Alternate login paths, tenant provisioning scope, group removal and revocation interval | [Identity lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) |
| HTTP/JSON-to-gRPC or gRPC-Web gateway | Same method and object through each deployed authentication path | [Protocol parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) |
| SSE and resumed streams | New-event authorization, reconnect cursor, membership removal | [Protocol parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) |

Start with a legitimate request, change one identity/proof/context, inspect a protected result, and preserve a control. Follow the module's full procedure before reaching its command card. The new classes are indexed with reverse references in the [vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html).

- [ ] Enrollment and recovery cannot silently reduce a required authentication guarantee.
- [ ] Account verification or linking does not preserve unintended access.
- [ ] An enforced SSO policy is checked at protected tenant access.
- [ ] Token purpose and claim checks are distinguished from signature checks.
- [ ] GraphQL alternate methods, deployed gateways, and resumed streams preserve permissions.

## Follow the two commonly missed server entry points

The server-side review now includes [request-value interpretation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/request-value-parsing.html) and [webhook event integrity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/webhook-event-integrity.html). These are reusable across web/API, self-hosted OSS, cloud services and AI integrations. Run them when the application has multiple parsing layers, internal service calls or external event delivery; record an inapplicable result with the reason when those features are absent.

| Boundary | Minimal controlled comparison | Required evidence |
|---|---|---|
| Duplicate query/JSON values | Allowed scalar, denied scalar, both values in each order | The value checked differs from the value used in a forbidden operation |
| Downstream parameter construction | Literal marker, delimiter marker, correctly encoded control | Actual internal request parameters plus changed policy semantics |
| Webhook authenticity | Genuine event, invalid signature, changed body with unchanged signature | No protected effect for invalid cases, or the exact unauthorized worker transition |
| Provider-to-tenant mapping | Valid events from two controlled integrations | Authenticated provider identity tied to the correct local tenant/object |
| Retry and event ordering | Serial replay and two valid events in reversed order | Durable effect count and final permissions after workers settle |
| Delayed injection | Store marker, trigger observed export/job, compare literal control | Both entry and later sink, including the stored bytes |

Keep ordinary parser preference, delivery acknowledgement and cached responses separate from demonstrated security failures. Use the modules' numbered procedures and linked vulnerability cards for report thresholds and false-positive controls.

- [ ] Parser/type/precedence behavior checked where multiple layers consume input.
- [ ] Later consumers of stored input traced where exports or workers exist.
- [ ] Incoming events authenticated before privileged processing and bound to tenant/object.
- [ ] Replay, ordering and queue effects inspected against the documented workflow.
- [ ] File links, cache revalidation and actual SSRF connection identity checked when applicable.

Review additions verified against primary documentation on 14 September 2026. Earlier chapter references retain their original review dates; these additions do not imply that every external link or every target was tested.

## Source registry

All sources accessed 2026-09-11. “Undated” means no reliable publication date was established; it does not imply old content. Sources were read directly. This chapter's test budgets, matrices, ordering and stopping rules are synthesis, not quotations from those sources.

| Source | Date/version | URL |
|---|---|---|
| OWASP WSTG project | v4.2 released 2020-12-03; v5 development | https://owasp.org/www-project-web-security-testing-guide/ |
| OWASP ASVS | v5.0.0 released 2025-05-30 | https://owasp.org/www-project-application-security-verification-standard/ |
| ProjectDiscovery Subfinder usage | Undated | https://docs.projectdiscovery.io/opensource/subfinder/usage |
| ProjectDiscovery httpx usage | Undated | https://docs.projectdiscovery.io/opensource/httpx/usage |
| curl manual | Undated rolling manual | https://curl.se/docs/manpage.html |
| PortSwigger access control | Undated | https://portswigger.net/web-security/access-control |
| PortSwigger GraphQL | Undated | https://portswigger.net/web-security/graphql |
| gRPC authentication | Last modified 2024-01-12 | https://grpc.io/docs/guides/auth/ |
| gRPC reflection | Undated | https://grpc.io/docs/guides/reflection/ |
| PortSwigger WebSockets | Undated | https://portswigger.net/web-security/websockets |
| OWASP Session Management | Undated | https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html |
| RFC 9700 OAuth Security BCP | January 2025 | https://www.rfc-editor.org/rfc/rfc9700.html |
| PortSwigger OAuth | Undated | https://portswigger.net/web-security/oauth |
| OpenID Connect Core | 1.0 incorporating errata set 2 | https://openid.net/specs/openid-connect-core-1_0.html |
| OWASP SAML Security | Undated | https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html |
| PortSwigger business logic | Undated | https://portswigger.net/web-security/logic-flaws |
| PortSwigger race conditions | Undated | https://portswigger.net/web-security/race-conditions |
| PortSwigger SQL injection | Undated | https://portswigger.net/web-security/sql-injection |
| PortSwigger NoSQL injection | Undated | https://portswigger.net/web-security/nosql-injection |
| PortSwigger template injection | Undated | https://portswigger.net/web-security/server-side-template-injection |
| PortSwigger XSS | Undated | https://portswigger.net/web-security/cross-site-scripting |
| PortSwigger file uploads | Undated | https://portswigger.net/web-security/file-upload |
| PortSwigger path traversal | Undated | https://portswigger.net/web-security/file-path-traversal |
| PortSwigger SSRF | Undated | https://portswigger.net/web-security/ssrf |
| PortSwigger CSRF | Undated | https://portswigger.net/web-security/csrf |
| PortSwigger CORS | Undated | https://portswigger.net/web-security/cors |
| PortSwigger cache poisoning | Undated | https://portswigger.net/web-security/web-cache-poisoning |
| PortSwigger request smuggling | Undated | https://portswigger.net/web-security/request-smuggling |
| Nmap port states | Undated | https://nmap.org/book/man-port-scanning-basics.html |
| Nmap version detection | Undated | https://nmap.org/book/man-version-detection.html |
| OWASP TLS | Undated | https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html |
| BIND manual | Rolling development manual, undated | https://bind9.readthedocs.io/en/latest/manpages.html |
| OpenSSL s_client | Version 3.5 manual, undated | https://docs.openssl.org/3.5/man1/openssl-s_client/ |

Review update, 14 September 2026: the official [OWASP API Security Top 10 2023 overview](https://api-security.owasp.org/editions/2023/en/0x11-t10/), BOLA and object-property authorization pages were successfully retrieved. Original source-registry access dates remain historical.


## Shared investigation procedures

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
- [Server-side fetching and network trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ssrf-boundary.html) — Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- [Workflow invariants, replay, idempotency, and races](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/state-business-logic.html) — Find security consequences in workflow ordering and concurrency, with serial controls and durable-state evidence.
- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
- [Proxy normalization, cache isolation, and request boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/proxy-cache.html) — Investigate layered HTTP behavior with isolated cache keys and controlled front-end/back-end traffic.
- [OSS lab: pin, install, prove, reset](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html) — Turn an eligible release into a repeatable synthetic environment with preserved versions, realistic controls, and an explicit reset recipe.
- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- [RAG isolation: ingestion, retrieval, citations and revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/rag-tenant-isolation.html) — Trace document authorization through vector search, generated answers, citation downloads, caches and sharing changes.
- [MFA and passkeys: enrollment, proof, replacement, and recovery](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) — Follow each authenticator from account binding to removal, and validate WebAuthn assertions without mistaking client UI or counter behavior for a security guarantee.
- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
- [Request values: duplicate parameters, parser conflicts and downstream queries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/request-value-parsing.html) — Trace the value a security layer validates through to the value the application or downstream service actually consumes.
- [Webhooks and integration events: authenticity, tenant binding and replay](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/webhook-event-integrity.html) — Verify the event signature, provider-to-tenant binding and durable worker effect together across retries and out-of-order delivery.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
- [Browser extensions: message authority and document lifetime](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) — Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.
- [AI state: memory, resumed work, retries and private caches](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-state-lifecycle.html) — Test persistent context, task ownership, MCP request-state integrity, duplicate effects and caches across identities and time.
- [Resource budgets and sensitive business flows](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/resource-budget-controls.html) — Trace request fan-out, retries, recipient limits and tenant quotas using tiny local limits, recording stubs and measured downstream effects.

## Vulnerability reference

- [Broken object-level authorization (BOLA / IDOR)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bola-controlled-object-access.html)
- [Broken function-level authorization (BFLA)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bfla-restricted-function.html)
- [Broken property authorization: private response fields](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bopla-private-response-property.html)
- [Mass assignment of server-controlled properties](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mass-assignment-protected-property.html)
- [Authentication or MFA state bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authentication-incomplete-state-bypass.html)
- [Session fixation across login](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-fixation-login-binding.html)
- [Residual access after explicit session revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-revocation-residual-access.html)
- [Password reset binding or single-use failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-reset-account-binding.html)
- [OAuth login or account-linking confusion](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/oauth-login-account-linking-confusion.html)
- [JWT signature, issuer, audience, or token-purpose validation failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/jwt-signature-trust-failure.html)
- [SQL injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sql-query-structure-injection.html)
- [NoSQL operator or query injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/nosql-operator-contract-bypass.html)
- [OS command injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/os-command-argument-boundary.html)
- [Server-side template injection (SSTI)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/server-template-expression-injection.html)
- [Reflected or stored cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xss-reflected-stored-origin-execution.html)
- [DOM-based cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dom-xss-source-sink-flow.html)
- [Cross-site request forgery (CSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/csrf-browser-forged-state-change.html)
- [CORS private-data exposure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cors-private-credentialed-read.html)
- [Cross-origin messaging trust failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/postmessage-origin-validation.html)
- [Server-side request forgery (SSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ssrf-forbidden-destination.html)
- [Unsafe upload interpretation or placement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-upload-interpretation.html)
- [Path traversal outside an allowed root](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/path-traversal-controlled-canary.html)
- [XML external entity injection (XXE)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xxe-external-entity-resolution.html)
- [Archive extraction path escape](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/archive-extraction-path-escape.html)
- [Web cache poisoning](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/web-cache-poisoning-unkeyed-input.html)
- [Web cache deception](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/web-cache-deception-private-response.html)
- [HTTP request smuggling / desynchronization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/http-request-boundary-desynchronization.html)
- [Race condition in a security-sensitive transition](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/race-condition-duplicate-transition.html)
- [Workflow order or approval bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/workflow-order-validation-bypass.html)
- [Single-use action or idempotency replay failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/single-use-idempotency-replay.html)
- [GraphQL resolver or field authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/graphql-resolver-field-authz.html)
- [WebSocket message or subscription authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/websocket-message-authorization.html)
- [Cross-site WebSocket hijacking](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cross-site-websocket-hijacking.html)
- [Unsafe object deserialization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-deserialization.html)
- [JavaScript prototype pollution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/prototype-pollution.html)
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html)
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html)
- [Anonymous access to private object storage](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-storage-anonymous-read.html)
- [Unauthorized object creation or replacement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-storage-unauthorized-write.html)
- [Signed storage capability exceeds its authorized scope](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-presigned-capability-scope.html)
- [Private delivery policy bypassed through the origin](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-origin-access-bypass.html)
- [Dangling DNS reference to a retired service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dns-dangling-resource-reference.html)
- [Agent tool accepts unauthorized object or tenant parameters](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-tool-object-authorization.html)
- [MCP accepts a token for another resource](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-token-audience-confusion.html)
- [RAG retrieval or citation resolver crosses tenant boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cross-tenant-retrieval.html)
- [RAG cache or fresh retrieval ignores revoked access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cache-revocation-leak.html)
- [Open redirect across an origin trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/open-redirect-trust.html)
- [Clickjacking of a sensitive authenticated action](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/clickjacking-sensitive-action.html)
- [Untrusted Host or forwarding-header origin construction](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/host-header-origin-trust.html)
- [Sensitive data in errors, debug routes, or generated files](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-error-disclosure.html)
- [Predictable security token or capability identifier](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/weak-security-token-randomness.html)
- [Password storage without an adequate adaptive hash](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-storage-weak-hash.html)
- [Encrypted data accepted without integrity authentication](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/crypto-authentication-missing.html)
- [SAML assertion signature, audience, or response binding failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/saml-assertion-trust.html)
- [Unauthorized authenticator enrollment, replacement, or removal](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authenticator-management-proof-bypass.html)
- [WebAuthn assertion accepted for an invalid account or ceremony context](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webauthn-assertion-binding-failure.html)
- [Verification or account merge preserves another actor's access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/identity-verification-merge-confusion.html)
- [Enforced SSO bypass through an alternate login path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/enforced-sso-alternate-login-bypass.html)
- [Argument or option injection without shell interpretation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/process-argument-option-injection.html)
- [Parameter or JSON parser disagreement crosses a security check](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/request-parser-value-conflict.html)
- [Server-side parameter pollution in a constructed request](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/downstream-parameter-injection.html)
- [Unverified or tampered webhook causes a protected effect](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-event-authenticity-failure.html)
- [Authentic integration event applied to the wrong tenant or object](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-provider-tenant-binding.html)
- [Page message borrows unintended browser-extension authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-message-authority.html)
- [Delayed extension result reaches a different document](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-document-reply-confusion.html)
- [Agent conversation, checkpoint or memory crosses ownership boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ai-persistent-state-ownership.html)
- [Agent retry commits a protected single-use action twice](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-retry-duplicate-effect.html)
- [Unbounded resource allocation or request amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/resource-allocation-limit-failure.html)
- [Sensitive business flow exceeds its permitted frequency or allocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-flow-frequency-limit.html)