Implement the 5-stage Funnel workflow (Notes → Leads → Primitives → Findings → Reports) for structured bug bounty hunting. Based on Critical Thinking Bug Bounty Podcast Episode 166.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
"Structure your hacking data like a sales funnel. Raw observations at the top, polished reports at the bottom." — Critical Thinking Podcast, Ep. 166 [37:42]
flowchart TB
N["📝 NOTES<br/>(All raw observations)"]
L["🔍 LEADS<br/>(Interesting patterns)"]
P["🔧 PRIMITIVES / GADGETS<br/>(Reusable techniques & entry points)"]
F["🐛 FINDINGS<br/>(Confirmed vulnerabilities)"]
R["📄 REPORTS<br/>(Submission-ready documentation)"]
N --> L --> P --> F --> R
style N fill:#1a1a2e,stroke:#e94560,color:#fff
style L fill:#1a1a2e,stroke:#f9a826,color:#fff
style P fill:#1a1a2e,stroke:#16c79a,color:#fff
style F fill:#1a1a2e,stroke:#11999e,color:#fff
style R fill:#1a1a2e,stroke:#6c5ce7,color:#fff
Everything goes here. No filtering. No judgment. Write it down NOW, evaluate LATER.
Directory structure:
target-name/
├── notes/
│ ├── 2025-01-15-initial-recon.md
│ ├── 2025-01-15-auth-flow-analysis.md
│ ├── 2025-01-16-api-endpoint-mapping.md
│ └── 2025-01-16-js-source-review.md
Note template:
# [Date] [Topic]
## Context
- Target: [subdomain/endpoint/feature]
- Tool used: [Burp/Browser DevTools/ffuf/etc]
- Time spent: [duration]
## Observations
- [Observation 1]
- [Observation 2]
## Raw Data
[Paste interesting requests/responses/code snippets here]
## Gut Feeling
- [ ] Worth investigating further
- [ ] Dead end
- [ ] Need more context
What belongs in Notes:
Leads are notes that survived initial triage. Something here is worth deeper investigation.
Promotion criteria (Notes → Leads):
| Signal | Example |
|---|---|
| Reflected user input | Parameter value appears in response body/headers |
| Inconsistent authorization | Different responses for same endpoint with different user roles |
| Verbose error messages | Stack trace leaking framework version, file paths |
| Unprotected API endpoints | /api/internal/ accessible without auth |
| Client-side security controls | JavaScript validation with no server-side enforcement |
| Unusual HTTP headers | X-Debug: true, X-Powered-By: Express 4.17.1 |
Lead template:
# LEAD: [Short Description]
## Source Note
- Link: [notes/2025-01-15-auth-flow-analysis.md]
## Hypothesis
[What vulnerability might this lead to?]
## Evidence
[Specific request/response or code snippet proving this is worth pursuing]
## Next Steps
1. [Action item 1]
2. [Action item 2]
## Priority: [HIGH / MEDIUM / LOW]
Primitives are common attack techniques or entry points you discover that can be reused across multiple targets. Think of them as building blocks for exploitation chains.
Examples:
| Primitive | Description | Reuse Potential |
|---|---|---|
| Unsigned JWT | Application accepts alg: none JWTs | Any endpoint using this auth |
| GraphQL Introspection | __schema query returns full type system | Enumerate all mutations |
| Predictable ID sequence | User IDs are sequential integers | IDOR on any user-scoped endpoint |
| Open redirect on login | /login?redirect= accepts any URL | OAuth token theft chain |
| File upload → path traversal | Upload filename is used in storage path | Write to any directory |
Primitive template:
# PRIMITIVE: [Technique Name]
## Description
[What is this technique and why does it work?]
## How to Detect
[Specific test to confirm this primitive exists on a target]
## Exploitation
[Step-by-step usage]
## Chain Potential
[What can this be combined with? SSRF + this = ? IDOR + this = ?]
## Seen On
- [Target 1] — [Date]
- [Target 2] — [Date]
A finding is a CONFIRMED bug with a working proof-of-concept. No speculation — only reproducible exploitation.
Promotion criteria (Leads → Findings):
Finding template:
# FINDING: [Vulnerability Type] in [Component]
## Severity: [Critical / High / Medium / Low]
## CVSS 4.0: [Score] — [Vector String]
## Summary
[2-3 sentences: what is broken, how it is exploited, worst-case impact]
## Proof of Concept
[Exact curl command / Burp request / script that reproduces the bug]
## Impact
[Specific business impact with numbers if possible]
## Root Cause
[Why does this vulnerability exist? Missing validation? Broken access control?]
## Remediation
[Specific code fix, not generic advice]
## Status: [CONFIRMED / SUBMITTED / TRIAGED / RESOLVED / DUPLICATE]
The final polished document submitted to the bug bounty platform. This is where money is made or lost.
Report quality directly correlates with bounty amount.
See the elite-report-writing skill for the full HackerOne-optimized report template.
Quick Report Checklist:
[VulnType] in [Component] Allows [BusinessImpact]Use Claude to automate transitions between stages:
Prompt to Claude:
"Review all files in notes/ and identify any that should be promoted to leads/.
For each promotion, create a lead file with hypothesis, evidence, and priority.
Explain why each note was or was not promoted."
Prompt to Claude:
"Take the finding in findings/idor-user-profiles.md and generate a
HackerOne-ready report in reports/. Use the elite report template.
Validate the CVSS score against the described impact."
programs/
└── example-corp/
├── .claudemd # Scope, policy, auth tokens (see ai-pair-hunting skill)
├── notes/ # Stage 1: Everything goes here
├── leads/ # Stage 2: Worth investigating
├── primitives/ # Stage 3: Reusable gadgets
├── findings/ # Stage 4: Confirmed bugs
├── reports/ # Stage 5: Submitted reports
└── scripts/ # Custom automation for this target
IMPORTANT: The 5-stage funnel is a framework, not a cage. You are expected to adapt it:
- Add sub-stages if a target is complex (e.g., Leads-High / Leads-Low).
- Create cross-references between primitives and findings.
- Auto-generate statistics (conversion rate: notes→findings).
- Build a "dormant leads" watchlist for findings that need updated tool versions.
Think like an attacker. Adapt. Improvise.
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
The English summary is being prepared. Showing the original description.
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
The English summary is being prepared. Showing the original description.
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
The English summary is being prepared. Showing the original description.
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
The English summary is being prepared. Showing the original description.
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
The English summary is being prepared. Showing the original description.
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
The English summary is being prepared. Showing the original description.