Hunt vulnerabilities in bug bounty programs

This skill runs a disciplined, five-phase bug bounty workflow instead of ad hoc target poking. Phase 1 (Intake) captures a program's in-scope and out-of-scope assets, payout tiers, disclosure window, retest policy, and required test headers, and prioritizes attack types by measured hit rate within the available time window (password reset 88%, arbitrary-account access 86.4%, withdrawal flows 83.1% in a 6-hour window; broader coverage for a full day or a major event). Phase 2 (Recon) gathers intelligence without sending traffic to the target - certificate-transparency logs, Wayback/CommonCrawl snapshots, GitHub secret searches, search-engine dorks, ASN/IP ranges, and favicon-hash pivoting. Phase 3 (Enum) does active asset discovery - subdomain and liveness enumeration, screenshots, content discovery, technology fingerprinting (including a dictionary of Chinese-vendor software fingerprints), JS extraction, and subdomain-takeover checks. Phase 4 (Hunt) routes to one of 19 attack-type playbooks (unauthorized access, information disclosure, arbitrary-object authorization, business-logic flaws, OAuth/SAML/JWT, REST API abuse, SQLi, RCE, SSRF, path traversal, file upload, XSS, HTTP smuggling, GraphQL, race conditions, DoS, mobile, LLM prompt injection, internal post-exploitation), each combining methodology, parameter-frequency data, real HackerOne case studies, structured payloads, and WAF-bypass variants. Phase 5 (Report) uses a three-part template - a precise title, reproducible steps with evidence, and impact plus remediation scored with CVSS 4.0.

Use it when hunting for vulnerabilities in a bug bounty or SRC program within that program's stated policy, when a user hands you a URL or API endpoint to test under a named program, or when the task matches patterns like privilege escalation on arbitrary accounts, password-reset logic, WAF bypass, or unauthenticated exposure (Actuator, Spring endpoints, default credentials, unauthenticated Redis). It gates every active command the same way: state the exact target, confirm written authorization and scope, show the command and its effect, and wait for explicit confirmation - without that it stays read-only and defensive-guidance-only. It is not for pure white-box source-code audit (a separate code-audit skill covers that), for general vulnerability-remediation Q&A, or for a standalone CTF challenge, since this workflow targets real, in-scope programs.

• 19 attack-type playbooks, each ending with a top-12 table of real, publicly disclosed HackerOne High/Critical reports for that class.
• 305 structured payloads (177 web, 128 internal-network) and 263 WAF/EDR-bypass steps across 23 attack categories.
• 6 general methodology documents (attack-value prioritization, a bypass decision tree, black-box evidence discipline, control-gap hunting across 9 sensitive-operation classes, and time-boxed priority templates for 6-hour/single-day/major-event windows).
• Industry-vertical playbooks for banking/payments and telecom/ISP targets, plus a dictionary of default credentials and fingerprints for common Chinese-vendor OA and middleware products.
• Optional local MCP tool integration (a curated 134-tool profile, activated on demand rather than loading the full 386-tool/40K-token set).
• An explicit legal red-line list per playbook: stop immediately and report on out-of-scope assets, never exfiltrate real PII (prove access, then destroy it), cap proof-of-concept traffic at 1-3 requests with no sustained load, verify authorization flaws only on your own two accounts, and never submit an unreproduced claim without HTTP evidence.

Bug bounty hunters and SRC program participants who want a repeatable, evidence-disciplined methodology - from scope intake through a submittable report - rather than unstructured target probing.