hackskills-bugbounty-hunter

HACKING SKILLS / HackSkills — Bug Bounty Hunter

Overview

This is an entry-point skill for bug bounty, web security, API security, authorized penetration testing .

Its core role is not to replace all specialized techniques, but to help the Agent:

first determine the testing phase (Recon / validation / privilege escalation / exploit chain)
then choose the correct vulnerability category
avoid relying only on basic training data and prioritize using structured methodologies
prioritize boundary conditions that AI tends to overlook but are important in real-world practice

This knowledge base emphasizes content safety and auditability.
When using it, it should be limited to authorized targets、legitimate research、defensive validation、what bug bounty rules permit .
Do not use the techniques here for unauthorized attacks.

Prioritize using this skill in the following scenarios:

You have just taken over a new bug bounty target and do not know what to test first
You need to decide which type of approach to load, such as XSS / SQLi / SSRF / IDOR / JWT / API
You want the Agent to conduct web/API security testing according to a more stable methodology
You need to route scattered phenomena to the appropriate attack surface
You hope AI will miss fewer key testing points in the security field

Prioritize collecting:

Target type: traditional web, REST API, mobile backend, admin panel, payment flow, file upload, GraphQL
Identity and permission model: anonymous, regular user, administrator, multi-tenant
Input locations: URL, query parameters, JSON, Header, Cookie, filenames, imported files, templates, reflection points
Output locations: HTML, attributes, JS, PDF, email, logs, background tasks, mobile interfaces

Phenomenon	Priority direction
Input reflected into HTML / JS	XSS / SSTI
The server actively accesses a URL / hostname	SSRF
Receives XML / Office / SVG	XXE
Paths, filenames, and download interfaces are controllable	Path Traversal / LFI
Large numbers of object IDs in the API	IDOR / BOLA / BFLA
Login, password recovery, 2FA, Session	Auth Bypass / JWT / OAuth
Multi-step transactions, coupons, prices, inventory	Business Logic
MongoDB / JSON query syntax exposed	NoSQL Injection
Command-line tools, image processing, importers	Command Injection

If you have the full repository, prioritize using it together with these specialized documents:

These points are easily overlooked by many foundation models but are often effective in real bug bounties:

The same filtering logic is often reused across multiple pages: if one point can be bypassed, similar pages can usually be bypassed as well.
Parameter names themselves are also an attack surface: WAFs often only watch parameter values, not parameter names.
Second-order vulnerabilities are very common: being safe at storage time does not mean it is still safe when read into a dangerous context.
The essence of BOLA is “authenticated but unauthorized”: replaying by switching between A/B accounts is very critical.
Old-version interfaces are the easiest to miss patches: fixing v2 does not mean v1 has been taken offline.
Business logic vulnerabilities often yield the highest rewards: they are hard for scanners to find and more likely to persist over time.
Race Condition testing should prioritize "one-time" operations: coupons, claiming, resets, invitations, trials, inventory deductions.
For JWT attacks, first look at the key and algorithm context: do not blindly try payloads; first confirm alg、kid, JWKS, key sources.

You can use this skill as a router; first have the Agent clarify the phase and objective:

"First, use the bug bounty methodology to help me plan a testing route for this target."
"This is a REST API; please prioritize reviewing it from the perspectives of BOLA, BFLA, Mass Assignment, and JWT."
"This parameter triggers a server-side request; please list the key verification points following the SSRF approach."
"This feature is a payment/coupon/inventory flow; please prioritize business logic and race conditions."
"I only see the login and password recovery flows; please analyze following the Auth Bypass + OAuth/JWT + CSRF route."

Recommended skill name:

Recommended search keywords:

Route by target type and symptoms first, rather than randomly enumerating payloads.
Prioritize finding reusable filters, shared components, and cross-page reproduction paths.
First confirm the authentication boundary, authorization boundary, and version boundary, then go deeper into exploitation.
Prioritize preserving an explainable, reviewable, and reproducible testing process.
When the full repository is available, prioritize returning to the specialized documentation for more detailed attack specifics.