After you run tools like subfinder, amass, or assetfinder, you end up with hundreds (sometimes thousands) of subdomains. Most hunters just scan them all blindly.

The Prompt:

Here is a list of subdomains for [target.com]. Analyze this list and:

	1. Group them by function (dev, staging, API, internal tools, admin panels, legacy apps)
	2. Identify which ones are most likely to be forgotten or under-maintained
	3. Highlight any naming patterns that suggest internal tools or debug environments
	4. Flag any subdomains that might indicate third-party integrations
[Paste your subdomain list here]

Prompt #2 — Technology Stack Vulnerability Mapping

After you identify technologies using Wappalyzer, whatweb, or httpx, feed the results to ChatGPT.

I found the following technology stack on a target web application:

- Web Server: Nginx 1.18
- Backend: Node.js with Express 4.17
- Database: MongoDB
- Frontend: React 18
- Authentication: JWT
- CDN: Cloudflare
- CMS: Strapi v4
Based on this stack, give me:
1. Known vulnerability classes for each technology
2. Common misconfigurations specific to this combination
3. Default endpoints I should check
4. Specific CVEs from 2024-2026 that affect these versions
5. Attack vectors that are unique to this particular stack combination

Prompt #3 — JavaScript File Analysis for Secrets

Analyze the following JavaScript code from a production web application. 
Look for:

		1. Hardcoded API keys, tokens, secrets, or credentials
		2. Hidden API endpoints not visible in the UI
		3. Internal URLs, IP addresses, or S3 bucket references
		4. Debug or development code left in production
		5. Comments that reveal business logic or security mechanisms
		6. Admin-only functionality or role checks done client-side
		7. WebSocket endpoints
		8. Any GraphQL queries or mutations
		9. faibarbase 
Be extremely thorough. Flag even slightly suspicious patterns.
[Paste JavaScript code here]

Prompt #4 — The "Describe and Attack" Prompt

This is the single most powerful prompt pattern I've seen top hunters use.

The Prompt:

I am testing a web application with the following functionality:

- Users can sign up with email and password
- Users can upload profile pictures (JPEG, PNG, max 5MB)
- Users can invite other users to their "workspace" via email
- There is a paid subscription system using Stripe
- Admins can export user data as CSV
- There is an API at /api/v2/ with Bearer token authentication
- Users can generate "share links" for their documents
- There is a password reset flow using email tokens

For each feature, give me:
1. The top 3 most likely vulnerability classes
2. Specific test cases I should try
3. Example payloads or requests
4. What a P1 (critical) version of each bug would look like
Think like a senior penetration tester. Be specific, not generic.

Prompt #5 — API Endpoint Attack Mapping

The Prompt:

Here are API endpoints I discovered on a target application:

GET /api/v2/users/{id}
PUT /api/v2/users/{id}
POST /api/v2/users/invite
GET /api/v2/workspace/{id}/members
DELETE /api/v2/workspace/{id}/members/{userId}
POST /api/v2/documents/upload
GET /api/v2/documents/{id}/download
POST /api/v2/billing/update-plan
GET /api/v2/admin/reports

For each endpoint, suggest:
1. IDOR test scenarios (changing IDs to access other users' data)
2. Authorization bypass tests (accessing admin endpoints as regular user)
3. Parameter manipulation tests
4. Race condition scenarios
5. Mass assignment / parameter pollution tests
6. Rate limiting bypass opportunities

Give me the exact HTTP requests I should craft for each test.

Prompt #6 — SSRF (Server-Side Request Forgery) Deep Dive

SSRF is one of the most common P1 bugs in modern applications, especially those that fetch URLs, generate previews, or process webhooks.

The Prompt:

I found a feature in a web application where I can submit a URL 
and the server fetches it (e.g., link preview, webhook URL, 
avatar from URL, PDF generation from URL).

The parameter is: url=https://example.com

Give me:
	1. All SSRF payloads to test for internal network access (127.0.0.1, 
	   metadata endpoints, internal IPs)
	2. Bypass techniques for common SSRF filters (URL parsing tricks, 
	   redirects, DNS rebinding, IPv6, encoding)
	3. Cloud metadata endpoints for AWS, GCP, and Azure
	4. How to escalate from basic SSRF to RCE or credential theft
	5. Payloads that bypass Cloudflare, WAFs, and URL validators
	
Explain each payload and why it works.

Prompt #7 — Authentication & Authorization Bypass