From claude-bughunter
Concrete probes, wordlists, regexes, dorks, and curl one-liners for authorized external recon: subdomain enumeration, API discovery, cloud bucket enumeration, CDN/WAF bypass, secret scanning, and more.
How this skill is triggered — by the user, by Claude, or both
Slash command
/claude-bughunter:offensive-osintThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
> **v3.0** — Refactored 2026-05-02 from a 4,168-line monolith into a lean SKILL.md (~400 lines) plus 15 modular reference files in `references/`. Detail content loads on demand — Claude reads only the reference files relevant to the current task.
README.mdreferences/breach-and-credentials.mdreferences/dork-corpus.mdreferences/helpers-and-automation.mdreferences/identity-fabric.mdreferences/people-osint.mdreferences/probes-and-wordlists.mdreferences/recon-stack.mdreferences/recon-techniques.mdreferences/saas-public-surfaces.mdreferences/secret-patterns.mdreferences/secret-validators.mdreferences/sector-notes.mdreferences/severity-matrix.mdreferences/specialized-osint.mdreferences/tooling-install.mdscripts/secret_scan.pyv3.0 — Refactored 2026-05-02 from a 4,168-line monolith into a lean SKILL.md (~400 lines) plus 15 modular reference files in
references/. Detail content loads on demand — Claude reads only the reference files relevant to the current task.
Use this skill when:
Do NOT use this skill when:
For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target — see methodology skill §1 for the full posture.
Findings should carry: id, module, asset_key, category, severity (info/low/medium/high/critical), confidence, title, description, evidence (url + UTC timestamp + sha256 + raw ≤ 2 KiB), references, remediation. UTC timestamps everywhere.
URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.
--aggressive.This skill is a lean operational index. Most concrete data (wordlists, regexes, dorks, endpoint catalogs, severity examples) lives in the references/ subfolder, organized by topic.
Workflow when this skill triggers:
bug-bounty skill for the local toolkit at ~/security-research/bug-bounty-resources/ and osint-methodology for the planning framework.Loading rules of thumb:
secret-patterns.md only.probes-and-wordlists.md first, then add others as the engagement narrows.severity-matrix.md.| File | Coverage | Trigger phrases |
|---|---|---|
probes-and-wordlists.md | API/Swagger/GraphQL paths, cloud-bucket arsenal, JS guess-paths, vendor & cloud-native fingerprints, K8s/CI-CD exposure, doc/wiki leaks, WHOIS/RDAP, DNS catalog, Wayback CDX, copy-paste curl probes, email security analysis, origin/CDN bypass | swagger discovery, graphql introspection, subdomain takeover, cloud bucket enum, S3/GCS/Azure enum, kubernetes exposure, CI CD exposure, vendor fingerprint, WHOIS RDAP, Wayback CDX, copy paste probes, curl one-liner |
identity-fabric.md | Concrete endpoints for Entra/Okta/ADFS/Google/SAML, M365 deep (Teams federation, SharePoint, OneDrive), GraphQL field-suggestion enumeration, user-enum patterns | identity fabric, SSO discovery, IdP fingerprinting, okta enum, entra enum, azure AD enum, ADFS enum, SAML metadata, Microsoft 365 deep, Teams federation, SharePoint enum, OneDrive enum, graphql field suggestion |
secret-patterns.md | 48-pattern secret-regex catalog (AWS, GCP, GitHub PATs, Stripe, Slack, JWT, private keys, Anthropic/OpenAI/HuggingFace, Cloudflare, DigitalOcean, npm, PyPI, Docker Hub, Atlassian, DataDog, Sentry, ngrok) with severity & FP notes | secret scanning, secret leak, leaked credential, JWT triage, AWS key triage, Anthropic API key, OpenAI API key |
secret-validators.md | 9 read-only secret validators + post-discovery enumeration workflows for AWS/GitHub/Slack/Postman/JWT/Anthropic/OpenAI/npm/Atlassian/DataDog | secret validation, post discovery workflow, AWS key triage, JWT triage |
dork-corpus.md | 80+ Google/Bing/DDG dork templates across 9 categories + 13 GitHub code-search dorks tailored for targets | google dorking, bing dorking, github dorking, dork corpus |
recon-stack.md | Subdomain-source stack (passive & active), infrastructure & attack-surface OSINT (Shodan/Censys/crt.sh/JARM/favicon mmh3), TLS deep audit, reverse DNS, IPv6 enumeration | subdomain enumeration, certificate transparency, crt.sh, shodan recon, censys recon, JARM, favicon mmh3, TLS deep audit, JA3 JA4, reverse DNS sweep, IPv6 enumeration |
breach-and-credentials.md | Breach & leak data sources (HudsonRock, HIBP, DeHashed, IntelX, infostealer logs), email-pattern inference, email-harvest source stack | breach lookup, have I been pwned, HudsonRock cavalier, infostealer, dehashed, intelx, email harvest |
people-osint.md | Search engines, username & email investigation, people search, phone OSINT, social media, public records & company info | username investigation, people search, phone OSINT, social media OSINT, public records |
saas-public-surfaces.md | Postman public workspace search (verified endpoint), Stack Exchange OSINT sweep, public SaaS dork stack (Notion, Confluence, Trello) | postman workspace, stack exchange OSINT, Notion public, Confluence anonymous, Trello board |
specialized-osint.md | Threat intel & IOCs, cryptocurrency OSINT, media intelligence, geospatial intelligence, regional search engines, Telegram & messaging intelligence | threat intel, IOCs, cryptocurrency OSINT, media intelligence, geospatial OSINT, regional search, Telegram intelligence |
recon-techniques.md | LinkedIn employee enumeration, job-posting tech-stack analysis, Slack/Discord/Telegram workspace discovery, package-registry leak hunting (npm/PyPI/Docker Hub/Quay/GHCR), sat imagery for physical recon | LinkedIn enumeration, job posting tech stack, Slack workspace discovery, Discord server discovery, npm token leak, PyPI token leak, Docker Hub leak, sat imagery physical recon |
severity-matrix.md | 80+ worked examples mapping observed conditions → finding severity (CRITICAL/HIGH/MEDIUM/LOW/INFO) | severity decision, finding severity, severity matrix |
sector-notes.md | Recon notes for healthcare (DICOM), finance (SWIFT), ICS/SCADA (Modbus/BACnet), IoT, government | sector specific recon, healthcare DICOM, finance SWIFT, ICS SCADA, Modbus, BACnet |
tooling-install.md | Quick-install one-liners for Subfinder, Amass, httpx, nuclei, gau, katana, gowitness, dnsx, mapcidr, naabu, sslyze, testssl.sh, etc. | tooling install, install subfinder, install nuclei, install httpx |
helpers-and-automation.md | AI-assisted OSINT, archiving & evidence preservation, automation & workflow patterns, cross-module sidecar coordination, runnable secret_scan.py helper notes | AI-assisted OSINT, evidence preservation, automation, sidecar |
For every classified endpoint (§22 in methodology skill), apply this rubric:
| Signal | Points | Conditions |
|---|---|---|
| Unauth write | +40 | POST/PUT/DELETE/PATCH endpoint returns 200/201/202/204 anonymously. |
| Open GraphQL introspection | +35 | __schema query returns full type list anonymously. |
| Verb tampering bypass | +30 | OPTIONS reveals method not documented; that method is accessible. |
| Reflected CORS + credentials | +25 | Access-Control-Allow-Origin reflects request Origin AND Access-Control-Allow-Credentials: true. |
| Sensitive keyword in path | +20 | Path matches one of: admin, internal, debug, user, password, token, key, export, upload, backup, config, secret, private, delete, purge, wipe. |
| Schema leak in error | +20 | Response body contains stack trace, ORM error class, framework signature (e.g., ActiveRecord::RecordNotFound, org.hibernate.exception.*, django.db.utils.IntegrityError). |
| API key in URL | +15 | Path or query string contains api_key=, apikey=, token=, access_token=. |
| Wildcard CORS | +10 | Access-Control-Allow-Origin: *. |
| Missing rate-limit headers | +10 | No RateLimit-* / X-RateLimit-* headers; no Retry-After after rapid requests. |
Thresholds:
| Score | Severity |
|---|---|
| ≥ 90 | CRITICAL |
| 70–89 | HIGH |
| 50–69 | MEDIUM |
| 25–49 | LOW |
| < 25 | INFO |
For score ≥ 70, attach an attack_path_hint in evidence (see §29).
Before running deep APK static analysis, score whether the discovered app actually belongs to the target. Threshold: ≥70 = accept.
| Signal | Points |
|---|---|
Package reverse-DNS matches target domain (e.g., com.acme.android ⟂ acme.com) | +40 |
Developer email is <anything>@<target-domain> | +25 |
| Developer website URL is the target domain (or a confirmed sibling brand domain) | +20 |
| App name contains a brand keyword from operator-supplied brand list | +10 |
| App has ≥ minimum review-score threshold (default 20 reviews) | +5 |
Apps below threshold are tagged mobile_review_pending and shown but not analyzed. Operator can re-score with --mobile-ownership-threshold 50 for noisier collection.
When emitting a HIGH/CRITICAL API endpoint finding (score ≥ 70), include a one-sentence attack_path_hint in evidence so the operator knows where to start exploiting. Templates:
| Trigger | Attack-path hint |
|---|---|
| Unauth POST / PUT / DELETE | "Unauthenticated {method} {path} — try IDOR + privilege escalation; check whether numeric IDs are sequential or guessable." |
| Open GraphQL introspection | "Open GraphQL introspection on {path} — enumerate mutations, look for createUser, setRole, transferFunds-shaped names; pivot to broken-auth or business-logic flaws." |
| Reflected CORS + creds | "Reflected CORS with credentials on {path} — host CSRF page on attacker-controlled origin; victim's browser will leak {sensitive-data-hint}." |
| Wildcard CORS + sensitive | "Wildcard CORS on {path} returning user-tied data without creds — exfiltrate via cross-origin fetch from any page victim visits." |
| Verb tampering | "Verb tampering: {hidden-method} allowed on documented-{visible-method}-only endpoint → likely missing-method-check authz bug; try {hidden-method} {path} with valid auth." |
| API key in URL | "API key in URL: ?{param}=... — token leaks to access logs, browser history, Referer headers, third-party CDNs. Check Wayback / Google for cached copies." |
| Schema leak in error | "Schema leak in error response — framework signature {framework} exposed; map to known {framework} vulns and craft targeted payloads." |
| Sensitive keyword | "Path contains '{keyword}' — review for direct object reference, mass-assignment, or hidden admin functionality." |
| Open RTDB Firebase | "Open Firebase RTDB at https://{project}.firebaseio.com/.json — read everything, then test write at /<random-key>.json with PUT to gauge ACL scope." |
| Listable cloud bucket | "Listable {provider} bucket {bucket} — recursive object listing + content-type analysis; look for backups, logs, customer data, AWS keys in JSON configs." |
| .git exposed | "Exposed .git/config on {host} — reconstruct repository with git-dumper or githacker; full source history." |
| .env exposed | "Exposed .env on {host} — grep for _KEY, _SECRET, _TOKEN, _PASSWORD; validate all credentials read-only via §23 validators." |
| /actuator/env | "Spring Boot /actuator/env exposed — dump environment variables; look for spring.datasource.password, JWT secrets, cloud creds." |
| /actuator/heapdump | "Spring Boot /actuator/heapdump exposed — download HPROF, run jhat or VisualVM, search for cleartext secrets in heap strings." |
| Open Elasticsearch | "Open Elasticsearch on {host}:9200 — /_cat/indices?v for index list; sample documents from each high-value index; test write to /test-idx/_doc to gauge ACL." |
| Open Redis | "Open Redis on {host}:6379 — INFO, KEYS *, sample reads; check for write access via CONFIG SET then BGSAVE to write authorized_keys." |
| Open MongoDB | "Open MongoDB on {host}:27017 — show dbs, show collections, sample find queries; check user collection for password hashes." |
| Subdomain takeover | "CNAME for {host} points to unclaimed {provider} resource → register {takeover-target} on {provider} to serve content from {host}; pivot to phishing or content injection on the trusted domain." |
| Open kubelet | "Open kubelet on {host}:10250 — GET /pods to list; POST /run/<ns>/<pod>/<container> for in-container exec without K8s API auth." |
| Open etcd | "Open etcd on {host}:2379 — etcdctl get / --prefix --keys-only for full cluster state; secrets stored under /registry/secrets/." |
| K8s API anonymous | "Kubernetes API on {host}:6443 with anonymous-auth — kubectl --server=https://{host}:6443 --insecure-skip-tls-verify get pods --all-namespaces." |
| Citrix unpatched | "Citrix NetScaler version {ver} on {host} — vulnerable to CVE-{cve} (KEV-listed); see vendor advisory; do not exploit but flag for client immediate patching." |
| F5 BIG-IP TMUI exposed | "F5 BIG-IP TMUI on {host} reachable; CVE-2022-1388 / CVE-2023-46747 KEV applicable; advise immediate patching to vendor-released hotfix." |
| VMware vCenter accessible | "vCenter at {host} accessible without VPN; CVE-2021-21972 RCE if unpatched; check version banner." |
| Cloud function URL unauth | "AWS Lambda Function URL at {url} accessible anonymously — review IAM auth configuration; if unauthenticated by design, audit input validation aggressively." |
| npm typosquat candidate | "Package name {candidate} is unregistered + similar to target's published {official} — typosquat takeover risk; advise client to defensively register." |
| DMARC missing/permissive | "DMARC p=none on {domain} — spoof of {anything}@{domain} deliverable to recipients; recommend enforcement to p=quarantine or p=reject after observing reports." |
| Live AI API key (Anthropic/OpenAI) | "Validated sk-{provider}-... key with model access — quota cost can be exfiltrated; rotate immediately + audit usage logs in provider console." |
| Public Slack invite link | "Slack workspace invite link discoverable via search engine — anyone can join the workspace without approval; trivially access internal channels." |
| Open Docker registry | "Public Docker registry at {host} — GET /v2/_catalog lists images; pull and scan layers for embedded secrets." |
| Telegram bot token live | "Telegram bot token validated — getUpdates reveals bot recipients (admin chats); if getMe shows bot is in channels, full message read access." |
Sourcemap with sourcesContent[] | "Sourcemap on {host} includes embedded original sources — full frontend code reconstructable; grep for inline secrets and internal hostnames." |
Drop these prompts into a fresh Claude session to verify the skill loads correctly.
/api/users?" → §39 (first row)./actuator/env." → §16.13.<Client Brand Ltd> with subdomains api/billing/hr." → §16.8.target.example." → §16.15 + companion methodology §27.acme.com's SPF/DMARC for spoof feasibility." → §16.14.android:debuggable=true on prod app?" → §40.target.com via direct API (no UI)." → §15.0.1.target.example covering vpn / api / staging / portal / intranet." → §16.24.mail.<domain>) is NXDOMAIN today but breach corpus has employee URLs against it. What's the finding?" → §15.2 legacy-mail-decommissioned pattern.kdmarc.com — what does that tell me?" → §16.14 DMARC reporting-vendor table.*.js query returned empty for a brochure-ware site. Pivot?" → §16.23 legacy-app pivot (.asp / .php / .jsp / .cfm / .aspx).Resolve-DnsName -Type CAA errors (use PS 7+ or nslookup -type=CAA). §16.22 expanded TXT verification token catalog with 17 new tokens (zscaler-verification, cloudflare-verify, autosect, cisco-site-verification, mscid, _amazonses, salesforce-domain-verification, workday/shopify/klaviyo/mailchimp/hubspot/zendesk/freshworks/intercom/loom/miro/gitlab) + new "Autodiscover-as-confirmation" pattern for M365 detection when MX is wrapped by Mimecast/Proofpoint/Barracuda. §22.1 added passive Autodiscover IP correlation pattern with Microsoft Exchange Online IP ranges. §22.8 added clarification: SharePoint HEAD HTTP 200 = tenant exists, NOT anonymous access granted (operators commonly misread). New §16.23 legacy-app pivot block (when Wayback *.js returns empty for brochure-ware sites, pivot to .asp/.php/.jsp/.cfm/.aspx/.json/.xml/.yml/.ini/.conf — with full broad-sweep one-liner). New §16.24 Common-Prefix Subdomain Sweep — formalized active prefix-probe technique with 100+ ordered prefix list, PowerShell + bash + puredns recipes, and real-engagement validation note (passive enum misses 20-40% of high-value subdomains; always pair with active prefix probe). §27.0.1 added crt.sh fallback chain (Censys, CertSpotter, Calidog, Subfinder, OTX, ThreatMiner, URLScan, Anubis-DB) with PowerShell wrapper that retries crt.sh 3× then falls back to Subfinder. §28.1 added Bulk IP→ASN recipes (Cymru bulk WHOIS, RIPEstat, bgp.tools, IPinfo Lite) + caveat that bgpview.io API has aggressive rate limits unsuitable for bulk. §40 severity matrix gained 8 rows: vendor procurement portal exposed + breach corpus hits (HIGH), PII-collection portal over plain HTTP (HIGH), decommissioned legacy mail + breach + cloud migration (CRITICAL), public-facing intranet without VPN (MEDIUM), staging/preprod publicly resolvable (MEDIUM), vpn. resolves but vendor unknown (INFO escalating to HIGH-CRITICAL on KEV match), DMARC RUA → third-party vendor (INFO). §49 self-test expanded from 30 → 40 prompts targeting all new content.web2-recon — When the arsenal needs to be executed against a live host set. Workflow primitive: this skill provides the probe paths and wordlists; web2-recon runs the actual subfinder → dnsx → httpx → katana pipeline that consumes them.osint-methodology — When this skill's concrete probes need a planning framework. Workflow primitive: osint-methodology is the planning skeleton (5-stage pipeline, asset graph, findings rubric); this skill is the operational arsenal that fills each stage with curl one-liners and regexes.hunt-subdomain — When this skill's subdomain enumeration finds stale CNAMEs. Workflow primitive: subdomains discovered via §27 / references/recon-stack.md get auto-routed to hunt-subdomain for takeover validation.hunt-cloud-misconfig — When this skill's cloud-bucket enum surfaces listable buckets / Firebase / actuator endpoints. Workflow primitive: §39 attack-path hints (listable bucket, /actuator/env, open Elasticsearch) hand off to hunt-cloud-misconfig for exploitation.m365-entra-attack / okta-attack — When identity-fabric fingerprinting finds Entra/Okta. Workflow primitive: references/identity-fabric.md fingerprints the IdP; matched platform skill (loaded by hunt-dispatch) takes over for active enumeration.npx claudepluginhub elementalsouls/claude-bughunterHunts API keys, tokens, and credentials in JS bundles, GitHub repos, Postman collections, and API specs using TruffleHog, Gitleaks during pentest phase 2 from recon data.
Automates web2 asset discovery: subdomain enumeration (subfinder, Chaos, assetfinder), live host probing (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), and continuous monitoring. Use for subdomain enumeration, attack surface mapping, or any web recon starting point.
Automates reconnaissance pipelines for bug bounty hunting: subdomain enumeration, live host discovery, tech fingerprinting. Uses Amass, Subfinder, httpx, Nuclei.