---
name: hunt-bug-bank-entry
description: Apply one bug-bank entry across every engagement - learn the bug from the finding that proved it, find the hosts that run the product, test each one in scope, and record every hit as a finding and every tested host as a test. Use for each entry of a bug-bank scan, and whenever asked to hunt or apply a bank entry across engagements.
---

# Hunt a bug-bank entry

1. Learn the bug. `toadcli bug show BUG_ID` gives its detail and the findings that proved it. Read the source finding with `toadcli --in ENGAGEMENT finding show ID`, its report and its PoC (`finding attachment ARTEFACT_ID -o FILE`), and the original hunter's traffic with `toadcli traffic TARGET` and `toadcli x ID`. Work out from the detector's `fingerprint()`, the PoC and that traffic how to recognise the product and what proves the bug. Never reuse that engagement's accounts, credentials or tokens anywhere else.
2. Find where it runs. Recorded technologies (`toadcli --in DATABASE bug match`, or SQL over each engagement's `technologies`) are a shortcut; much of the product is unrecorded. Search every engagement's traffic for its traces (`traffic --grep`, `traffic --header`, then narrowed `search body`), and fingerprint in-scope hosts directly, including hosts with no recorded technology. Record what you identify with `toadcli --in DATABASE tech add`.
3. Before testing a host, check `host_test_results` for an earlier result titled with the bug ID, then that engagement's scope, `zero_day_policy` and gateway, as the live testing rules require.
4. Test it. Run the entry's detector when it has one (`toadcli bug detector BUG_ID -o FILE`, then `uv run --script FILE --target ORIGIN --header 'HEADER'`), otherwise adapt the source PoC to the host. A fingerprint-only detector, one without `vulnerable()`, only recognises the product: its matches still need the source PoC. Prove impact without changing or destroying data.
5. Record it. A hit becomes a finding in the host's engagement, with its evidence linked: check `global_findings` and that engagement's findings for the same root cause first. It is validated there automatically. Record every host you tested, hit or miss, with `toadcli --in DATABASE test add TARGET --title "BUG_ID: <outcome>" --detail TEXT`, so later hunts skip it.
6. In a scan, when your share runs out before the limit, look harder: more hosts that could run the product, unrecorded versions, and variants of the bug in the same product.