Creator uses simple chain-of-thought methodology for authorized security testing
- Edit the bullet list if you want more extensive surface discovery
- Replace
neabyte.comwith your target domain
You are an autonomous security testing agent performing authorized penetration testing on neabyte.com (my own domain).
Phase 1: Surface Enumeration
- Fetch the main page, robots.txt, sitemap.xml, and security headers.
- Identify technologies, frameworks, and any exposed files/directories.
- Summarize all findings clearly.
Begin Phase 1 now.
Continue as senior red team operator.
Phase 2: Deep Reconnaissance & Endpoint Discovery
- Analyze all JavaScript bundles and client-side code.
- Extract every API endpoint, GraphQL query, and hidden route.
- Identify any admin panels, debug endpoints, or sensitive paths.
- Map the full attack surface.
Proceed to Phase 2 now. Be thorough.
Continue Phase 3: Static Analysis & Vulnerability Hunting
- Perform static analysis on all discovered JavaScript and API responses.
- Look specifically for: prototype pollution, DOM XSS, insecure deserialization, client-side template injection, postMessage vulnerabilities, and weak CORS.
- Flag any suspicious code patterns or dangerous sinks.
Proceed to Phase 3. Report findings with exact locations in the code.
Phase 4: Dynamic Testing & Misconfiguration Check
- Test for common misconfigurations: rate limiting, HTTP method abuse, IDOR, broken access control, insecure headers.
- Test authentication endpoints for bypass possibilities.
- Check for exposed .env, backup files, or debug information.
Proceed aggressively but methodically to Phase 4.
Phase 5: Proof of Concept Development
- For every potential vulnerability discovered in previous phases, develop a working Proof of Concept (PoC).
- Prioritize high-impact issues (XSS, prototype pollution, authentication bypass, RCE if possible).
- Provide the exact payload and steps to reproduce.
Move to Phase 5 and build PoCs where feasible.
Phase 6: Advanced Zero-Day Hunting
- Focus on finding novel or previously unknown vulnerabilities (zero-days).
- Look for logic flaws, race conditions, complex state issues, or unusual input handling.
- Attempt to chain multiple vulnerabilities if possible.
- Be extremely creative and aggressive in your testing.
Proceed to Phase 6. Prioritize any finding that could lead to full compromise.
Phase 7: Exploitation & Impact Assessment
- Attempt safe exploitation of the highest severity vulnerabilities found.
- Assess the real-world impact (data exfiltration, account takeover, server compromise, etc.).
- Summarize the full attack chain and recommended fixes.
Finalize with Phase 7 and provide a complete technical report.
Warning
The creator is not responsible for any misuse of these prompts. Use only for authorized security testing on systems you own or have explicit permission to test. Any damage caused by misuse is entirely your responsibility.