hunting-bug-variants

# Hunting bug variants: one seed, every sibling One bug is almost never alone. The same mistake gets copy-pasted, re-implemented by a second author, or left uncovered by a fix that only patched the reported call site. Variant hunting takes a *single confirmed defect* and turns it into a signature you can sweep the whole codebase with, so you find the three other copies before an attacker does. ## When to use - You just confirmed a bug and want its siblings, not a victory lap. - A CVE, advisory, or writeup describes a bug in code you can read. - A fix landed and you want to know whether it covered every instance. - Someone says "we already patched that" and you want to verify it is really gone. ## Scope check Authorized source only (your own, OSS, CTF, in-scope engagement). If you can't name the authorization, stop. ## The loop 1. **Anchor the seed.** State the confirmed defect precisely: the exact sink, the exact missing or wrong step (no bounds check, no authz check, unnormalized path, unescaped context), and the untrusted input that drives it. A vague seed ("there was an injection somewhere") produces a useless sweep. 2. **Extract the shape, not the string.** Abstract the seed into a structural signature that survives renaming and reformatting. Usually one of: *this sink called without that guard*; *this unsafe idiom* (raw concat into a query, `base / user_name` without resolve-and-contain); *this type of value reaching this argument*. Grepping ...