HackAtlas

Build a comprehensive inventory of the target's digital assets using OSINT techniques — domains, acquisitions, IP ranges, cloud infrastructure, employee data, and technology stack.

Define the engagement scope, identify in-scope assets, review programme rules, and set up your testing environment before any active work begins.

Analyse DNS records, zone transfers, DNSSEC configuration, and mail infrastructure to uncover hidden services and misconfigurations.

Systematically discover all subdomains of a target to map the full attack surface before active testing begins.

Identify web servers, frameworks, CMS platforms, WAFs, CDNs, and third-party services to map the target's technology stack and find version-specific vulnerabilities.

Identify open TCP/UDP ports and enumerate running services across the target's IP space to reveal the full network attack surface.

Run automated vulnerability scanners against discovered services to identify known CVEs, misconfigurations, and common security weaknesses at scale.

Use web application scanners to detect OWASP Top 10 vulnerabilities, misconfigurations, and common web security issues across all discovered web assets.

Discover and map REST, GraphQL, and WebSocket APIs — find undocumented endpoints, authentication schemes, rate limits, and data schemas.

Enumerate cloud services (AWS, GCP, Azure), storage buckets, serverless functions, container registries, and cloud-specific misconfigurations.

Uncover hidden routes, API endpoints, and web resources by combining passive URL harvesting with active directory brute-forcing and JavaScript analysis.

Identify unintentional exposure of sensitive data — API keys, credentials, stack traces, internal hostnames, and developer artifacts — across all discovered surfaces.

Analyse client-side JavaScript files to extract API endpoints, secrets, tokens, internal paths, and business logic that reveal hidden attack surface.

Discover hidden parameters, form fields, API arguments, and input vectors across all endpoints to maximise the attack surface for injection and logic testing.

Test authentication mechanisms for broken access control, JWT vulnerabilities, IDOR, insecure password reset flows, and OAuth misconfigurations.

Test application workflows for logic flaws — race conditions, price manipulation, coupon abuse, workflow bypass, and state management issues.

Test whether sensitive, state-changing actions can be framed and hijacked through UI redressing due to missing X-Frame-Options or CSP frame-ancestors protections.

Test for cross-site request forgery, CORS misconfigurations, and cross-origin data leakage across all state-changing and authenticated endpoints.

Test for insecure deserialization, mass assignment / parameter binding vulnerabilities, and prototype pollution in server-side and client-side contexts.

Test file upload functionality for unrestricted file types, path traversal, remote code execution, and storage-based vulnerabilities.

Systematically test for insecure direct object references, broken function-level authorization, and privilege escalation across all API endpoints and application functions.

Test for SQL injection, NoSQL injection, command injection, template injection (SSTI), LDAP injection, and other server-side injection flaws.

Test for open redirect vulnerabilities where user-controlled input drives a redirect destination, then bypass filters and chain the issue into OAuth token theft and SSRF.

Test for time-of-check to time-of-use (TOCTOU) vulnerabilities, limit bypass via concurrent requests, and race conditions in financial and state-changing operations.

Test for HTTP request smuggling (desync) between front-end and back-end servers to bypass access controls, capture other users' requests, and poison caches.

Test the session lifecycle for weak token entropy, insecure cookie attributes, session fixation, incomplete invalidation, timeout flaws, and remember-me weaknesses.

Test for SSRF vulnerabilities to access internal services, cloud metadata endpoints, and internal network resources through the target application.

Identify and verify dangling DNS records pointing to deprovisioned cloud services that can be claimed by an attacker.

Test for web cache poisoning via unkeyed inputs and cache deception via path confusion to serve malicious responses or leak private data to other users.

Test for reflected, stored, and DOM-based XSS across all input vectors, including filter bypass techniques and context-aware payload crafting.

Test for XXE vulnerabilities to read local files, perform SSRF against internal services, and exfiltrate data through classic, blind, and error-based external entity injection.

Combine multiple low/medium-severity findings into high-impact exploit chains that demonstrate real-world attack scenarios and maximise bounty payouts.

Safely demonstrate the impact of a vulnerability by extracting proof-of-concept data — PII samples, internal configs, source code — while staying within programme rules.

Escalate from a low-privilege foothold to admin/root access through application-level, API-level, and infrastructure-level privilege escalation techniques.

Navigate coordinated disclosure timelines, communicate professionally with triage teams, handle duplicates and escalation, and rigorously retest fixes for bypasses and regressions.

Develop reliable, safe, and convincing proof-of-concept exploits that demonstrate vulnerability impact without causing damage to the target.

Write clear, reproducible, high-impact vulnerability reports that maximise the chance of acceptance and appropriate bounty payout.