offensive-bug-identification

Name: offensive-bug-identification
Author: SnailSploit

2.8kstars447forks

How to install offensive-bug-identification?

snailsploit/claude-red/offensive-bug-identification

$npx -y skills add SnailSploit/Claude-Red --skill offensive-bug-identification

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Bug Identification
2
3	## Metadata
4	- Skill Name: bug-identification
5	- Folder: offensive-bug-identification
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/bug-identification.md
7
8	## Description
9	Systematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`bug identification, code review, taint analysis, dangerous functions, data flow, source audit, black box, vulnerability identification, static analysis, code audit, bug hunting`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Bug Identification
29
30	## Overview
31
32	Bug identification is the process of discovering potential vulnerabilities in software through various techniques including static analysis, dynamic analysis, and fuzzing. This document outlines methodologies and tools for effective vulnerability research.
33
34	For practical exploit development, see [Exploit Development](/exploit/development.md).
35
36	```mermaid
37	flowchart TD
38	BugId["Bug Identification"]
39
40	%% Main Methods
41	Static["Static Analysis"]
42	Dynamic["Dynamic Analysis"]
43	Fuzzing["Fuzzing"]
44	AI["AI-Assisted"]
45
46	%% Static Analysis Methods
47	CodeReview["Manual Code Review"]
48	RevEng["Reverse Engineering"]
49	PatchDiff["Patch Diffing"]
50	StaticTools["Static Analysis Tools"]
51	SBOM["Supply Chain Analysis"]
52
53	%% Dynamic Analysis Methods
54	DebugTrace["Debugging/Tracing"]
55	DBI["Dynamic Binary Instrumentation"]
56	Taint["Taint Analysis"]
57	SymExec["Symbolic Execution"]
58	Snapshot["Snapshot Analysis"]
59
60	%% Fuzzing Methods
61	DumbFuzz["Dumb Fuzzing"]
62	SmartFuzz["Smart Fuzzing"]
63	EvoFuzz["Evolutionary Fuzzing"]
64	LLMFuzz["LLM-Guided Fuzzing"]
65
66	%% AI Methods
67	LLMTriage["LLM Crash Triage"]
68	MLPattern["ML Pattern Recognition"]
69	AutoVariant["Automated Variant Analysis"]
70
71	%% Connections
72	BugId --> Static
73	BugId --> Dynamic
74	BugId --> Fuzzing
75	BugId --> AI
76
77	Static --> CodeReview
78	Static --> RevEng
79	Static --> PatchDiff
80	Static --> StaticTools
81	Static --> SBOM
82
83	Dynamic --> DebugTrace
84	Dynamic --> DBI
85	Dynamic --> Taint
86	Dynamic --> SymExec
87	Dynamic --> Snapshot
88
89	Fuzzing --> DumbFuzz
90	Fuzzing --> SmartFuzz
91	Fuzzing --> EvoFuzz
92	Fuzzing --> LLMFuzz
93
94	AI --> LLMTriage
95	AI --> MLPattern
96	AI --> AutoVariant
97
98	%% Combinations
99	Taint -.-> Fuzzing
100	SymExec -.-> Fuzzing
101	RevEng -.-> Fuzzing
102	AI -.-> Fuzzing
103	AI -.-> Static
104
105	class BugId primary
106	```
107
108	## Vulnerability Research Methodology
109
110	### Phase 1: Reconnaissance
111
112	- Target Enumeration: Identify version, dependencies, configuration
113	- Attack Surface Mapping: List all input vectors, APIs, protocols
114	- Documentation Review: RFCs, specifications, developer docs
115	- Prior Art Analysis: CVE database, exploit-db, bug trackers
116
117	### Phase 2: Static Analysis
118
119	- Source Review: If available, focus on parsing/validation code
120	- Binary Analysis: Reverse engineering with Ghidra/IDA
121	- Patch Diffing: Compare vulnerable vs patched versions
122	- SBOM Analysis: Check third-party component vulnerabilities
123
124	### Phase 3: Dynamic Analysis
125
126	- Behavioral Analysis: Monitor syscalls, network, file I/O
127	- Debugging: Trace execution paths with controlled input
128	- Instrumentation: Coverage-guided exploration
129	- Taint Analysis: Track input propagation
130
131	### Phase 4: Fuzzing
132
133	- Corpus Generation: Create valid seed inputs
134	- Harness Development: Isolate target functionality
135	- Coverage Monitoring: Identify untested code paths
136	- Crash Triage: Classify and prioritize findings
137
138	### Phase 5: Exploitation
139
140	- Primitive Development: Convert bug to reliable primitives
141	- Mitigation Bypass: Defeat ASLR, DEP, CFG, etc.
142	- Payload Development: Create working exploit
143	- Weaponization: Package for real-world use (if authorized)
144
145	## Attack Surface Identification
146
147	Before diving into specific bug hunting techniques, it's essential to understand where to look for vulnerabilities.
148
149	### Windows User Mode
150
151	- Shared Memory
152	- RPC
153	- Named Pipes
154	- File & Network IO
155	- Windows Messages
156	- For authentication-related vulnerabilities, see [Windows Auth](/exploit/windows-auth.md)
157
158	### Kernel
159
160	- _Device Drivers_
161	- Many third-party software with drivers to target
162	- Can accept arbitrary user input via the `IOCTL` interface
163	- Also performs actions when we `

People who liked this also viewed

6 picks

Type

offensive-bug-identification

2.8kstars447forks

View on GitHub

How to install offensive-bug-identification?

snailsploit/claude-red/offensive-bug-identification

$npx -y skills add SnailSploit/Claude-Red --skill offensive-bug-identification

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Bug Identification
2
3	## Metadata
4	- Skill Name: bug-identification
5	- Folder: offensive-bug-identification
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/bug-identification.md
7
8	## Description
9	Systematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`bug identification, code review, taint analysis, dangerous functions, data flow, source audit, black box, vulnerability identification, static analysis, code audit, bug hunting`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Bug Identification
29
30	## Overview
31
32	Bug identification is the process of discovering potential vulnerabilities in software through various techniques including static analysis, dynamic analysis, and fuzzing. This document outlines methodologies and tools for effective vulnerability research.
33
34	For practical exploit development, see [Exploit Development](/exploit/development.md).
35
36	```mermaid
37	flowchart TD
38	BugId["Bug Identification"]
39
40	%% Main Methods
41	Static["Static Analysis"]
42	Dynamic["Dynamic Analysis"]
43	Fuzzing["Fuzzing"]
44	AI["AI-Assisted"]
45
46	%% Static Analysis Methods
47	CodeReview["Manual Code Review"]
48	RevEng["Reverse Engineering"]
49	PatchDiff["Patch Diffing"]
50	StaticTools["Static Analysis Tools"]
51	SBOM["Supply Chain Analysis"]
52
53	%% Dynamic Analysis Methods
54	DebugTrace["Debugging/Tracing"]
55	DBI["Dynamic Binary Instrumentation"]
56	Taint["Taint Analysis"]
57	SymExec["Symbolic Execution"]
58	Snapshot["Snapshot Analysis"]
59
60	%% Fuzzing Methods
61	DumbFuzz["Dumb Fuzzing"]
62	SmartFuzz["Smart Fuzzing"]
63	EvoFuzz["Evolutionary Fuzzing"]
64	LLMFuzz["LLM-Guided Fuzzing"]
65
66	%% AI Methods
67	LLMTriage["LLM Crash Triage"]
68	MLPattern["ML Pattern Recognition"]
69	AutoVariant["Automated Variant Analysis"]
70
71	%% Connections
72	BugId --> Static
73	BugId --> Dynamic
74	BugId --> Fuzzing
75	BugId --> AI
76
77	Static --> CodeReview
78	Static --> RevEng
79	Static --> PatchDiff
80	Static --> StaticTools
81	Static --> SBOM
82
83	Dynamic --> DebugTrace
84	Dynamic --> DBI
85	Dynamic --> Taint
86	Dynamic --> SymExec
87	Dynamic --> Snapshot
88
89	Fuzzing --> DumbFuzz
90	Fuzzing --> SmartFuzz
91	Fuzzing --> EvoFuzz
92	Fuzzing --> LLMFuzz
93
94	AI --> LLMTriage
95	AI --> MLPattern
96	AI --> AutoVariant
97
98	%% Combinations
99	Taint -.-> Fuzzing
100	SymExec -.-> Fuzzing
101	RevEng -.-> Fuzzing
102	AI -.-> Fuzzing
103	AI -.-> Static
104
105	class BugId primary
106	```
107
108	## Vulnerability Research Methodology
109
110	### Phase 1: Reconnaissance
111
112	- Target Enumeration: Identify version, dependencies, configuration
113	- Attack Surface Mapping: List all input vectors, APIs, protocols
114	- Documentation Review: RFCs, specifications, developer docs
115	- Prior Art Analysis: CVE database, exploit-db, bug trackers
116
117	### Phase 2: Static Analysis
118
119	- Source Review: If available, focus on parsing/validation code
120	- Binary Analysis: Reverse engineering with Ghidra/IDA
121	- Patch Diffing: Compare vulnerable vs patched versions
122	- SBOM Analysis: Check third-party component vulnerabilities
123
124	### Phase 3: Dynamic Analysis
125
126	- Behavioral Analysis: Monitor syscalls, network, file I/O
127	- Debugging: Trace execution paths with controlled input
128	- Instrumentation: Coverage-guided exploration
129	- Taint Analysis: Track input propagation
130
131	### Phase 4: Fuzzing
132
133	- Corpus Generation: Create valid seed inputs
134	- Harness Development: Isolate target functionality
135	- Coverage Monitoring: Identify untested code paths
136	- Crash Triage: Classify and prioritize findings
137
138	### Phase 5: Exploitation
139
140	- Primitive Development: Convert bug to reliable primitives
141	- Mitigation Bypass: Defeat ASLR, DEP, CFG, etc.
142	- Payload Development: Create working exploit
143	- Weaponization: Package for real-world use (if authorized)
144
145	## Attack Surface Identification
146
147	Before diving into specific bug hunting techniques, it's essential to understand where to look for vulnerabilities.
148
149	### Windows User Mode
150
151	- Shared Memory
152	- RPC
153	- Named Pipes
154	- File & Network IO
155	- Windows Messages
156	- For authentication-related vulnerabilities, see [Windows Auth](/exploit/windows-auth.md)
157
158	### Kernel
159
160	- _Device Drivers_
161	- Many third-party software with drivers to target
162	- Can accept arbitrary user input via the `IOCTL` interface
163	- Also performs actions when we `

People who liked this also viewed

6 picks

Type