bb-local-toolkit

Name: bb-local-toolkit
Author: elementalsouls

78installs461forks

How to install bb-local-toolkit?

elementalsouls/claude-bughunter/bb-local-toolkit

$npx -y skills add elementalsouls/Claude-BugHunter --skill bb-local-toolkit

Installs into the current project.

Summary

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, gha

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Master Workflow
2
3	Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.
4
5	## THE ONLY QUESTION THAT MATTERS
6
7	> "Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"
8	>
9	> If the answer is NO -- STOP. Do not write. Do not explore further. Move on.
10
11	### Theoretical Bug = Wasted Time. Kill These Immediately:
12
13	\| Pattern \| Kill Reason \|
14	\|---\|---\|
15	\| "Could theoretically allow..." \| Not exploitable = not a bug \|
16	\| "An attacker with X, Y, Z conditions could..." \| Too many preconditions \|
17	\| "Wrong implementation but no practical impact" \| Wrong but harmless = not a bug \|
18	\| Dead code with a bug in it \| Not reachable = not a bug \|
19	\| Source maps without secrets \| No impact \|
20	\| SSRF with DNS-only callback \| Need data exfil or internal access \|
21	\| Open redirect alone \| Need ATO or OAuth chain \|
22	\| "Could be used in a chain if..." \| Build the chain first, THEN report \|
23
24	You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.
25
26	---
27
28	## CRITICAL RULES
29
30	1. READ FULL SCOPE FIRST -- verify every asset/domain is owned by the target org
31	2. NO THEORETICAL BUGS -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.
32	3. KILL WEAK FINDINGS FAST -- run the 7-Question Gate BEFORE writing any report
33	4. Validate before writing -- check CHANGELOG, design docs, deployment scripts FIRST
34	5. One bug class at a time -- go deep, don't spray
35	6. Verify data isn't already public -- check web UI in incognito before reporting API "leaks"
36	7. 5-MINUTE RULE -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON
37	8. IMPACT-FIRST HUNTING -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target
38	9. CREDENTIAL LEAKS need exploitation proof -- finding keys isn't enough, must PROVE what they access
39	10. STOP SHALLOW RECON SPIRALS -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere
40	11. BUSINESS IMPACT over vuln class -- severity depends on CONTEXT, not just vuln type
41	12. UNDERSTAND THE TARGET DEEPLY -- before hunting, learn the app like a real user
42	13. DON'T OVER-RELY ON AUTOMATION -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds
43	14. HUNT LESS-SATURATED VULN CLASSES -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks
44	15. ONE-HOUR RULE -- stuck on one target for an hour with no progress? SWITCH CONTEXT
45	16. TWO-EYE APPROACH -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior)
46	17. T-SHAPED KNOWLEDGE -- go DEEP in one area and BROAD across everything else
47
48	> For the full hunting methodology — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see `skills/bb-methodology/SKILL.md`.
49
50	---
51
52	## A->B

People who liked this also viewed

6 picks

Type

bb-local-toolkit

78installs461forks

View on GitHub

How to install bb-local-toolkit?

elementalsouls/claude-bughunter/bb-local-toolkit

$npx -y skills add elementalsouls/Claude-BugHunter --skill bb-local-toolkit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Master Workflow
2
3	Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.
4
5	## THE ONLY QUESTION THAT MATTERS
6
7	> "Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"
8	>
9	> If the answer is NO -- STOP. Do not write. Do not explore further. Move on.
10
11	### Theoretical Bug = Wasted Time. Kill These Immediately:
12
13	\| Pattern \| Kill Reason \|
14	\|---\|---\|
15	\| "Could theoretically allow..." \| Not exploitable = not a bug \|
16	\| "An attacker with X, Y, Z conditions could..." \| Too many preconditions \|
17	\| "Wrong implementation but no practical impact" \| Wrong but harmless = not a bug \|
18	\| Dead code with a bug in it \| Not reachable = not a bug \|
19	\| Source maps without secrets \| No impact \|
20	\| SSRF with DNS-only callback \| Need data exfil or internal access \|
21	\| Open redirect alone \| Need ATO or OAuth chain \|
22	\| "Could be used in a chain if..." \| Build the chain first, THEN report \|
23
24	You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.
25
26	---
27
28	## CRITICAL RULES
29
30	1. READ FULL SCOPE FIRST -- verify every asset/domain is owned by the target org
31	2. NO THEORETICAL BUGS -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.
32	3. KILL WEAK FINDINGS FAST -- run the 7-Question Gate BEFORE writing any report
33	4. Validate before writing -- check CHANGELOG, design docs, deployment scripts FIRST
34	5. One bug class at a time -- go deep, don't spray
35	6. Verify data isn't already public -- check web UI in incognito before reporting API "leaks"
36	7. 5-MINUTE RULE -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON
37	8. IMPACT-FIRST HUNTING -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target
38	9. CREDENTIAL LEAKS need exploitation proof -- finding keys isn't enough, must PROVE what they access
39	10. STOP SHALLOW RECON SPIRALS -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere
40	11. BUSINESS IMPACT over vuln class -- severity depends on CONTEXT, not just vuln type
41	12. UNDERSTAND THE TARGET DEEPLY -- before hunting, learn the app like a real user
42	13. DON'T OVER-RELY ON AUTOMATION -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds
43	14. HUNT LESS-SATURATED VULN CLASSES -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks
44	15. ONE-HOUR RULE -- stuck on one target for an hour with no progress? SWITCH CONTEXT
45	16. TWO-EYE APPROACH -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior)
46	17. T-SHAPED KNOWLEDGE -- go DEEP in one area and BROAD across everything else
47
48	> For the full hunting methodology — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see `skills/bb-methodology/SKILL.md`.
49
50	---
51
52	## A->B

People who liked this also viewed

6 picks

Type