Hunter – Optimize your Pentesters Time
summary
Open-source tool called Hunter grades HTTP/REST endpoints A–F grade using a Python/Django backend and sslyze to check TLS and cipher details, HTTP security headers, CSP for unsafe-eval, and cookie flags. Scans return results under 30 seconds and the team enforces an A as a prerequisite before engaging full pentesters, cutting low-risk noise that consumed >25% of pentest effort and claiming about 10–15% budget savings while freeing testers for business-logic flaws.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 1:20What is a Pentest
- 1:40External vs Internal
- 2:16Pentest Team
- 2:51Engagement
- 3:32Security
- 4:10scoping call
- 4:22system
- 4:48walkthrough
- 5:27internal systems
- 7:28final reports
- 7:52business logic flaws
- 8:28how do you optimize
- 9:08evangelize
- 10:08no more fancy tools
- 10:19easy to use
- 10:56what is hunter
- 11:23what is hunter not
- 11:52SSL Versions
- 12:41ILook Architecture
- 13:15Frontend UI
- 14:03HTTP endpoint
- 15:34Local host
- 16:18Test Site
- 16:52Security Headers
- 17:10MidLevel Rating
- 17:31Headers
- 17:45Policy
- 19:30Scoring Model
- 20:21CSP Policy
- 21:09Cipher List
- 22:07Legacy Applications
- 24:03Pentest Results
- 24:58Impact of Prereqs
- 26:23More Slides
- 27:22Future Plans
- 28:30Outro
related talks
44mHUNT: Data Driven Web Hacking & Manual Testing
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
08mAutomated Security Testing for JS Apps & Underlying APIs
23mHack Your Cybersecurity Career: Your Role in the Ecosystem
50mA CISO's Best Friend: The Pentester
09mAutomated Application Security Testing