skills.rest
zer0xhamid
zer0xhamidCOMMUNITY
Explore all skills by this author →
GitHub

bug-bounty

Automate end-to-end bug bounty workflows from recon through reporting.

1|Updated Mar 19, 2026
Search Tags:#reporting#threat-modeling#workflows#bug-bounty#recon#vulnerability-hunting#ai-security-testing
One-click install
npx skills add https://github.com/zer0xhamid/LogicHunter_v2 --skill bug-bounty-zer0xhamid
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bug-bounty
Source: https://github.com/zer0xhamid/LogicHunter_v2/tree/main/skills/bug-bounty
Command: npx skills add https://github.com/zer0xhamid/LogicHunter_v2 --skill bug-bounty-zer0xhamid

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill consolidates recon, learning, hunting, and reporting into an end-to-end bug bounty workflow, reducing fragmentation and accelerating engagements.

Core Features & Use Cases

  • Recon workflows: subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit
  • Pre-hunt learning: disclosed reports, tech stack research, mind maps, threat modeling
  • Vulnerability hunting: IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI
  • LLM/AI security testing: chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10
  • A-to-B bug chaining: IDOR → auth bypass, SSRF → cloud metadata, XSS → ATO
  • Reporting: templates and validation gates to structure findings and reports

Quick Start

Start by mapping recon data, then apply learn, hunt, validate, and report steps to close a target with a formal submission.

Frequently Asked Questions about bug-bounty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate recon and vulnerability hunting workflows for bug bounty targets?▼

Automate bug bounty workflows by mapping recon data through subdomain enumeration, asset discovery, and fingerprinting, then applying structured learn, hunt, validate, and report steps to close engagements.

Can I test for LLM prompt injection and AI security vulnerabilities during a bug bounty hunt?▼

Yes, you can test LLM security by hunting for chatbot IDOR, prompt injection, ASCII smuggling, exfil channels, and RCE via code tools using dedicated validation gates within the workflow.

What is the best way to chain multiple vulnerabilities like IDOR and SSRF for account takeover?▼

Chain vulnerabilities by linking isolated flaws such as IDOR to auth bypass, SSRF to cloud metadata, or XSS to ATO, structuring the combined exploit chain through validation gates before reporting.

How do I structure bug bounty reports after finding auth bypass and race conditions?▼

Structure bug bounty reports using templated outputs and validation gates to formalize findings for auth bypass, race conditions, and other vulnerabilities into a submission-ready format.

Do I need HackerOne scope and disclosed reports to start pre-hunt threat modeling?▼

Yes, pre-hunt threat modeling requires HackerOne scope and disclosed reports to research tech stacks and build mind maps, ensuring targeted vulnerability hunting before validation.

Related Skills

Explore More Software Engineering Skills→
chrismcmackenchrismcmacken

review-artifacts

Triage artifact scan results to surface reportable bug bounty findings.

Community
Intermediate
sseshachalasseshachala

bug-bounty

Run an end-to-end bug bounty workflow from reconnaissance to validated reporting.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

bug-bounty

Automate subdomain enumeration, asset discovery, and vulnerability hunting workflows.

Community
Advanced
Awannaphasch2016Awannaphasch2016

webapp-testing

Automate local web application testing with Playwright Python scripts.

Community
Intermediate