elementalsouls/Claude-BugHunter✦ 精选0°

bug-bounty

仓库创建 2026年5月5日最近提交 4 天前SkillHot 收录 20 天前

⬈ GitHub 仓库 ⬈ SKILL.md 原文件 ⬇ Raw 原始文件

▸ 精选理由

一份面向实战的端到端流程指南，适合系统化开展漏洞狩猎与复盘。

▸ 风险提示

含具体漏洞利用思路与测试方法，可能被滥用，务必在授权范围内执行。

这个 Skill 做什么

覆盖从资产发现到报告的完整漏洞赏金工作流与实战策略。

把漏洞赏金的全流程讲清楚：从 Recon、资产指纹、源码审计到实战漏洞挖掘、验证和写报告一条龙。适合想把 bug bounty 做成系统化工作的人，涵盖 IDOR、SSRF、XSS、链式挖掘和 LLM/AI 测试等常见场景。核心原则是只关注“现在能被真实用户利用并造成实害”的漏洞，避免浪费在无影响的问题上。

▸ 展开 SKILL.md 英文原文

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question

垂直行业漏洞赏金全流程测试指南通用

3.1k

Stars

480

Forks

仓库内 Skill

+245

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/bug-bounty/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/bug-bounty/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

## THE ONLY QUESTION THAT MATTERS

> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"**
>
> If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**

### Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason |
|---|---|
| "Could theoretically allow..." | Not exploitable = not a bug |
| "An attacker with X, Y, Z conditions could..." | Too many preconditions |
| "Wrong implementation but no practi

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有