skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

bug-bounty

Run a full bug bounty pipeline from reconnaissance to reporting.

5|Updated May 27, 2026
Search Tags:#security testing#reconnaissance#reporting#bug bounty#vulnerability hunting
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill bug-bounty-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bug-bounty
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/bug-bounty
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill bug-bounty-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the complex and multifaceted problem of bug bounty hunting, providing a comprehensive workflow for reconnaissance, learning, hunting, validation, and reporting vulnerabilities.

Core Features & Use Cases

  • Comprehensive Reconnaissance: Subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit.
  • Pre-Hunt Learning: Disclosed reports, tech stack research, mind maps, threat modeling.
  • Vulnerability Hunting: IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI.
  • A-to-B Bug Chaining: IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth.
  • Language-Specific Grep: JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap.
  • Reporting: 7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist.
  • Use Case: Ideal for bug bounty hunters looking to streamline their workflow and improve their chances of discovering and reporting high-quality vulnerabilities.

Quick Start

Start the bug bounty workflow by running the 'bug-bounty' skill and follow the full pipeline: Recon -> Learn -> Hunt -> Validate -> Report.

Frequently Asked Questions about bug-bounty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start bug bounty hunting with a full vulnerability discovery workflow?▼

Bug bounty hunting begins with comprehensive reconnaissance like subdomain enumeration, asset discovery, and fingerprinting. You then learn from disclosed reports, hunt for vulnerabilities, validate findings, and generate reports using provided templates.

What vulnerability types can I hunt for using a structured bug bounty pipeline?▼

You can hunt for IDOR, SSRF, XSS, authentication bypass, CSRF, race conditions, SQLi, XXE, GraphQL flaws, HTTP smuggling, cache poisoning, OAuth theft, SSTI, subdomain takeover, and cloud misconfigurations using structured methodologies.

How do I chain vulnerabilities like IDOR to auth bypass during bug bounty hunting?▼

Vulnerability chaining maps attack paths like IDOR to auth bypass, SSRF to cloud metadata, XSS to account takeover, and open redirect to OAuth theft. This methodology amplifies individual bug impact during security testing.

Do I need Python to perform reconnaissance and run bug bounty scripts?▼

Yes, Python is required to execute bug bounty scripts and reconnaissance tools. The workflow includes Python-based scripts for subdomain enumeration, asset discovery, fingerprinting, and source code auditing to identify vulnerabilities.

How should I validate and report security vulnerabilities found during reconnaissance?▼

Validate vulnerabilities using 4 validation gates and the 7-Question Gate, then report them using templates by vulnerability class, CVSS 3.1 scoring, PoC generation, and a submission checklist to ensure high-quality reporting.

Can I use grep rules for language-specific security testing like JS prototype pollution?▼

Yes, language-specific grep rules target vulnerabilities like JS prototype pollution, Python pickle deserialization, PHP type juggling, Go template HTML injection, and Ruby YAML load flaws during source code auditing and security testing.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

auto-hunt

Automate bug bounty hunting from reconnaissance through exploitation and reporting.

Community
Advanced
grivera82grivera82

report-writing

Standardize vulnerability reports with structured sections and CVSS scoring.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
langbyyilangbyyi
96

business-logic-vulnerabilities

Identifies high-severity business logic vulnerabilities in web applications.

Community
Advanced