/bug-bounty

name: bug-bounty
description: Complete bug bounty workflow — recon, pre-hunt learning, vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (ASI01-ASI10), A-to-B bug chaining, bypass tables, language-specific grep patterns, and reporting (7-Question Gate, 4 validation gates, CVSS 3.1, PoC generation, submission checklist). Use for ANY bug bounty task — recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports.

Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

THE ONLY QUESTION THAT MATTERS

> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"** > > If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**

Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason | |---|---| | "Could theoretically allow..." | Not exploitable = not a bug | | "An attacker with X, Y, Z conditions could..." | Too many preconditions | | "Wrong implementation but no practical impact" | Wrong but harmless = not a bug | | Dead code with a bug in it | Not reachable = not a bug | | Source maps without secrets | No impact | | SSRF with DNS-only callback | Need data exfil or internal access | | Open redirect alone | Need ATO or OAuth chain | | "Could be used in a chain if..." | Build the chain first, THEN report |

**You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.**

---

CRITICAL RULES

1. **READ FULL SCOPE FIRST** -- verify every asset/domain is owned by the target org 2. **NO THEORETICAL BUGS** -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP. 3. **KILL WEAK FINDINGS FAST** -- run the 7-Question Gate BEFORE writing any report 4. **Validate before writing** -- check CHANGELOG, design docs, deployment scripts FIRST 5. **One bug class at a time** -- go deep, don't spray 6. **Verify data isn't already public** -- check web UI in incognito before reporting API "leaks" 7. **5-MINUTE RULE** -- if a target shows nothing after 5 min probing (all 401/403/404), MOVE ON 8. **IMPACT-FIRST HUNTING** -- ask "what's the worst thing if auth was broken?" If nothing valuable, skip target 9. **CREDENTIAL LEAKS need exploitation proof** -- finding keys isn't enough, must PROVE what they access 10. **STOP SHALLOW RECON SPIRALS** -- don't probe 403s, don't grep for analytics keys, don't check staging domains that lead nowhere 11. **BUSINESS IMPACT over vuln class** -- severity depends on CONTEXT, not just vuln type 12. **UNDERSTAND THE TARGET DEEPLY** -- before hunting, learn the app like a real user 13. **DON'T OVER-RELY ON AUTOMATION** -- automated scans hit WAFs, trigger rate limits, find the same bugs everyone else finds 14. **HUNT LESS-SATURATED VULN CLASSES** -- XSS/SSRF/XXE have the most competition. Expand into: cache poisoning, Android/mobile vulns, business logic, race conditions, OAuth/OIDC chains, CI/CD pipeline attacks 15. **ONE-HOUR RULE** -- stuck on one target for an hour with no progress? SWITCH CONTEXT 16. **TWO-EYE APPROACH** -- combine systematic testing (checklist) with anomaly detection (watch for unexpected behavior) 17. **T-SHAPED KNOWLEDGE** -- go DEEP in one area and BROAD across everything else 18. **LEAD BOARD — never lose a lead** -- after recon run `python3 tools/lead_board.py ingest <target>` + `show` + `next`. Route each signal to its skill ("GraphQL → hunt-graphql"). `touch` when starting/killing/reporting. Focus on one lead; the board remembers the rest. Surface stale high-priority leads unprompted.

> **For the full hunting methodology** — 5-phase non-linear workflow, developer psychology framework, session discipline, tool routing by phase, and Wide/Deep route selection — see **`skills/bb-methodology/SKILL.md`**. > > **Tool catalogue:** `tools/README.md` (~50 tools). Orchestrator: `python3 tools/hunt.py --target T` (auto lead ingest; add `--graphql` / `--cve-hunt` as needed).

---

AUTH-AWARE HUNTING (when bugs live behind a login)

Anonymous recon misses the bugs that pay most. IDOR, BOLA, mass-assignment, privilege escalation, auth bypass, SSRF behind login, and most LLM/agent bugs are invisible until you log in. Load auth **once** at session start and every downstream tool (httpx, katana, ffuf, nuclei, dalfox, the SQLi / SSTI / upload PoC verifiers) sends those headers automatically.

# Pick ONE of these and run hunt.py normally:
python3 tools/hunt.py --target T --cookie 'session=eyJabc...'
python3 tools/hunt.py --target T --bearer 'eyJhbGciOi...'
python3 tools/hunt.py --target T --auth-file .private/T.json

# Or via env (persists for the shell):
export BBHUNT_COOKIE='session=eyJabc...'
python3 tools/hunt.py --target T

**For IDOR / BOLA hunts**, load two sessions and diff behavior:

python3 tools/hunt.py --target T --auth-file .private/T-user-a.json
python3 tools/hunt.py --target T --auth-file .private/T-user-b.json
# Audit log entries carry different session_id hashes → diff which
# endpoints behaved differently per identity.

**Safety**: cookies/tokens never appear in logs, hunt-memory, or `repr()`. Only a 12-char `session_id` hash is recorded. `.private/` is gitignored. MFA-skip and SAML signature-stripping probes deliberately stay anonymous — that's the attack they're checking for.

Full guide: `docs/auth-sessions.md`. Template: `docs/auth.example.json`.

---

A->B BUG SIGNAL METHOD (Cluster Hunting)

**When you find bug A, systematically hunt for B and C nearby.** This is one of the most powerful methodologies in bug bounty. Single bugs pay. Chains pay 3-10