elementalsouls/claude-bughunter
71 skills5.1k installs234k starsGitHub
Install
npx skills add https://github.com/elementalsouls/claude-bughunterSkills in this repo
1Bb MethodologyActs as a master orchestrator for bug bounty sessions, combining a phased hunting workflow with a developer-psychology mindset framework and routing to other hunt skills. A developer uses it at the start of a session or when unsure what to do next.90installs2Bug BountyProvides a complete bug bounty master workflow from recon through hunting, validation, and reporting across a broad set of vulnerability classes. A developer uses it as a single skill for any bug bounty task on a target.88installs3Web2 ReconChains asset discovery, live-host detection, URL crawling, directory fuzzing, and JS analysis into a hunt-ready URL list with continuous monitoring. A hunter uses it when starting recon or mapping attack surface on any web2 target.88installs4Hunt Auth BypassHunts authentication bypass vulnerabilities across SAML, OAuth/OIDC, JWT, and legacy auth endpoints. A developer uses it when testing SSO, admin panels, or federated identity integrations.86installs5Hunt SubdomainDetects dangling DNS records and re-registers them to serve content from trusted company domains, emphasizing ATO-chain primitives. A hunter uses it when testing for subdomain takeover across cloud and CDN providers.83installs6Osint MethodologyA methodology covering the seed-to-reporting recon pipeline, identity-fabric mapping, breach correlation, detection-aware probing, and client deliverables. A red-teamer uses it to plan and execute attack-surface assessments or entity investigations.83installs7Offensive OsintAn operational arsenal of curl one-liners, regexes, and wordlists for subdomain enum, cloud bucket discovery, secret triage, and identity-fabric mapping, with detail in 15 modular reference files. A red-teamer uses it for any authorized recon: scoping, asset discovery, and attack-path mapping.82installs8Report WritingProvides report templates, human-tone guidelines, impact-first writing, and severity decision guides for bug bounty submissions. A hunter uses it after validating a finding and before submitting.82installs9Hunt RceGuides testing for RCE, the highest-payout bug class that grants direct execution on target infrastructure. A hunter uses it when testing any target for code-execution paths.81installs10Hunt SsrfTests for server-side request forgery against cloud metadata services and internal networks with mandatory OOB confirmation for blind cases. A hunter uses it when a target fetches URLs or runs on cloud infrastructure.80installs11Hunt XssGuides XSS testing that combines privileged context, persistent delivery, and scope escalation for high payouts. A hunter uses it when testing any target for script-injection sinks.80installs12Vmware Vcenter AttackProvides an external attack matrix for vCenter/Workspace ONE/Aria including APT-exploited CVEs and vmdir LDAP enumeration. A red-teamer uses it when recon shows an internet-exposed vCenter banner or VMware fingerprints.80installs13Web3 AuditCovers reentrancy, oracle, flash-loan, access-control, and other DeFi bug classes with real Immunefi paid examples. A developer or auditor uses it for any Solidity/Rust contract audit or to decide if a DeFi target is worth hunting.80installs14Bb Local ToolkitProvides a complete bug bounty workflow spanning recon, vulnerability hunting across many classes, validation, and report writing. A developer uses it for any bug bounty task from starting a target to filing a report.79installs15Hunt SamlTests SAML SSO flows for XSW, key confusion, audience-restriction gaps, and replay leading to account takeover or admin role injection. A hunter uses it when a SAML AssertionConsumerService or SSO endpoint is reachable.79installs16Mid Engagement Ir DetectionProvides a methodology to notice mid-engagement changes such as a patched finding or shifted baseline timing, then package them as deliverables. A red-teamer uses it during any active engagement against a monitored target.79installs17Security ArsenalA reference of payloads, bypass techniques, wordlists, and always-rejected/conditionally-valid tables for hunting. A hunter uses it to grab specific payloads or check whether a finding is submittable.79installs18Bugcrowd ReportingEncodes Bugcrowd-specific reporting tactics including VRT category selection, severity overrides, and out-of-scope rebuttals. A developer uses it when filing a Bugcrowd submission or when a triager downgrades severity or closes as out of scope.78installs19Enterprise Vpn AttackProvides an external SSL VPN and remote-access appliance attack matrix covering fingerprinting, CVEs, and pre-auth exploits for major vendors. A developer uses it when a target's perimeter exposes an SSL VPN or remote-access gateway.78installs20Evidence HygieneProvides evidence-capture and PoC-redaction discipline for bug bounty submissions, covering cookie masking, PII handling, and HAR sanitization. A developer uses it before capturing any screenshot or attaching evidence that contains session cookies or other-user data.78installs21Hunt AspnetHunts ASP.NET-specific attack surface including ViewState deserialization, machineKey recovery, and request-validator bypass. A developer uses it when a target runs ASP.NET Webforms, WCF, or SharePoint.78installs22Hunt DispatchActs as a skill-set loader for the /hunt orchestrator, fingerprinting the target and loading the appropriate red-team or WAPT skills. A developer uses it internally after /hunt receives a mode answer, not as a direct invocation.78installs23Hunt GraphqlHunts GraphQL vulnerabilities including object-level authorization flaws, cross-tenant IDOR, SSRF, and query-cost bypass. A developer uses it when a target exposes a GraphQL endpoint.78installs24Hunt OauthGuides OAuth flow testing for account takeover, session theft, and auth bypass patterns drawn from disclosed reports. A hunter uses it when testing any OAuth implementation on a target.78installs25Hunt SqliGuides SQLi/NoSQLi testing across modern ORMs, GraphQL, and OIDC-proxy backends drawn from disclosed CVEs. A hunter uses it when testing any target for injection into data queries.78installs26Hunt SstiFingerprints template engines via math-expression probes then escalates to RCE using engine-specific class-walker and callback patterns. A hunter uses it against email templates, PDF/report generators, and CMS previews that render user input.78installs27Hunt XxeTests XML parsers for XXE across upload, SOAP, and SAML surfaces with an OOB gate for blind cases. A hunter uses it when a target parses XML and there is a path to data exfil or SSRF.78installs28Meme Coin AuditPerforms fast rug-pull detection and deep token security analysis across EVM and Solana, covering mint/freeze authority and DEX liquidity attacks. A developer or investor uses it for token audits and pre-investment due diligence.78installs29Redteam Report TemplateProvides the client-facing red-team report format distinct from bug-bounty platform reports, tuned for enterprise audience and cadence. A red-teamer uses it when generating the final deliverable or packaging findings into DOCX/PDF.78installs30Supply Chain Attack ReconIdentifies supply-chain openings such as internal-package leakage, container registry exposure, and CI/CD config exposure, recon only. A red-teamer uses it when a target has a public GitHub org, reachable SBOMs, or Docker images.78installs31Cloud Iam DeepProvides a cloud IAM red-team attack chain across AWS, Azure, and GCP focused on external exploitation and post-credential privilege escalation. A developer uses it when a cloud credential surfaces and they need to know what it grants and how to escalate.77installs32Hunt Api MisconfigHunts API security misconfigurations including mass assignment, JWT attacks, prototype pollution, and HTTP verb tampering. A developer uses it when testing API endpoints for auth and object-handling flaws.77installs33Hunt Business LogicHunts business logic vulnerabilities such as price tampering, coupon stacking, and checkout amount manipulation. A developer uses it when testing e-commerce, payment, and tiered-access flows for financial abuse.77installs34Hunt Cache PoisonHunts cache poisoning and web cache deception on CDN-fronted applications. A developer uses it when a target serves content through Cloudflare, Fastly, Akamai, or similar edge caches.77installs35Hunt Cloud MisconfigHunts cloud and infrastructure storage and compute misconfigurations across AWS, GCP, and Azure. A developer uses it when testing cloud-native storage buckets, serverless endpoints, or metadata exposure.77installs36Hunt File UploadHunts file upload vulnerabilities leading to RCE, XSS, SSRF, and path traversal using a bypass technique table. A developer uses it when testing avatar, attachment, import, or document-processing endpoints.77installs37Hunt Http SmugglingHunts HTTP request smuggling caused by front-end and back-end disagreement on request boundaries. A developer uses it on CDN-plus-origin stacks and load balancer or WAF bypass scenarios.77installs38Hunt IdorHunts insecure direct object reference vulnerabilities that grant access to other users' data without an auth bypass. A developer uses it on any application with user-owned resources.77installs39Hunt Mfa BypassHunts MFA and 2FA bypass across seven distinct patterns that enable account takeover. A developer uses it when testing MFA flows and chaining primitives toward ATO.77installs40Hunt Race ConditionGuides race-condition testing using modern single-packet attack techniques against financial, access-control, and integrity assumptions. A hunter uses it when testing for TOCTOU bugs, double-spend, or MFA bypass via timing.77installs41Hunt SharepointTests SharePoint 2013-Subscription Edition on-prem farms for anonymous endpoints, SafeControl reflection, and CVE-2025-53770 preconditions. A red-teamer uses it when a target shows SharePoint headers or /_layouts/ and /_vti_bin/ paths.77installs42Okta AttackCovers Okta-specific authentication flows, factor enumeration, phishing primitives, and post-compromise admin API surface. A red-teamer uses it when recon shows tenant.okta.com or Okta IdP records.77installs43Redteam MindsetCodifies mindset corrections built from engagements where conservative defaults missed findings, emphasizing a do-not-stop directive. A red-teamer loads it at the start of external engagements and whenever stuck on a defended target.77installs44Triage ValidationRuns findings through validation gates and CVSS 3.1 quick reference to kill weak findings and protect N/A ratio before any report is written. A hunter uses it before writing any report.77installs45Hunt AtoHunts account-takeover vulnerabilities across nine distinct paths and their chains toward critical impact. A developer uses it when testing password reset, email change, MFA, OAuth, session, or JWT flows.76installs46Hunt CsrfHunts modern CSRF vulnerabilities including SameSite bypasses, JSON CSRF, and CSWSH targeting state-changing actions. A developer uses it when testing auth flows, account-linking, and cross-origin POST endpoints.76installs47Hunt Llm AiHunts LLM and AI feature vulnerabilities including prompt injection, indirect injection, and exfiltration via tool-use or markdown. A developer uses it when testing chatbots, RAG systems, agentic copilots, or MCP tools.76installs48Hunt MiscHunts miscellaneous vulnerabilities spanning access-control failures, information disclosure, and session and auth logic bugs. A developer uses it as a catch-all when hunting outside the named vuln-class skills.76installs49M365 Entra AttackClaude BugHunter provides a self-contained skill bundle for authorized security testing of Microsoft 365 and Entra infrastructure. It includes enterprise identity attack patterns and integration with Burp Suite for comprehensive penetration testing workflows.76installs50Apk Redteam PipelineRuns an end-to-end Android APK red-team pipeline covering acquisition, decompilation, secret extraction, exported-component enumeration, and Frida instrumentation. A developer uses it when a target has a mobile app in scope for an authorized security assessment.74installs51Hunt NodejsGuides testing of Node.js/Express/Fastify/NestJS targets for prototype pollution to RCE chains, command injection, SSTI, and env-var exfil. A pentester or bug bounty hunter loads it when the target runs a Node.js backend.55installs52Hunt NosqliGuides NoSQL injection testing using MongoDB operators ($where, $regex, $ne), CouchDB, and Redis command injection for auth bypass and data extraction. A hunter uses it when the target runs MongoDB/Mongoose or shows NoSQL error messages.54installs53Hunt Source LeakReconstructs source and discovers attack surface from leaked source maps, build info, and exposed config at the start of recon. A hunter uses it early in every engagement to unlock the wider attack surface.54installs54Hunt Brute ForceHunts missing or weak rate-limiting flaws including brute force, credential stuffing, and username enumeration. A developer uses it when testing login, OTP, and password-reset endpoints for throttling gaps.53installs55Hunt CicdHunts CI/CD pipeline vulnerabilities across GitHub Actions, Jenkins, GitLab CI, and cloud OIDC trust policies. A developer uses it when a target has public repos, exposed CI dashboards, or reachable build artifacts.53installs56Hunt DeserializationHunts insecure deserialization leading to remote code execution across Java, PHP, Python, .NET, and Ruby stacks. A developer uses it when a target runs a serialization-based framework.53installs57Hunt GrpcHunts gRPC vulnerabilities such as enabled reflection, missing authentication on internal endpoints, and edge-auth trust collapse. A developer uses it when a target exposes HTTP/2 gRPC services or a microservice architecture.53installs58Hunt K8sHunts Kubernetes and Docker vulnerabilities including anonymous API access, kubelet RCE, and container escapes. A developer uses it when a target runs containerized infrastructure or exposes K8s ports.53installs59Hunt LdapHunts LDAP injection and XPath injection covering authentication bypass and blind attribute exfiltration. A developer uses it when a target uses LDAP/AD authentication, directory-backed SSO, or XML data stores.53installs60Hunt Open RedirectTests URL parameter manipulation, JavaScript redirect, meta refresh, and header injection for open redirects, then chains them to higher-impact ATO. A hunter uses it when finding redirect bugs or building account-takeover chains.53installs61Hunt Tls NetworkTests for missing HSTS, weak ciphers, SPF/DKIM/DMARC gaps, and AXFR while honestly triaging best-practice noise from reportable findings. A hunter uses it during recon to find infrastructure weaknesses worth reporting.53installs62Hunt WebsocketTests WebSocket handshakes and messages for CSWSH, missing per-message auth, tampering, and Upgrade smuggling. A hunter uses it when a target has ws://, socket.io, SignalR, or real-time features.53installs63Hunt CorsHunts CORS misconfigurations where an attacker-controlled origin can perform a credentialed cross-origin read of sensitive data. A developer uses it when testing APIs or SPAs that emit Access-Control headers.52installs64Hunt DomHunts client-side DOM vulnerabilities including DOM clobbering, PostMessage hijacking, service-worker abuse, and CSS exfiltration. A developer uses it when hunting DOM-XSS or client-side token theft without server interaction.52installs65Hunt Host HeaderHunts Host header injection leading to password-reset poisoning, cache poisoning, routing-based SSRF, and OAuth poisoning. A developer uses it on forgot-password flows, CDN-fronted apps, and OAuth endpoints.52installs66Hunt LaravelHunts Laravel-specific vulnerabilities such as debug-mode Ignition RCE, exposed Telescope dashboards, and env leakage. A developer uses it when a target runs the Laravel PHP framework.52installs67Hunt LfiHunts local and remote file inclusion and path traversal, including filter-chain RCE and wrapper abuse. A developer uses it when hunting file-include or path-traversal bugs on any target.52installs68Hunt NextjsHunts Next.js-specific vulnerabilities including Server Actions auth bypass, middleware bypass, and Image Optimization SSRF. A developer uses it when a target runs Next.js 13/14/15 or a React SSR framework.52installs69Hunt SessionGuides session-management testing with two real sessions, body-diffing, and OOB confirmation for theft chains. A hunter uses it when testing login, logout, and token-lifecycle behavior on a target.52installs70Hunt SpringbootTests Spring Boot targets for Actuator exposure, Spring4Shell, Spring Cloud Function SpEL, and Jolokia JMX issues. A hunter uses it when a target runs Spring Boot per its headers or Whitelabel error page.52installs71Hunt Ntlm InfoExtracts reconnaissance from NTLM/Negotiate information disclosure on internet-reachable Windows enterprise infrastructure via the AV_PAIRS structure. A red-teamer uses it when a target advertises WWW-Authenticate: NTLM or Negotiate headers anonymously.51installs