bug-bounty

Name: bug-bounty
Author: elementalsouls

3.0kstars461forks

How to install bug-bounty?

elementalsouls/claude-bughunter/bug-bounty

$npx -y skills add elementalsouls/Claude-BugHunter --skill bug-bounty

Installs into the current project.

Summary

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, ra

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Master Workflow
2
3	Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.
4
5	## THE ONLY QUESTION THAT MATTERS
6
7	> "Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"
8	>
9	> If the answer is NO -- STOP. Do not write. Do not explore further. Move on.
10
11	### Theoretical Bug = Wasted Time. Kill These Immediately:
12
13	\| Pattern \| Kill Reason \|
14	\|---\|---\|
15	\| "Could theoretically allow..." \| Not exploitable = not a bug \|
16	\| "An attacker with X, Y, Z conditions could..." \| Too many preconditions \|
17	\| "Wrong implementation but no practical impact" \| Wrong but harmless = not a bug \|
18	\| Dead code with a bug in it \| Not reachable = not a bug \|
19	\| Source maps without secrets \| No impact \|
20	\| SSRF with DNS-only callback \| Need data exfil or internal access \|
21	\| Open redirect alone \| Need ATO or OAuth chain \|
22	\| "Could be used in a chain if..." \| Build the chain first, THEN report \|
23
24	You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.
25
26	---
27
28	## CRITICAL RULES
29
30	1. READ FULL SCOPE FIRST -- verify every asset/domain is owned by the target org
31	2. NO THEORETICAL BUGS -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.
32	3. KILL WEAK FINDINGS FAST -- run the 7-Question Gate BEFORE writing any report
33	4. Validate before writing -- check CHANGELOG, design docs, deployment scripts FIRST
34	5. One bug class at a time -- go deep, don't spray
35	6. Verify data isn't already public -- check web UI in incognito before reporting API "leaks"
36	7. 5-MINUTE RULE -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON
37	8. IMPACT-FIRST HUNTING -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target
38	9. CREDENTIAL LEAKS need exploitation proof -- finding keys isn't enough, must PROVE what they access
39	10. STOP SHALLOW RECON SPIRALS -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere
40	11. BUSINESS IMPACT over vuln class -- severity depends on CONTEXT, not just vuln type
41	12. UNDERSTAND THE TARGET DEEPLY -- before hunting, learn the app like a real user
42	13. DON'T OVER-RELY ON AUTOMATION -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds
43	14. HUNT LESS-SATURATED VULN CLASSES -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks
44	15. ONE-HOUR RULE -- stuck on one target for an hour with no progress? SWITCH CONTEXT
45	16. TWO-EYE APPROACH -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior)
46	17. T-SHAPED KNOWLEDGE -- go DEEP in one area and BROAD across everything else
47
48	> For the full hunting methodology — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see `skills/bb-methodology/SKILL.md`.
49
50	---
51
52	## A->B BUG SIGNAL METHOD (Cluster Hunting)
53
54	When you find bug A, systematically hunt for B and C nearby. This is one of the most powerful methodologies in bug bounty. Single bugs pay. Chains pay 3-10x more.
55
56	### Known A->B->C Chains
57
58	\| Bug A (Signal) \| Hunt for Bug B \| Escalate to C \|
59	\|----------------\|---------------\|---------------\|
60	\| IDOR (read) \| PUT/DELETE on s

People who liked this also viewed

6 picks

Type

bug-bounty

3.0kstars461forks

View on GitHub

How to install bug-bounty?

elementalsouls/claude-bughunter/bug-bounty

$npx -y skills add elementalsouls/Claude-BugHunter --skill bug-bounty

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Bug Bounty Master Workflow
2
3	Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.
4
5	## THE ONLY QUESTION THAT MATTERS
6
7	> "Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"
8	>
9	> If the answer is NO -- STOP. Do not write. Do not explore further. Move on.
10
11	### Theoretical Bug = Wasted Time. Kill These Immediately:
12
13	\| Pattern \| Kill Reason \|
14	\|---\|---\|
15	\| "Could theoretically allow..." \| Not exploitable = not a bug \|
16	\| "An attacker with X, Y, Z conditions could..." \| Too many preconditions \|
17	\| "Wrong implementation but no practical impact" \| Wrong but harmless = not a bug \|
18	\| Dead code with a bug in it \| Not reachable = not a bug \|
19	\| Source maps without secrets \| No impact \|
20	\| SSRF with DNS-only callback \| Need data exfil or internal access \|
21	\| Open redirect alone \| Need ATO or OAuth chain \|
22	\| "Could be used in a chain if..." \| Build the chain first, THEN report \|
23
24	You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.
25
26	---
27
28	## CRITICAL RULES
29
30	1. READ FULL SCOPE FIRST -- verify every asset/domain is owned by the target org
31	2. NO THEORETICAL BUGS -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.
32	3. KILL WEAK FINDINGS FAST -- run the 7-Question Gate BEFORE writing any report
33	4. Validate before writing -- check CHANGELOG, design docs, deployment scripts FIRST
34	5. One bug class at a time -- go deep, don't spray
35	6. Verify data isn't already public -- check web UI in incognito before reporting API "leaks"
36	7. 5-MINUTE RULE -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON
37	8. IMPACT-FIRST HUNTING -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target
38	9. CREDENTIAL LEAKS need exploitation proof -- finding keys isn't enough, must PROVE what they access
39	10. STOP SHALLOW RECON SPIRALS -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere
40	11. BUSINESS IMPACT over vuln class -- severity depends on CONTEXT, not just vuln type
41	12. UNDERSTAND THE TARGET DEEPLY -- before hunting, learn the app like a real user
42	13. DON'T OVER-RELY ON AUTOMATION -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds
43	14. HUNT LESS-SATURATED VULN CLASSES -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks
44	15. ONE-HOUR RULE -- stuck on one target for an hour with no progress? SWITCH CONTEXT
45	16. TWO-EYE APPROACH -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior)
46	17. T-SHAPED KNOWLEDGE -- go DEEP in one area and BROAD across everything else
47
48	> For the full hunting methodology — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see `skills/bb-methodology/SKILL.md`.
49
50	---
51
52	## A->B BUG SIGNAL METHOD (Cluster Hunting)
53
54	When you find bug A, systematically hunt for B and C nearby. This is one of the most powerful methodologies in bug bounty. Single bugs pay. Chains pay 3-10x more.
55
56	### Known A->B->C Chains
57
58	\| Bug A (Signal) \| Hunt for Bug B \| Escalate to C \|
59	\|----------------\|---------------\|---------------\|
60	\| IDOR (read) \| PUT/DELETE on s

People who liked this also viewed

6 picks

Type