Prompting Guide

Prompting Guide - How to Talk to XHack AI

XHack AI is a professional security researcher, not a scanner. How you prompt it matters. This guide shows you how to get the best results by being clear, specific, and strategic.

Core Principles

1. Identify Your Asset First

Always tell XHack what you're testing:

• A live API endpoint
• A web application
• Source code (for review)
• An internal network
• A specific feature/endpoint

2. Be Specific About Scope

Define boundaries:

• What areas are in scope?
• What should be excluded?
• Do you need authentication?
• Any rate limits to respect?

3. Ask Smart Questions

Guide the AI strategically:

• What vulnerability type interests you?
• Should we focus on high-impact issues first?
• Do you want comprehensive testing or focused testing?

4. Avoid False Positives

Be clear about context:

• If testing source code → say "code review"
• If testing live API → mention the endpoint
• If testing web app → mention authentication

Prompt Categories

1. Browser-Based Bug Hunting

Use this when you want XHack to autonomously hunt vulnerabilities in a web application using a browser.

Basic Browser Hunt

Perform a browser-based bug hunt on https://example.com

Focus on:
- XSS vulnerabilities in all forms and user inputs
- CSRF protection on state-changing operations
- IDOR in user-specific features
- Authentication bypass opportunities

What it does:

• Opens a browser (headless or visual)
• Navigates the application
• Tests all forms and inputs
• Reports findings with POC

Advanced Browser Hunt with Login

Test https://example.com for vulnerabilities as an authenticated user

Login credentials:
- Username: testuser@example.com
- Password: TestPassword123

Target areas:
- User profile modifications
- Admin panel access (if available)
- File upload functionality
- API interactions from the browser

Look for: XSS, CSRF, IDOR, privilege escalation, information disclosure

What it does:

• Logs in as the provided user
• Tests authenticated features
• Maps user-specific functionalities
• Tests for authorization flaws

Specific Feature Testing

Test the "Settings" page at https://example.com/settings for vulnerabilities

The page has these form fields:
- Email input (text)
- Phone number (text)
- Bio (textarea)
- Profile picture (file upload)
- Two-factor authentication toggle

Test each for: XSS, CSRF, IDOR, injection, file upload vulnerabilities

What it does:

• Focuses on specific page/feature
• Tests each input systematically
• Reports context-specific vulnerabilities

2. Reconnaissance & Asset Discovery

Use this when you need comprehensive information gathering.

Full Scope Reconnaissance

Perform comprehensive reconnaissance on example.com

Gather:
1. Subdomain enumeration - find all subdomains
2. Live host detection - which subdomains are active?
3. Port scanning - what services are exposed?
4. Technology fingerprinting - what stack/frameworks?
5. Directory discovery - find hidden endpoints
6. JavaScript analysis - extract API endpoints
7. Email/user enumeration - find user patterns

Provide:
- Complete subdomain list with active services
- Technology stack breakdown
- API endpoints discovered
- Potential entry points for testing

What it does:

• Maps complete attack surface
• Identifies all services
• Finds hidden endpoints
• Discovers API patterns
• Lists technologies in use

Targeted Subdomain Testing

Reconnaissance on *.example.com

Specifically look for:
- Admin panels (admin, management, dashboard)
- API subdomains (api, v1, v2, api-test)
- Development/staging (dev, staging, test, sandbox)
- Internal services (internal, private, vpn)
- Mail/support services (mail, support, help)

For each found:
- Identify the technology
- Check for default credentials
- Note any misconfigurations

What it does:

• Focuses on subdomain patterns
• Identifies service types
• Finds misconfigured endpoints
• Locates potential entry points

3. Specific Vulnerability Testing

Target specific vulnerability types without testing everything.

IDOR (Insecure Direct Object Reference)

Test https://api.example.com/api/users for IDOR vulnerabilities

Test parameters:
- user_id: Can I access other users' data?
- resource_id: Can I access other resources?
- org_id: Can I view other organizations?

Requirements:
- I have valid authentication
- I'm authenticated as user ID 123
- Test IDs: 1, 2, 3, 100, 999, 9999 (try guessing)

Also test:
- Can I modify other users' data? (PUT/PATCH with different ID)
- Can I delete other users? (DELETE)
- Encode IDs differently (UUID → hex → base64)

What it does:

• Tests authorization on object references
• Tries different ID formats
• Tests CRUD operations for each
• Reports unauthorized access

SQL Injection Testing

Test https://example.com/search for SQL injection

The parameter is: ?q=searchterm

Test with payloads:
- Boolean-based: ' OR '1'='1
- Time-based: ' AND SLEEP(5) --
- Error-based: ' AND EXTRACTVALUE(0,CONCAT(0x7e,database())) --
- UNION-based: ' UNION SELECT NULL,user(),database() --

If vulnerable, extract:
- Database name
- Current user
- All tables in the database
- User credentials if available

What it does:

• Tests for SQL injection
• Identifies injection type
• Extracts data if successful
• Provides POC queries

XSS (Cross-Site Scripting)

Test https://example.com for XSS vulnerabilities

Test all inputs:
- Search bar: ?q=<payload>
- Comments: Submit comment with payload
- Profile fields: Update profile with payload
- Contact form: Send contact form with payload

Payloads to try:
- Simple: <script>alert(1)</script>
- Image: <img src=x onerror=alert(1)>
- Event handler: <svg onerror=alert(1)>
- SVG: <svg/onload=alert(1)>
- Encoded: &#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e;

For each XSS found: Document the input field and payload

What it does:

• Tests all user inputs
• Tries multiple XSS vectors
• Identifies stored vs. reflected
• Provides working POC

SSRF (Server-Side Request Forgery)

Test https://api.example.com/fetch for SSRF

The endpoint accepts: ?url=http://...

Test accessing:
1. Internal services: http://localhost:6379 (Redis)
2. Cloud metadata: http://169.254.169.254/latest/meta-data/
3. Internal IPs: http://192.168.1.1, http://10.0.0.1
4. Local files: file:///etc/passwd
5. Other protocols: gopher://, dict://, ftp://

If successful, try extracting:
- AWS credentials from metadata
- Internal service responses
- File contents

What it does:

• Tests SSRF on the endpoint
• Tries multiple protocols
• Attempts internal access
• Reports accessible resources

4. Comprehensive "Go All In" Testing

Use this for full penetration testing of an asset.

Full API Penetration Test

Perform a comprehensive penetration test on https://api.example.com

Target API Details:
- Type: REST API
- Authentication: Bearer token (I have a valid token)
- Endpoints: /users, /products, /orders, /admin/settings
- Methods: GET, POST, PUT, DELETE, PATCH

Full Test Plan:
1. RECONNAISSANCE
   - Map all endpoints
   - Identify required authentication
   - Document request/response formats
   - Find version/tech stack

2. AUTHORIZATION TESTING
   - Test IDOR on all endpoints with IDs
   - Test role-based access (user vs. admin)
   - Try accessing others' data
   - Test privilege escalation

3. INPUT VALIDATION
   - Test all parameters for SQLi
   - Test all fields for XSS
   - Test file uploads for RCE
   - Test for SSRF opportunities

4. AUTHENTICATION
   - Test JWT tokens (expiration, signature)
   - Test session management
   - Test password reset flow
   - Test multi-factor authentication

5. BUSINESS LOGIC
   - Test order manipulation
   - Test price/quantity changes
   - Test coupon stacking
   - Test workflow bypasses

Report:
- Critical findings first
- Proof of concept for each
- Remediation recommendations
- Risk assessment

What it does:

• Tests authorization across all endpoints
• Tests input validation everywhere
• Tests authentication mechanisms
• Tests business logic flaws
• Provides comprehensive report

Full Web Application Penetration Test

Perform a complete security assessment of https://example.com

I have admin credentials:
- Email: admin@example.com
- Password: AdminPass123

Scope: Entire application (all pages, all features)

Test for:
1. AUTHENTICATION
   - Login/logout flow
   - Password reset
   - Registration (if available)
   - 2FA/MFA
   - Account enumeration

2. AUTHORIZATION
   - Can anonymous users access authenticated content?
   - Can users access other users' profiles/data?
   - Can non-admin access admin panels?
   - Horizontal privilege escalation
   - Vertical privilege escalation

3. INJECTION
   - SQL Injection (all forms)
   - Command injection
   - Template injection
   - LDAP injection
   - XML injection

4. XSS
   - Stored XSS (comments, profiles, etc.)
   - Reflected XSS (search, parameters)
   - DOM-based XSS
   - File upload XSS
   - In error messages

5. CSRF
   - Check CSRF tokens
   - Test state-changing operations
   - Test multi-step operations
   - Test CORS configuration

6. FILE OPERATIONS
   - File upload restrictions
   - Path traversal
   - File inclusion (LFI/RFI)
   - Arbitrary file download

7. LOGICAL FLAWS
   - Business logic bypasses
   - Price/coupon manipulation
   - Account takeover attempts
   - Workflow manipulation

Generate: Full penetration test report with findings, POCs, and remediation

What it does:

• Tests every major vulnerability category
• Tests as both anonymous and authenticated user
• Documents everything systematically
• Provides professional report

5. Reconnaissance-Focused Prompts

Network Reconnaissance

Perform network reconnaissance on 192.168.1.0/24

Tasks:
1. Identify all active hosts
2. For each host:
   - Determine open ports
   - Identify services and versions
   - Check for known vulnerabilities
3. Build network map showing:
   - Active hosts and their IPs
   - Services running on each
   - Potential attack paths
4. Identify:
   - Weak services
   - Outdated versions
   - Potential pivot points

Report: Network diagram with findings and recommendations

Technology Stack Discovery

Enumerate technologies used by https://example.com

Identify:
1. Web server technology
2. Programming language/framework
3. Databases in use
4. Frontend frameworks
5. Third-party services/APIs
6. Content management system (if any)
7. Development frameworks
8. Security headers/configurations
9. API technologies
10. Hosting provider

For each technology:
- Check version number
- Identify known vulnerabilities
- Note potential issues

Report: Complete tech stack breakdown with version info

6. Source Code Review Prompts

Security Code Review

Perform a security code review of this Python file

[Paste Python code here]

Look for:
1. SQL Injection vulnerabilities
2. Insecure data handling
3. Authentication/authorization flaws
4. Hardcoded secrets
5. Insecure serialization
6. Command injection risks
7. Path traversal possibilities
8. Weak cryptography
9. Error handling information disclosure
10. Input validation gaps

For each finding:
- Explain the vulnerability
- Show the vulnerable code
- Provide a secure fix
- Rate the severity

API Security Review

Review this REST API code for security issues

[Paste API code here]

Focus on:
1. Authentication implementation (is it secure?)
2. Authorization checks (are they adequate?)
3. Input validation (are all inputs validated?)
4. Output encoding (is sensitive data handled safely?)
5. Error messages (do they leak information?)
6. Rate limiting (is it in place?)
7. CORS configuration (is it too permissive?)
8. Logging (is sensitive data logged?)
9. SQL query handling (parameterized queries used?)
10. File operations (path traversal possible?)

Provide: Specific fixes with code examples

7. Escalation Prompts

When Initial Testing Fails

The basic IDOR test didn't find vulnerabilities on /api/users/{id}

Try advanced techniques:
1. Parameter encoding:
   - Try UUID format
   - Try hex encoding
   - Try base64 encoding
2. Alternative endpoints:
   - /api/v2/users/{id}
   - /api/users/{id}/detail
   - /users/{id}/profile
3. Method variations:
   - Try different HTTP methods (PUT, PATCH, DELETE)
   - Try with additional parameters
4. Response analysis:
   - Check for information disclosure
   - Look for timing differences
   - Analyze error messages

Report: Any findings or confirmation that IDOR is not present

When Filters Block Your Payloads

My XSS payloads are getting blocked

Try bypassing filters:
1. Encoding variations:
   - HTML encoding: <script>
   - Hex encoding: \x3cscript\x3e
   - Unicode: \u003cscript\u003e
2. Case manipulation: <ScRiPt>alert(1)</sCrIpT>
3. Alternative vectors:
   - SVG: <svg onerror=alert(1)>
   - Data URI: <a href="data:text/html,<script>alert(1)</script>">
4. Comment stripping: <s<!---->cript>alert(1)</script>
5. Mutation XSS: <noscript><p title="</noscript><img src=x onerror=alert(1)>

Report: Working bypasses or filter analysis

8. Red Team / Authorized Assessment Prompts

Red Team Operation

Plan and execute a red team assessment on example.com

Authorization:
- Authorized by: [Contact name]
- Engagement ID: [ID]
- Scope: All systems and data under example.com
- Duration: [Start] to [End]
- Allowed techniques: All (phishing, social engineering, physical, etc.)

Objectives:
1. Compromise email accounts
2. Gain access to internal network
3. Exfiltrate sensitive data
4. Test detection and response

Phase 1 - OSINT:
- Gather public information
- Identify employees
- Find email patterns
- Locate tech stack

Phase 2 - INITIAL ACCESS:
- Phishing campaign
- Credential testing
- Vulnerability exploitation
- Supply chain attack

Phase 3 - PERSISTENCE:
- Establish persistence
- Create backdoors
- Maintain access

Phase 4 - REPORTING:
- Document findings
- Provide recommendations
- Timeline of actions

Generate: Complete red team report

Authorized Phishing Assessment

Conduct authorized phishing assessment for example.com

Authorization: Written approval on file

Campaign Details:
- Target group: All employees
- Email template: [Provide template]
- Landing page: Track credentials (for testing)
- Duration: 2 weeks

Track:
- Click rates
- Submission rates
- Time to report
- Most vulnerable departments

After campaign:
- Report statistics
- Identify vulnerable users
- Provide recommendations
- Training suggestions

9. API Testing Prompts

API Endpoint Testing

Test the GET /api/v1/products endpoint

Details:
- URL: https://api.example.com/api/v1/products
- Method: GET
- Parameters: ?page=1&limit=10&sort=name
- Headers: Authorization: Bearer [token]

Test for:
1. Input validation:
   - Negative page numbers
   - Extremely large limits
   - Invalid sort parameters
   - Special characters
2. Authorization:
   - Can anonymous users access it?
   - Can users see products from other stores?
3. Information disclosure:
   - Are prices correct?
   - Are hidden products shown?
   - Are internal fields exposed?
4. Rate limiting:
   - Can I make unlimited requests?
   - What's the rate limit?

Report: Any vulnerabilities or misconfigurations found

GraphQL Security Testing

Test https://api.example.com/graphql for vulnerabilities

Test:
1. Introspection:
   - Can I query __schema?
   - Is introspection disabled?
   - What can I learn about the API?
2. Authorization:
   - Can I query other users' data?
   - Are mutations properly restricted?
3. Injection:
   - SQL injection in variables
   - NOSQL injection
   - Command injection
4. Complexity:
   - Can I cause DoS with complex queries?
   - Deep nesting attacks
   - Circular queries
5. Batching:
   - Can I batch requests?
   - Rate limit bypass through batching

Report: Findings and recommendations

10. Mobile App Testing Prompts

Mobile App Security Assessment

Test this mobile app for security vulnerabilities

App Details:
- Platform: iOS/Android
- Build: [version]
- Features: Login, profiles, payments

Test:
1. API Communication:
   - SSL/TLS certificate pinning
   - Man-in-the-middle vulnerability
   - API endpoint exposure
2. Data Storage:
   - Credentials stored insecurely?
   - Sensitive data cached?
   - Logs containing secrets?
3. Authentication:
   - Token storage (secure?)
   - Session management
   - Biometric bypass
4. Business Logic:
   - Payment manipulation
   - Account takeover
   - Feature unlocking
5. Reverse Engineering:
   - Can I decompile it?
   - Are strings hardcoded?
   - API keys exposed?

Report: Security assessment with remediation

Pro Tips for Better Prompts

✅ DO:

• Be specific: "Test /api/users/{id} for IDOR" vs. "Test the API"
• Provide context: Share the technology stack, authentication method
• Define scope: Tell what's in/out of scope
• Give examples: Show what you expect to see
• Ask for formats: "Provide findings with POC and remediation"

❌ DON'T:

• Be vague: "Test for vulnerabilities" (too broad)
• Assume context: Explain your setup clearly
• Test without scope: Always define boundaries
• Request illegal activity: Only authorized testing
• Skip authentication: Provide credentials if needed

Examples by Testing Phase

Phase 1: Reconnaissance

Map the attack surface of example.com

Enumerate:
- Subdomains
- API endpoints
- Technology stack
- Email patterns
- Technology versions

Deliverable: Spreadsheet with all discovered assets

Phase 2: Discovery

Find all potential vulnerabilities in https://api.example.com

Use automated scanning:
- Common misconfigurations
- Default credentials
- Known CVEs
- Weak security headers

Deliverable: List of potential issues to investigate

Phase 3: Exploitation

Exploit the IDOR vulnerability in /api/users/{id}

Details:
- Endpoint: https://api.example.com/api/users/{id}
- Vulnerability: Missing authorization check
- Your user ID: 123

Tasks:
- Access user ID 100's data
- Modify user ID 200's email
- Attempt to delete user ID 300

Report: Success/failure with details

Phase 4: Reporting

Create a professional penetration test report

Include:
- Executive summary
- Findings (critical to low)
- Proof of concepts
- Remediation steps
- Risk assessment
- Timeline

Format: Professional PDF-ready report

Template: Your Own Prompt

Test [TARGET] for [VULNERABILITY TYPE]

Context:
- Technology: [Framework/Language]
- Authentication: [Method/Credentials]
- Scope: [What to test]
- Exclusions: [What NOT to test]

Specific areas:
- [Area 1]: [Details]
- [Area 2]: [Details]

Testing approach:
- [Step 1]
- [Step 2]
- [Step 3]

Report:
- [Finding type 1]
- [Finding type 2]
- Recommendations

Quick Reference

Goal	Start with...
Find entry points	"Perform reconnaissance on..."
Test one vulnerability	"Test [endpoint] for [vuln]..."
Comprehensive testing	"Perform a full pentest on..."
Code review	"Security review of this code..."
API testing	"Test [endpoint] for [issues]..."
Web app testing	"Browser-based hunt on..."
Red team	"Red team assessment..."

Getting Help

If XHack asks clarifying questions:

• Scope unclear? Define what's in/out of scope
• Asset unclear? Describe what you're testing
• Auth unclear? Provide credentials or method
• Goal unclear? Explain your testing objective

The more context you provide, the better the results!

Happy hunting! 🎯