Bug-Bounty Hunting

Bug-Bounty Hunting

XHack keeps everything about a bug-bounty program in one place, watches it for new assets, and can hand the whole program to the AI in one click. The AI stays inside the scope and rules you give it, asks you when it needs something only you know, and reproduces every finding before it logs it.

This page shows how the pieces fit together. Each step has its own guide.

The flow, step by step

Step	What you do	Guide
1. Add the program	Save its scope, out-of-scope list, rules of engagement and notes.	Programs
2. Run recon	Map its subdomains, live URLs and JavaScript files, and see what is new since last time.	Run recon and see what's new
3. Keep watching	Re-check it daily or weekly in the background. No AI, no tokens.	Background monitoring
4. Hunt	Hand the whole program to the AI, or point it at only the new assets.	Start a full hunt
5. Answer questions	Give the AI what only you know, such as test credentials, or let it decide for itself.	Questions from the AI and Go full mode
6. Report	Submit verified findings with a ready-made HackerOne or Bugcrowd write-up.	Findings & Reports

In a hurry? Type a target into an empty chat and XHack starts tracking it straight away. See Start a hunt from an empty chat.

Tools for the hard-to-see bugs

Tool	What it finds	Guide
Collaborator	Blind SSRF, XXE, injection and other bugs that only show up as a DNS or HTTP callback.	Collaborator
Role profiles and access matrix	IDOR and broken access control, by replaying one request as every role at once.	Role profiles and access matrix

The AI can use both on its own. You can also use them by hand.

Work from any screen

Open the same chat on the desktop app and on the web console. Messages, approvals, questions, Stop and steering stay in sync on both as they happen. See Desktop and web console in sync.

Hunt responsibly

• Only hunt programs you are part of, and only inside their scope.
• Keep the program details accurate. The AI reads your scope, out-of-scope list and rules of engagement before it starts, and that is what it works from.
• Use test accounts the program gives you. Never use someone else's account or real customer data.
• Read every report before you submit it. The AI writes it, but you are the one submitting it.

Related

• CoHunter, the hunting team a full hunt can use
• Sub-Agents, parallel workers for big hunts
• Permission Modes, how much the AI does without asking
• HTTP Repeater, replay and edit requests by hand