THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.
中文简介正在准备中。当前显示原文说明。
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
Satu skill untuk semua bug bounty. Merge dari: arsenal 69-skill zip + SYADAGENTIC-bugbounty v7.1 + submission review gate.
Authorized targets only (owned or in-scope bounty program). Working exploits over theory. Ship fast. No fabrication — real tool output or honest blocker.
Do this order. No skip. No early chat dump.
skills/, references under references/,
commands under commands/, agents under agents/, tools under tools/. Route per phase
via table below. Then execute.~/workspace/bug-hunter/public-reports/<project>/, rebuild hub.
SS: real browser on live target (URL bar = target) or rendered code SS
when bug is not browser-visible.gas
before any platform submit (H1/Sherlock/Cantina/Discord).| Fase | Tipe | Sub-skill / reference |
|---|---|---|
| Scope & Policy | Semua | skills/bounty-policy-agent · responsible-disclosure-off-program · skills/bb-methodology |
| Recon | Web/API | skills/web2-recon · shodan-reconnaissance · subdomain-takeover · crawl4ai-recon · manual-recon-cors-leaks · skills/web2-recon |
| Recon | SC/Web3 | bughunter-os (phase1) · entry-point-analyzer · solana-scanner · on-chain-forensics |
| Attack Surface | Web/API | api-fuzzing-bug-bounty · http2-attacks · webhunter-os (phases 1-3) |
| Attack Surface | SC | attack-surface-mapper · entry-point-analyzer (solidity/vyper/move/solana/ton/cosmwasm) |
| Bug Discovery | Web/API | webhunter-os (pattern libs) · skills/web2-vuln-classes · xss-scanner · xss-html-injection · sql-injection-testing · html-injection-testing · code-injection-detector · sqlmap-database-pentesting |
| Bug Discovery | SC | bughunter-os (attack patterns) · smart-contract-audit · solidity-security · sc-vulns · skills/web3-audit · web3-audit/* |
| Bug Discovery | Crypto | crypto-ctf-solving · ctf-crypto · encrypt-decrypt |
| Chain Analysis | Semua | attack-chaining-core · attack-chain-web2 · attack-chain-web3 · variant-discovery |
| Exploit Dev | Web/API | exploitability-analyzer · exploit-to-confirm · vulnerability-scanner |
| Exploit Dev | SC | bughunter2 (PoC phase) · evm-fuzzing-resources · web3-audit/rounding-zero-shortcut-exploit |
| Verification | Semua | verifier-agent · security-finding-triage · root-cause-analyzer · skills/triage-validation |
| Evidence | Semua | evidence-packager (manifest + bundle layout) |
| Report | Semua | security-finding-triage (final) · skills/report-writing · bug-hunter-report |
| Pre-Submit GATE | Semua | submission-gate · skills/triage-validation (7-Question Gate) — WAJIB |
| Guardrails | Semua | security-research-guardrail · guidelines-advisor |
skills/: bug-bounty (master), bb-methodology, web2-recon, web2-vuln-classes, security-arsenal, web3-audit, meme-coin-audit, report-writing, triage-validation, cicd-security, credential-attack, graphql-audit, mobile-pentestcommands/: hunt, recon, chain, cloud-recon, bypass-403, xxsbypass, breach-check, intel, pickup, remember, godmode, genjson, wafcheck, fuzz, auth-tests, etc.agents/: recon-agent, recon-ranker, validator, token-auditor, web3-auditor, chain-builder, report-writer, credential-hunter, autopilotskills/report-writing → templates per platform (H1/Bugcrowd/Intigriti/Immunefi)
wordlists/, MCP clients in mcp/ (Burp, Caido, HackerOne)references/ (50+ files: recon, vuln classes, reporting, verification,
grpc-web, graphql, oauth, waf-bypass, subdomain & storage probing, evidence hub, smart-contract
bounty audit workflow)🔴 Critical — direct loss of funds, no constraints · 🟠 High — loss with constraints / permanent freeze · 🟡 Medium — DoS, griefing, logic errors · 🟢 Low — minor / gas · 🔵 Info — best practice. Web: use CVSS 3.1/4.0.
gas required.forge test, fork with anvil --fork-url).还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
中文简介正在准备中。当前显示原文说明。
Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.
中文简介正在准备中。当前显示原文说明。
Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.
中文简介正在准备中。当前显示原文说明。
Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.
中文简介正在准备中。当前显示原文说明。
Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.
中文简介正在准备中。当前显示原文说明。
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."
中文简介正在准备中。当前显示原文说明。