/cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/cloud-recon
Context preview
What this command does when you run it.
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
Command definition
cloud-recon.mddescription: Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage: /cloud-recon --keyword <name> | /cloud-recon --cf-bypass <domain>
/cloud-recon
Find cloud-storage misconfigurations and origin IPs that bypass CloudFlare.
Usage
/cloud-recon --keyword acme
/cloud-recon --keyword acme --s3-only
/cloud-recon --cf-bypass api.target.com
What it runs
| Tool | Mode | What it finds | |---|---|---| | `s3scanner` | `--keyword` | Public/listable S3 buckets across AWS, DigitalOcean Spaces, Wasabi, Linode | | `cloud_enum` | `--keyword` | AWS S3, Azure blobs/files/queues, GCP storage with permutation patterns | | `cloudfail` | `--cf-bypass` | DNS-history-based CloudFlare origin IP discovery |
When `cloudfail` is missing the script falls back to crt.sh + dig and flags any subdomain that resolves to an IP **outside** CloudFlare's published ranges — typical origin-IP leak symptom.
Why this matters
- A world-readable S3 bucket holding PII or backups is usually rated **High to
Critical** ($1k–$10k+).
- An exposed CloudFlare origin IP lets you bypass WAF rules; combined with a
Host-header trick or a vulnerability that the WAF was masking, payouts climb fast.
- Both classes are easy to triage and nearly always in-scope.
Output
`findings/cloud/<timestamp>/` with:
- `s3scanner.txt` — buckets that exist + their permission bits
- `cloud_enum.txt` — multi-cloud OSINT hits
- `cloudfail.txt` or `non_cf_ips.txt` — origin-IP candidates
Read more
description: Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage: /cloud-recon --keyword <name> | /cloud-recon --cf-bypass <domain>
/cloud-recon
Find cloud-storage misconfigurations and origin IPs that bypass CloudFlare.
Usage
/cloud-recon --keyword acme /cloud-recon --keyword acme --s3-only /cloud-recon --cf-bypass api.target.com
What it runs
| Tool | Mode | What it finds | |---|---|---| | `s3scanner` | `--keyword` | Public/listable S3 buckets across AWS, DigitalOcean Spaces, Wasabi, Linode | | `cloud_enum` | `--keyword` | AWS S3, Azure blobs/files/queues, GCP storage with permutation patterns | | `cloudfail` | `--cf-bypass` | DNS-history-based CloudFlare origin IP discovery |
When `cloudfail` is missing the script falls back to crt.sh + dig and flags any subdomain that resolves to an IP **outside** CloudFlare's published ranges — typical origin-IP leak symptom.
Why this matters
- A world-readable S3 bucket holding PII or backups is usually rated **High to
Critical** ($1k–$10k+).
- An exposed CloudFlare origin IP lets you bypass WAF rules; combined with a
Host-header trick or a vulnerability that the WAF was masking, payouts climb fast.
- Both classes are easy to triage and nearly always in-scope.
Output
`findings/cloud/<timestamp>/` with:
- `s3scanner.txt` — buckets that exist + their permission bits
- `cloud_enum.txt` — multi-cloud OSINT hits
- `cloudfail.txt` or `non_cf_ips.txt` — origin-IP candidates
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.
Repo: shuvonsec/claude-bug-bounty
Other commands on claude-bug-bounty.
- /arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>
Open command - /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /breach-check
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
Open command - /bypass-403
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /cors
Scan an endpoint for CORS misconfiguration — arbitrary-origin reflection, null-origin trust, credential exposure, suffix/prefix regex bypass, scheme downgrade. Usage: /cors <url> [--cookie "session=..."] | /cors -l urls.txt
Open command