From cybersec-toolkit
Scope-aware bug bounty recon methodology covering passive enumeration, subdomain discovery, asset attribution, tech stack fingerprinting, and content discovery. Use at the start of a bounty engagement.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:bounty-reconThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Before running any tool:
Before running any tool:
If on HackerOne / Bugcrowd, parse the scope CSV. Out-of-scope hits cost reputation.
# Subdomain via cert transparency
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
# Subdomain via passive sources
amass enum -passive -d target.com
subfinder -d target.com -all -silent
assetfinder --subs-only target.com
findomain -t target.com
# Combined
echo target.com | tlsx -san -cn -silent | sort -u
GitHub / GitLab / Postman dorking:
# tools in registry
gitleaks detect --source=. --no-git
trufflehog github --org=target-org
# Manual:
# site:github.com "target.com" password
# site:postman.com "target.com"
OSINT layer:
whois target.comwhois -h whois.cymru.com " -v target.com"domainmonster, viewdns.infowaybackurls target.com | sort -u > wayback.txtgau target.comSubdomain bruteforcing — only if scope allows:
# DNS bruteforce
shuffledns -d target.com -w wordlists/dns.txt -r resolvers.txt
# Permutation
gotator -sub subs.txt -perm permutations.txt | shuffledns -r resolvers.txt
Live host probing:
cat all_subs.txt | httpx -silent -title -tech-detect -status-code -ip > live.txt
Port scan (only if scope allows full port range):
# Top ports
naabu -list ips.txt -top-ports 1000 -silent
# Full
masscan -iL ips.txt -p 1-65535 --rate=1000 # respect rate limits
Content discovery — chain with httpx output:
ffuf -w wordlist.txt -u https://FUZZ.target.com -mc 200,301,302,403
# OR per-host
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc all -fc 404
whatweb -a 3 https://target.com
nuclei -l live.txt -t technologies/ # nuclei tech detection
wappalyzer-cli https://target.com
JS analysis (where modern apps leak the most):
# Endpoint extraction
katana -u https://target.com -jc -silent | tee endpoints.txt
LinkFinder -i https://target.com/main.js -o cli
# Secret in JS bundles
trufflehog filesystem ./js_dumps/
nuclei -l live.txt -t exposures/
When you find a subdomain/asset, confirm it belongs to the target:
Out-of-scope reporting wastes the program's time and your reputation.
Track everything in a flat directory:
target/
├── domains.txt # all subdomains (passive + active)
├── live.txt # 200/301/403 alive
├── tech.txt # whatweb output
├── endpoints.txt # crawled URLs
├── js_secrets.txt # trufflehog hits
├── ports.txt # naabu/masscan
└── notes.md # running observations
Once recon settles:
bounty-webbounty-apibounty-mobilenpx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitAutomates reconnaissance pipelines for bug bounty hunting: subdomain enumeration, live host discovery, tech fingerprinting. Uses Amass, Subfinder, httpx, Nuclei.
Automates web2 asset discovery: subdomain enumeration (subfinder, Chaos, assetfinder), live host probing (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), and continuous monitoring. Use for subdomain enumeration, attack surface mapping, or any web recon starting point.
Performs structured reconnaissance and attack surface enumeration for authorized pentests, CTFs, and bug bounty programs. Handles passive recon (DNS, WHOIS, certificate transparency, dorking), active scanning (nmap, web content discovery, SSL analysis), and organizes findings into an actionable map.