bb-methodology

Name: bb-methodology
Author: elementalsouls

89installs461forks

How to install bb-methodology?

elementalsouls/claude-bughunter/bb-methodology

$npx -y skills add elementalsouls/Claude-BugHunter --skill bb-methodology

Installs into the current project.

Summary

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Methodology: Workflow + Mindset
2
3	Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest.
4
5	---
6
7	## PART 0: MODE CONFIRMATION (Before Anything Else)
8
9	Confirm the engagement type before deciding what counts as a finding. The same target produces a different report shape depending on which mode applies. Getting this wrong is the single biggest waste of time in this workflow — answer it explicitly before Phase 0.
10
11	\| Engagement type \| What counts as a finding \| What gets rejected \|
12	\|---\|---\|---\|
13	\| Bug bounty (H1 / Bugcrowd / Intigriti / private VDP) \| Impact-demonstrated bugs ONLY. Full chain to attacker-attainable harm. \| Hygiene (EoL software alone, permissive CSP alone, stack traces, info disclosure without concrete impact, "best practice" violations) \|
14	\| Red team (external client engagement) \| Hygiene findings + recon + IoCs + defensive-state observations are ALL deliverables \| Nothing — even "no finding here" is reportable as a positive defensive observation \|
15	\| Pentest (signed SoW / WAPT) \| Depends on SoW. Read scope explicitly. Usually accepts hygiene + impact + recon \| Out-of-scope assets, unsigned testing \|
16	\| Internal audit \| Compliance-mapped findings (PCI / ISO / NIST / DPDPA / GDPR) \| Findings without a control-mapping \|
17
18	Hard rule: Before Phase 0 runs, write the engagement type as the first line in your hunt notes. If you can't answer it from the user's instruction, ASK once. Don't assume — the mistake costs both you and the triager.
19
20	Lesson from an authorized engagement: First-pass on this target produced 5 hygiene findings (SP2013 EoL, permissive CSP, stack traces) shipped in red-team format. The engagement was bug-bounty. Findings would have been N/A'd as "informational, no impact demonstrated." After the corrected pass with hygiene-as-context-not-finding, the same target yielded 11 impact-demonstrated bugs including 3 Critical.
21
22	---
23
24	## PART 1: MINDSET (How to Think)
25
26	### Core Principle
27
28	Hunting is not "find a bug" -- it is "prove an attack scenario." Think like an attacker with a specific goal, not a scanner looking for patterns.
29
30	### Daily Discipline: Define, Select, Execute
31
32	Before touching any tool:
33
34	1. Define: "Today I target [feature/domain] to achieve [CIA impact]"
35	2. Select: Choose 1-2 vuln classes (IDOR, Race Condition, etc.)
36	3. Execute: Focus ONLY on selected techniques. No wandering.
37
38	### 5 Ultimate Goals (Pick One Per Session)
39
40	1. Confidentiality -- steal data the attacker shouldn't see
41	2. Integrity -- modify data the attacker shouldn't change
42	3. Availability -- disrupt service (app-level DoS only)
43	4. Account Takeover -- control another user's account
44	5. RCE -- execute commands on the server
45
46	### 4 Thinking Domains
47
48	#### 1. Critical Thinking (deep analysis)
49
50	Question trust boundaries:
51	- Frontend control disabled? Send request directly via proxy
52	- `user_role=user` cookie? Change to `admin`
53	- `price=1000` in POST? Change to `1`
54	- `<script>` blocked? Try `<img onerror=...>`
55
56	Reverse-engineer developer psychology:
57	- Feature A has auth checks -> Similar feature B (newly added) probably doesn't
58	- Complex flows (coupon + points + refund) -> Edge cases have bugs
59	- `/api/v2/user` exists -> Does `/api/v1/user` still work with weaker auth?
60
61	What-If experiments:
62	- Skip checkout -> hit `/checkout/success` directly
63	- Skip 2FA -> navigate to `/dashboard`
64	- Send coupon request 10x simultaneously -> Race condition?
65	- Replace `guid=f8a2...` with `id=100` on sibling endpoint -> IDOR?
66
67	#### 2. Multi-Perspective (multiple angles)
68
69	\| Perspective \| What to check \|
70	\|------------\|---------------\|
71	\| Horizontal (same role) \| User A's token + User B's ID -> IDOR \|
72	\| Vertical (different role) \| Regular user -> `/admin/deleteUser` \|
73	\| Data flow (proxy view) \| Hidden params in JSON: `debug=false`, `discount_rate` \|
74	\| Time/State \| Race conditions, post-delete session reuse \|
75	\| Client environment \| Mobile UA -> legacy API with weaker auth \|
76	\| Business impact \| "What's the $ damage if this breaks?" \|
77
78	#### 3. Tactical Thinking (pattern detection)
79
80	- Naming anomaly: `userId` everywhere but suddenly `user_id` -> different dev, weaker security
81	- Error diff: Same 403 but different JSON structure -> different backend systems
82	- Environment diff: Prod vs Dev/Staging -> debug headers, CSP disabled
83	- Version diff: JS file before/after update -> new endpoin

People who liked this also viewed

6 picks

Type

bb-methodology

89installs461forks

View on GitHub

How to install bb-methodology?

elementalsouls/claude-bughunter/bb-methodology

$npx -y skills add elementalsouls/Claude-BugHunter --skill bb-methodology

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Methodology: Workflow + Mindset
2
3	Master orchestrator for hunting sessions. Combines the 5-phase non-linear workflow with the critical thinking framework that separates top 1% hunters from the rest.
4
5	---
6
7	## PART 0: MODE CONFIRMATION (Before Anything Else)
8
9	Confirm the engagement type before deciding what counts as a finding. The same target produces a different report shape depending on which mode applies. Getting this wrong is the single biggest waste of time in this workflow — answer it explicitly before Phase 0.
10
11	\| Engagement type \| What counts as a finding \| What gets rejected \|
12	\|---\|---\|---\|
13	\| Bug bounty (H1 / Bugcrowd / Intigriti / private VDP) \| Impact-demonstrated bugs ONLY. Full chain to attacker-attainable harm. \| Hygiene (EoL software alone, permissive CSP alone, stack traces, info disclosure without concrete impact, "best practice" violations) \|
14	\| Red team (external client engagement) \| Hygiene findings + recon + IoCs + defensive-state observations are ALL deliverables \| Nothing — even "no finding here" is reportable as a positive defensive observation \|
15	\| Pentest (signed SoW / WAPT) \| Depends on SoW. Read scope explicitly. Usually accepts hygiene + impact + recon \| Out-of-scope assets, unsigned testing \|
16	\| Internal audit \| Compliance-mapped findings (PCI / ISO / NIST / DPDPA / GDPR) \| Findings without a control-mapping \|
17
18	Hard rule: Before Phase 0 runs, write the engagement type as the first line in your hunt notes. If you can't answer it from the user's instruction, ASK once. Don't assume — the mistake costs both you and the triager.
19
20	Lesson from an authorized engagement: First-pass on this target produced 5 hygiene findings (SP2013 EoL, permissive CSP, stack traces) shipped in red-team format. The engagement was bug-bounty. Findings would have been N/A'd as "informational, no impact demonstrated." After the corrected pass with hygiene-as-context-not-finding, the same target yielded 11 impact-demonstrated bugs including 3 Critical.
21
22	---
23
24	## PART 1: MINDSET (How to Think)
25
26	### Core Principle
27
28	Hunting is not "find a bug" -- it is "prove an attack scenario." Think like an attacker with a specific goal, not a scanner looking for patterns.
29
30	### Daily Discipline: Define, Select, Execute
31
32	Before touching any tool:
33
34	1. Define: "Today I target [feature/domain] to achieve [CIA impact]"
35	2. Select: Choose 1-2 vuln classes (IDOR, Race Condition, etc.)
36	3. Execute: Focus ONLY on selected techniques. No wandering.
37
38	### 5 Ultimate Goals (Pick One Per Session)
39
40	1. Confidentiality -- steal data the attacker shouldn't see
41	2. Integrity -- modify data the attacker shouldn't change
42	3. Availability -- disrupt service (app-level DoS only)
43	4. Account Takeover -- control another user's account
44	5. RCE -- execute commands on the server
45
46	### 4 Thinking Domains
47
48	#### 1. Critical Thinking (deep analysis)
49
50	Question trust boundaries:
51	- Frontend control disabled? Send request directly via proxy
52	- `user_role=user` cookie? Change to `admin`
53	- `price=1000` in POST? Change to `1`
54	- `<script>` blocked? Try `<img onerror=...>`
55
56	Reverse-engineer developer psychology:
57	- Feature A has auth checks -> Similar feature B (newly added) probably doesn't
58	- Complex flows (coupon + points + refund) -> Edge cases have bugs
59	- `/api/v2/user` exists -> Does `/api/v1/user` still work with weaker auth?
60
61	What-If experiments:
62	- Skip checkout -> hit `/checkout/success` directly
63	- Skip 2FA -> navigate to `/dashboard`
64	- Send coupon request 10x simultaneously -> Race condition?
65	- Replace `guid=f8a2...` with `id=100` on sibling endpoint -> IDOR?
66
67	#### 2. Multi-Perspective (multiple angles)
68
69	\| Perspective \| What to check \|
70	\|------------\|---------------\|
71	\| Horizontal (same role) \| User A's token + User B's ID -> IDOR \|
72	\| Vertical (different role) \| Regular user -> `/admin/deleteUser` \|
73	\| Data flow (proxy view) \| Hidden params in JSON: `debug=false`, `discount_rate` \|
74	\| Time/State \| Race conditions, post-delete session reuse \|
75	\| Client environment \| Mobile UA -> legacy API with weaker auth \|
76	\| Business impact \| "What's the $ damage if this breaks?" \|
77
78	#### 3. Tactical Thinking (pattern detection)
79
80	- Naming anomaly: `userId` everywhere but suddenly `user_id` -> different dev, weaker security
81	- Error diff: Same 403 but different JSON structure -> different backend systems
82	- Environment diff: Prod vs Dev/Staging -> debug headers, CSP disabled
83	- Version diff: JS file before/after update -> new endpoin

People who liked this also viewed

6 picks

Type