skills.rest
hataiit9x
hataiit9xCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

credential-attack

Generate wordlists and execute password spraying against login endpoints.

3|Updated Jul 6, 2026
Search Tags:#osint#bug bounty#password spray#credential testing#security recon
One-click install
npx skills add https://github.com/hataiit9x/Bbkit-AI --skill credential-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-attack
Source: https://github.com/hataiit9x/Bbkit-AI/tree/main/ref/claude-bug-bounty/skills/credential-attack
Command: npx skills add https://github.com/hataiit9x/Bbkit-AI --skill credential-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill aids in the discovery and exploitation of valid credentials in bug bounty campaigns, guiding when and how to execute credential attacks efficiently and legally.

Core Features & Use Cases

  • Password Spray Methodology: Aids in identifying whether a credential attack is warranted for a target, and offers the framework for conducting it.
  • Wordlist Generation & Breach Checks: Generates and enriches wordlists, and checks passwords against breaches to identify strong candidates for spray.
  • OSINT & Employee Usernames: Gathers information about potential employees, expanding the pool of usernames to be targeted.
  • Spray & Authentication: Executes password spray against login endpoints, and upon finding valid credentials, aids in authenticating for deeper recon.
  • Legal & Operational Guidance: Provides a legal and operational framework for credential testing, including best practices and pitfalls.

Quick Start

Execute a password spray on a target by using the command: bb spray example.com

Frequently Asked Questions about credential-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a password spray attack for bug bounty testing?▼

Password spray attacks for bug bounty testing are executed using the command 'bb spray example.com'. This framework handles wordlist generation, breach checks, and OSINT data to systematically guess and validate credentials against login endpoints.

Can I use OSINT to gather employee usernames for credential testing?▼

Yes, OSINT is utilized to gather information about potential employees, expanding the username pool for credential testing. This data is combined with generated wordlists to identify strong password candidates for spraying authentication endpoints.

What is the best way to generate wordlists and check passwords against breaches?▼

The best way to generate wordlists and check passwords against breaches involves using this Skill's automated framework. It enriches wordlists and validates passwords against known breaches to identify strong candidates for your spray campaign.

When do I need a legal framework for executing credential attacks?▼

A legal framework for credential attacks is required whenever you test authentication and authorization bypass in bug bounty campaigns. This Skill provides operational guidance and best practices to ensure your password spraying remains within legal boundaries.

Does this password spray methodology support authentication bypass validation?▼

Yes, the password spray methodology supports authentication bypass validation. Upon finding valid credentials, it aids in authenticating for deeper reconnaissance within the target system while operating within bug bounty program confines.

Related Skills

wgpsecwgpsec
1.6k

ad-domain-attack

Simulate Active Directory domain attack paths with concrete commands and safety guards.

Official
Advanced
Prohao42Prohao42
120

api-sec

Route API security testing to relevant sub-skills via the Skill Map.

Community
Intermediate
cloudlinesscloudliness

sherlock

Search 400+ social networks for public accounts by username.

Community
Intermediate
EntroVyxEntroVyx
3

hunt-brute-force

Identify and validate rate-limiting vulnerabilities in web authentication and API security workflows.

Community
Advanced