skills.rest
aivos-xie
aivos-xieCOMMUNITY
Explore all skills by this author →
GitHub

bug-bounty

Enumerate subdomains, probe HTTP services, and scan web applications for vulnerabilities.

1|Updated Jun 9, 2026
Search Tags:#vulnerability assessment#penetration testing#reconnaissance#bug bounty#vulnerability disclosure
One-click install
npx skills add https://github.com/aivos-xie/hermes-skills --skill bug-bounty-aivos-xie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bug-bounty
Source: https://github.com/aivos-xie/hermes-skills/tree/main/security/bug-bounty
Command: npx skills add https://github.com/aivos-xie/hermes-skills --skill bug-bounty-aivos-xie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, httpx, nuclei, ffuf, gau, katana, dnsx, naabu, interactsh-client, sqlmap, dalfox, linkfinder, graphql-cop, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive methodology for bug bounty hunting, streamlining the process of reconnaissance, exploitation, and report writing.

Core Features & Use Cases

  • Reconnaissance Pipeline: Offers a step-by-step guide for thorough enumeration of subdomains, DNS resolution, and active discovery of live domains.
  • HTTP Probing and Screenshots: Utilizes httpx for live HTTP service probing and captures screenshots, aiding in initial service mapping.
  • Port Scanning: Identifies open ports using naabu and provides a list of common interesting ports.
  • URL Discovery and Crawling: Uses katana and gau for comprehensive URL discovery and crawling.
  • Vulnerability Scanning: Incorporates nuclei for template-based scanning of web applications.
  • Directory Bruteforcing: Leverages ffuf for directory and subdomain discovery.
  • Manual Testing: Offers guidance on manual testing, including SSRF, XSS, SQL Injection, IDOR, and GraphQL testing.
  • Report Writing: Provides a structured template for reporting vulnerabilities, ensuring clarity and professionalism.

Quick Start

Use the bug-bounty skill to enumerate subdomains and perform reconnaissance on the domain 'example.com'.

Frequently Asked Questions about bug-bounty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate bug bounty reconnaissance and subdomain enumeration?▼

Automate bug bounty reconnaissance by chaining subfinder for subdomain enumeration, dnsx for DNS resolution, and httpx for live HTTP probing to map active services. This pipeline streamlines initial target mapping before deeper vulnerability scanning.

What is the best way to scan web applications for vulnerabilities during penetration testing?▼

Scan web applications for vulnerabilities by using nuclei for template-based scanning and ffuf for directory bruteforcing. This combination identifies common security misconfigurations and hidden endpoints during penetration testing.

Do I need to install external tools to use this vulnerability assessment methodology?▼

Yes, this vulnerability assessment methodology requires installing multiple external dependencies including subfinder, nuclei, sqlmap, and katana. These tools are necessary for executing the automated reconnaissance and manual testing techniques provided.

Can I test for SSRF, XSS, and SQL Injection using this bug bounty workflow?▼

Yes, the bug bounty workflow provides specific guidance on manual testing for SSRF, XSS, SQL Injection, IDOR, and GraphQL vulnerabilities. It integrates tools like sqlmap and dalfox to facilitate these manual testing techniques.

How should I structure a vulnerability disclosure report for bug bounty programs?▼

Structure a vulnerability disclosure report using the provided template to ensure clarity and professionalism. It organizes reconnaissance findings, exploitation steps, and manual testing results into a standardized format for bug bounty programs.

Related Skills

giosuetedeschi-specgiosuetedeschi-spec

Red Team Tools and Methodology

Automate web application reconnaissance and vulnerability discovery workflows.

Community
Advanced
utsavthakurutsavthakur

recon-and-methodology

Structure subdomain enumeration, service discovery, and vulnerability testing for bug bounty targets.

Community
Advanced
mlvpatelmlvpatel
1

ghost-recon

Automate web2 reconnaissance with subdomain enumeration, host discovery, URL crawling, directory fuzzing, and JavaScript analysis.

Community
Advanced
HelloEverybobyHelloEveryboby
17

WebSecurityTester

Orchestrate web security testing with Nmap, Sqlmap, and Nuclei.

Community
Intermediate