Create structured target models for bug bounty reconnaissance.
npx skills add https://github.com/AshtonVaughan/bountyhound --skill target-research
Please help me install this Agent Skill. Skill: target-research Source: https://github.com/AshtonVaughan/bountyhound/tree/main/bountyhound/skills/target-research Command: npx skills add https://github.com/AshtonVaughan/bountyhound --skill target-research
Build a structured target model for bug bounty programs to standardize reconnaissance scope and planning.
Provide the program handle and target domain to generate a recon-ready target model.
High-intent search queries and answers about installing and using this skill.
A bug bounty target model captures domains, endpoints, tech stack, and authentication details in a standardized schema. It provides an ordered, time-bounded recon workflow including fingerprinting, subdomain enumeration, port scanning, and JS analysis to accelerate findings.
You need a target model for vulnerability hunting during initial recon across programs, domains, and assets. It standardizes scope and planning by recording attack surface details, hypotheses, and timestamps to guide compliant testing within defined timeframes.
To start building a target model, provide the bug bounty program handle and target domain. This generates a ready-to-use model with a guided recon sequence covering subdomain enumeration, port scanning, JS analysis, and source discovery.
Yes, you can use a standardized target model for time-bounded reconnaissance. It provides an ordered sequence of recon steps designed to accelerate findings while keeping your attack flow focused and compliant within allocated timeframes.
Yes, the target model schema supports tracking authentication and attack surface details. It standardizes records for domains, endpoints, tech stack, and authentication, while also logging last_updated timestamps and testing hypotheses.
cuongnguyen-gitRun scope-restricted bug bounty recon for subdomains, live hosts, endpoints, JS assets, and CVEs.
Liberty91LTDQuery the Shodan API for host information and banners.
wgpsecEnumerate subdomains, scan ports, fingerprint assets, and validate POCs.
EntroVyxCompare recon findings across temporal waves to detect security regressions.
