ai-pair-hunting-with-claude

Name: ai-pair-hunting-with-claude
Author: ShulkwiSEC

18stars5forks

How to install ai-pair-hunting-with-claude?

shulkwisec/bb-huge/ai-pair-hunting-with-claude

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-pair-hunting-with-claude

Installs into the current project.

Summary

Configure Claude as a "Pair Hunter" — autonomous overnight hacking, context management via per-target .claudemd files, sub-agent compaction avoidance, and scope enforcement. Based on Critical Thinking Bug Bounty Podcast Episode 166.

Files · 1

View on GitHub

SKILL.md

1	# AI Pair Hunting with Claude
2
3	## When to Use
4	- When setting up Claude Code CLI to autonomously test a bug bounty target.
5	- When running overnight / multi-hour autonomous hacking sessions.
6	- When managing scope and context across multiple bug bounty programs.
7	- When Claude is getting stuck in compaction loops or losing context mid-session.
8	- When you need Claude to stay strictly within program scope.
9
10	## Prerequisites
11	- Claude Code CLI installed and authenticated
12	- A defined bug bounty target with program policy
13	- Separate workspace directory per target program
14	- Understanding of Claude's context window limitations
15
16	## Core Concept: Claude as a Pair Hunter
17
18	> **"AI is not your replacement. It is your Pair Hunter —
19	> it brings determinism (accuracy) and speed."**
20	> — Critical Thinking Podcast, Ep. 166
21
22	Claude excels at:
23	- Deterministic tasks: Testing every parameter in a 200-param API
24	- Speed: Fuzzing/enumerating faster than manual testing
25	- Pattern recognition: Spotting anomalies in large response sets
26	- Documentation: Auto-generating reports from findings
27
28	Claude struggles with:
29	- Creative intuition: "This feels wrong" — that is YOUR job
30	- Out-of-scope judgment: Without explicit policy, Claude will test everything
31	- Long context retention: After ~100k tokens, context degrades
32
33	## Workflow
34
35	### Phase 1: Per-Target Context Management
36
37	> **"For every target, create a separate folder. Put a .claudemd file in it
38	> with the program's policy and scope."**
39	> — Episode 166 [51:20]
40
41	Directory structure:
42	```
43	programs/
44	├── example-corp/
45	│ ├── .claudemd # ← THIS IS THE KEY FILE
46	│ ├── notes/
47	│ ├── leads/
48	│ ├── findings/
49	│ └── scripts/
50	├── another-target/
51	│ ├── .claudemd
52	│ └── ...
53	```
54
55	`.claudemd` template:
56	```markdown
57	# Target: Example Corp Bug Bounty Program
58
59	## Program URL
60	https://hackerone.com/example-corp
61
62	## Scope — IN
63	- *.example.com
64	- api.example.com
65	- app.example.com (authenticated testing allowed)
66	- mobile-api.example.com
67
68	## Scope — OUT (DO NOT TEST)
69	- blog.example.com (third-party WordPress)
70	- status.example.com (StatusPage hosted)
71	- *.example.dev (staging — explicitly excluded)
72	- Any domain not listed above
73
74	## Rules of Engagement
75	- NO denial of service testing
76	- NO social engineering of employees
77	- NO accessing other users' data beyond proof of concept (read 1 record, stop)
78	- Rate limit: Max 10 requests/second
79	- Report vulnerabilities within 24 hours of confirmation
80
81	## Authentication
82	- Test account 1: testuser@example.com / [use env var AUTH_TOKEN_1]
83	- Test account 2: testadmin@example.com / [use env var AUTH_TOKEN_2]
84	- API Key: [use env var EXAMPLE_CORP_API_KEY]
85
86	## Tech Stack (Known)
87	- Frontend: React 18 + Next.js
88	- Backend: Node.js + Express
89	- Database: PostgreSQL (inferred from error messages)
90	- CDN: Cloudflare
91	- Auth: OAuth 2.0 + JWT
92
93	## Priority Targets
94	1. `/api/v2/users/*` — IDOR testing
95	2. `/api/v2/billing/*` — Payment logic flaws
96	3. `/upload/*` — File upload vulnerabilities
97	4. `/auth/*` — Authentication bypass
98
99	## Previous Findings (to avoid duplicates)
100	- XSS in /search — reported 2024-12, resolved
101	- IDOR in /api/v1/users/{id} — reported 2025-01, resolved (v2 untested)
102	```
103
104	Why this works: When you run `claude` from inside `programs/example-corp/`, Claude
105	automatically reads `.claudemd` and constrains itself to the defined scope.
106
107	### Phase 2: Autonomous Overnight Hacking
108
109	> "I am going to bed. Don't ask for input. Keep hacking."
110	> — Episode 166 [40:01]
111
112	The overnight prompt:
113	```
114	I am going to sleep. Do not ask me for input or confirmation.
115
116	Your mission for the next 4 hours:
117	1. Read the .claudemd file for scope and rules.
118	2. Map all API endpoints on api.example.com using the scripts in scripts/.
119	3. For each endpoint, test the following:
120	- IDOR: Replace user IDs / resource IDs with other values.
121	- Broken auth: Access endpoints without auth token, with expired token, with wrong role.
122	- Input validation: Fuzz all parameters with payloads from scripts/fuzz-payloads.ts.
123	4. Log ALL findings to findings/ using the finding template.
124	5. Log all interesting observations to notes/.
125	6. Do NOT exceed 10 requests per second.
126	7. Do NOT test anything outside the scope

People who liked this also viewed

6 picks

Type

ai-pair-hunting-with-claude

18stars5forks

View on GitHub

How to install ai-pair-hunting-with-claude?

shulkwisec/bb-huge/ai-pair-hunting-with-claude

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-pair-hunting-with-claude

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AI Pair Hunting with Claude
2
3	## When to Use
4	- When setting up Claude Code CLI to autonomously test a bug bounty target.
5	- When running overnight / multi-hour autonomous hacking sessions.
6	- When managing scope and context across multiple bug bounty programs.
7	- When Claude is getting stuck in compaction loops or losing context mid-session.
8	- When you need Claude to stay strictly within program scope.
9
10	## Prerequisites
11	- Claude Code CLI installed and authenticated
12	- A defined bug bounty target with program policy
13	- Separate workspace directory per target program
14	- Understanding of Claude's context window limitations
15
16	## Core Concept: Claude as a Pair Hunter
17
18	> **"AI is not your replacement. It is your Pair Hunter —
19	> it brings determinism (accuracy) and speed."**
20	> — Critical Thinking Podcast, Ep. 166
21
22	Claude excels at:
23	- Deterministic tasks: Testing every parameter in a 200-param API
24	- Speed: Fuzzing/enumerating faster than manual testing
25	- Pattern recognition: Spotting anomalies in large response sets
26	- Documentation: Auto-generating reports from findings
27
28	Claude struggles with:
29	- Creative intuition: "This feels wrong" — that is YOUR job
30	- Out-of-scope judgment: Without explicit policy, Claude will test everything
31	- Long context retention: After ~100k tokens, context degrades
32
33	## Workflow
34
35	### Phase 1: Per-Target Context Management
36
37	> **"For every target, create a separate folder. Put a .claudemd file in it
38	> with the program's policy and scope."**
39	> — Episode 166 [51:20]
40
41	Directory structure:
42	```
43	programs/
44	├── example-corp/
45	│ ├── .claudemd # ← THIS IS THE KEY FILE
46	│ ├── notes/
47	│ ├── leads/
48	│ ├── findings/
49	│ └── scripts/
50	├── another-target/
51	│ ├── .claudemd
52	│ └── ...
53	```
54
55	`.claudemd` template:
56	```markdown
57	# Target: Example Corp Bug Bounty Program
58
59	## Program URL
60	https://hackerone.com/example-corp
61
62	## Scope — IN
63	- *.example.com
64	- api.example.com
65	- app.example.com (authenticated testing allowed)
66	- mobile-api.example.com
67
68	## Scope — OUT (DO NOT TEST)
69	- blog.example.com (third-party WordPress)
70	- status.example.com (StatusPage hosted)
71	- *.example.dev (staging — explicitly excluded)
72	- Any domain not listed above
73
74	## Rules of Engagement
75	- NO denial of service testing
76	- NO social engineering of employees
77	- NO accessing other users' data beyond proof of concept (read 1 record, stop)
78	- Rate limit: Max 10 requests/second
79	- Report vulnerabilities within 24 hours of confirmation
80
81	## Authentication
82	- Test account 1: testuser@example.com / [use env var AUTH_TOKEN_1]
83	- Test account 2: testadmin@example.com / [use env var AUTH_TOKEN_2]
84	- API Key: [use env var EXAMPLE_CORP_API_KEY]
85
86	## Tech Stack (Known)
87	- Frontend: React 18 + Next.js
88	- Backend: Node.js + Express
89	- Database: PostgreSQL (inferred from error messages)
90	- CDN: Cloudflare
91	- Auth: OAuth 2.0 + JWT
92
93	## Priority Targets
94	1. `/api/v2/users/*` — IDOR testing
95	2. `/api/v2/billing/*` — Payment logic flaws
96	3. `/upload/*` — File upload vulnerabilities
97	4. `/auth/*` — Authentication bypass
98
99	## Previous Findings (to avoid duplicates)
100	- XSS in /search — reported 2024-12, resolved
101	- IDOR in /api/v1/users/{id} — reported 2025-01, resolved (v2 untested)
102	```
103
104	Why this works: When you run `claude` from inside `programs/example-corp/`, Claude
105	automatically reads `.claudemd` and constrains itself to the defined scope.
106
107	### Phase 2: Autonomous Overnight Hacking
108
109	> "I am going to bed. Don't ask for input. Keep hacking."
110	> — Episode 166 [40:01]
111
112	The overnight prompt:
113	```
114	I am going to sleep. Do not ask me for input or confirmation.
115
116	Your mission for the next 4 hours:
117	1. Read the .claudemd file for scope and rules.
118	2. Map all API endpoints on api.example.com using the scripts in scripts/.
119	3. For each endpoint, test the following:
120	- IDOR: Replace user IDs / resource IDs with other values.
121	- Broken auth: Access endpoints without auth token, with expired token, with wrong role.
122	- Input validation: Fuzz all parameters with payloads from scripts/fuzz-payloads.ts.
123	4. Log ALL findings to findings/ using the finding template.
124	5. Log all interesting observations to notes/.
125	6. Do NOT exceed 10 requests per second.
126	7. Do NOT test anything outside the scope

People who liked this also viewed

6 picks

Type