/param-discover
Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover <url> | /param-discover -l <urls-file>
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/param-discover
Context preview
What this command does when you run it.
Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover <url> | /param-discover -l <urls-file>
Command definition
param-discover.mddescription: Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover <url> | /param-discover -l <urls-file>
/param-discover
Find HTTP parameters the application accepts but doesn't link from any visible endpoint. Useful when an endpoint looks unreachable or returns a generic response — often a hidden `id`, `user`, `redirect`, `file`, or `debug` param unlocks the real surface.
Usage
/param-discover https://api.target.com/v2/user
/param-discover -l recon/target.com/live/urls.txt
Tools
`tools/param_discovery.sh` prefers `arjun` (richer JSON output, ML-driven diffing) and falls back to `x8` (Rust, faster on huge wordlists). Install hint:
pipx install arjun
# or
cargo install x8
Why it pays
- Hidden `redirect=` / `next=` → open redirect, SSRF, OAuth code theft chain.
- Hidden `id=` / `user_id=` → IDOR.
- Hidden `file=` / `path=` / `template=` → LFI, SSTI, RFI.
- Hidden `debug=` / `admin=` → privilege escalation toggles.
- Hidden `callback=` / `jsonp=` → reflected XSS via JSONP.
After discovery, feed the URL+param into `/hunt --vuln-class <best-fit>` for targeted testing.
Output
`findings/params/<timestamp>/`:
- `arjun.json` / `arjun_summary.txt` — endpoint → discovered params
- `x8.txt` — diff-based hits when arjun is unavailable
Read more
description: Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover <url> | /param-discover -l <urls-file>
/param-discover
Find HTTP parameters the application accepts but doesn't link from any visible endpoint. Useful when an endpoint looks unreachable or returns a generic response — often a hidden `id`, `user`, `redirect`, `file`, or `debug` param unlocks the real surface.
Usage
/param-discover https://api.target.com/v2/user /param-discover -l recon/target.com/live/urls.txt
Tools
`tools/param_discovery.sh` prefers `arjun` (richer JSON output, ML-driven diffing) and falls back to `x8` (Rust, faster on huge wordlists). Install hint:
pipx install arjun # or cargo install x8
Why it pays
- Hidden `redirect=` / `next=` → open redirect, SSRF, OAuth code theft chain.
- Hidden `id=` / `user_id=` → IDOR.
- Hidden `file=` / `path=` / `template=` → LFI, SSTI, RFI.
- Hidden `debug=` / `admin=` → privilege escalation toggles.
- Hidden `callback=` / `jsonp=` → reflected XSS via JSONP.
After discovery, feed the URL+param into `/hunt --vuln-class <best-fit>` for targeted testing.
Output
`findings/params/<timestamp>/`:
- `arjun.json` / `arjun_summary.txt` — endpoint → discovered params
- `x8.txt` — diff-based hits when arjun is unavailable
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.
Repo: shuvonsec/claude-bug-bounty
Other commands on claude-bug-bounty.
- /arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>
Open command - /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /breach-check
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
Open command - /bypass-403
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
Open command