bug-bounty-methodology

The saved excerpt is a snapshot from review. The external source remains the complete and most current version.

---
name: bug-bounty-methodology
description: Target-agnostic bug bounty hunting methodology with parallel recon, systematic testing workflows, and vulnerability-specific exploitation guidance
contributor: buttercupck
---

# Bug Bounty Methodology Skill

## Overview

This skill provides a complete, target-agnostic bug bounty hunting methodology inspired by industry experts like Hadx and Daniel Miessler. It emphasizes systematic reconnaissance, parallel execution for efficiency, and vulnerability-specific testing workflows that apply to any web application target.

## Core Philosophy

**Three-Phase Approach:**
1. **Intelligence Gathering** (Passive Recon) - No direct target interaction
2. **Active Enumeration** - Verification and endpoint discovery
3. **Targeted Exploitation** - Vulnerability-specific testing based on findings

**Key Principles:**
- Target-agnostic workflows that apply universally
- Parallel agent execution for 5-7 hour tasks completed in ~1 hour wall time
- Systematic documentation of all findings
- Prioritization based on bug bounty program criteria
- Reproducible steps with exact commands

## Skill Invocation Patterns

When the user requests bug bounty work, route to appropriate workflow based on intent:

### Starting New Target Reconnaissance
**User says:** "Start bug bounty recon on [target]" or "Begin reconnaissance for [target]"

**Action:**
1. Read `targets/{target}.md` for scope and context
2. Identify required recon phases (passive, active, js-analysis, mobile)
3. Propose spawning parallel agents for each phase
4. Upon user approval, spawn agents via Task() tool
5. Each agent executes appropriate workflow and outputs to target directory
6. Synthesize findings into prioritized attack roadmap

### Continuing Existing Work
**User says:** "Continue testing [target]" or "Resume [target] work"

**Action:**
1. Read latest findings from `LEARNING/targets/{target}/`
2. Review attack roadmap or previous session notes
3. Identify next priority testing phase
4. Route to appropriate testing workflow

### Specific Vulnerability Testing
**User says:** "Test GraphQL on [target]" or "Check for IDOR in [target] API"

**Action:**
1. Load appropriate testing workflow (`test-graphql.md`, `test-rest-api.md`, etc.)
2. Read target context and discovered endpoints
3. Guide through systematic testing checklist
4. Document findings in target-specific location

### New Target Setup
**User says:** "Add new target [name]" or "Set up [target] for bug bounty"

**Action:**
1. Create new target file from `targets/template.md`
2. Guide user through scope definition
3. Help capture authentication details
4. Document program-specific criteria (payout ranges, exclusions)

## Workflow Routing Logic

### Reconnaissance Phase
- **Passive Recon** → `workflows/recon-passive.md`
  - Subdomain enumeration (crt.sh, subfinder, amass)
  - Technology fingerprinting (Wappalyzer, whatweb)
  - Source code intelligence (GitHub, JavaScript analysis)
  - Mobile app static analysis

- **Active Recon** → `workflows/recon-active.md`
  - Subdomain verification (httpx, dnsx)
  - Web application mapping (gospider, Burp Suite)
  - API endpoint discovery (fuzzing, JavaScript extraction)
  - GraphQL detection and introspection

- **JavaScript Analysis** → `workflows/analyze-javascript.md`
  - Bundle extraction and beautification
  - Endpoint discovery from JS
  - Secret scanning (API keys, tokens)
  - Client-side logic analysis

- **Mobile Analysis** → `workflows/analyze-mobile.md`
  - APK/IPA decompilation
  - String extraction and analysis
  - Hardcoded endpoint discovery
  - Mobile-specific API differences

### Testing Phase

Route based on discovered technology stack and vulnerability category:

- **GraphQL endpoints** → `workflows/test-graphql.md`
- **XSS (Cross-Site Scripting)** → `workflows/test-xss.md`
- **REST APIs** → `workflows/test-api.md`
- **Authentication systems** → `workflows/test-authentication.md`
- **Payment/business logic** → `workflows/test-b