elementalsouls/Claude-BugHunter

API Misconfig Hunter finds mass assignment, prototype pollution, HTTP verb tampering, and server-side parameter pollution in APIs. Use it when auditing API endpoints for security misconfigurations in bug bounty or penetration testing.

APK Red Team Pipeline automates Android APK reconnaissance, acquisition, decompilation, secret scanning, and Frida instrumentation for authorized red-team assessments. Use when a target has a mobile app catalogue, hosts APK files, or when 'mobile app' is in scope.

Auth Bypass Hunting guides reconnaissance of authentication entry points and exploitation of SSO, SAML, JWT, XMLRPC, and legacy protocol weaknesses to find login bypasses and privilege escalation. Use when assessing web apps, WordPress, SharePoint, Atlassian, and partner portals for auth flaws.

Bug Bounty guides security researchers through the full bug bounty workflow: reconnaissance, hunting vulnerabilities (IDOR, SSRF, XSS, auth bypass, AI/LLM security issues), validating findings, and writing impactful reports.

Bug Bounty Local Toolkit provides the complete bug-bounty workflow (recon, learning, hunting, validation, reporting) and resolves local install paths for tools, wordlists, and clones. Use it when hunting from a local machine and you need to know where jhaddix, SecLists, trufflehog, ffuf, dalfox, or ghauri are installed, or as the full-workflow variant of the local toolkit.

Bug Bounty Methodology orchestrates bug bounty hunting sessions by combining a five-phase non-linear workflow with critical thinking tactics like developer psychology, anomaly detection, and what-if experiments to decide next steps.

Bugcrowd Reporting provides Bugcrowd-specific submission tactics for VRT category selection, manual severity overrides, OOS-clause rebuttals, and chained-finding cross-references. Use it when filing Bugcrowd reports or responding to triage decisions.

Business Logic Hunter identifies business logic vulnerabilities in web applications, covering price tampering, coupon stacking, verification bypass, and rate limit abuse. Use it when hunting for financial-impact bugs in e-commerce, SaaS, and payment platforms.

CAPTCHA Bypass Hunter identifies CAPTCHA validation weaknesses such as omitted fields, replayable tokens, and missing server-side checks. Use it during security testing to find bypasses that enable brute force, account farming, or automated abuse.

Cache Poison Hunter finds cache poisoning and web cache deception vulnerabilities in CDN-fronted apps, using techniques like unkeyed header reflection and path confusion to poison cached responses or steal dynamic content.

Cloud IAM Attack Chains analyzes cloud IAM credentials and privilege paths across AWS, Azure, and GCP to determine what access a credential grants and how to escalate. Use it after discovering an AWS key, Azure secret, GCP service account JSON, or K8s SA token from a code repo, JS bundle, APK, or SSRF chain.

Cloud Misconfig Hunter searches for misconfigurations in AWS, GCP, and Azure cloud services, including public S3 buckets, exposed CloudFront origins, public Lambda function URLs, and leaked IAM credentials in JavaScript bundles. It validates findings by attempting actual data read/write or remote code execution, and is used during bug bounty and penetration testing engagements.

DOM Vulnerability Hunter finds and exploits client-side DOM vulnerabilities such as DOM clobbering, PostMessage misconfigurations, service worker abuse, and CSS exfiltration. Use it when auditing web applications for DOM XSS, client-side auth bypass, or token theft without server-side interaction.

Enterprise VPN Attack catalogs fingerprinting methods and CVEs for SSL VPN/remote-access appliances such as Cisco ASA/AnyConnect, Fortinet, Citrix, Palo Alto, Pulse Secure, SonicWall, and F5. Use it when a perimeter exposes an SSL VPN gateway to test pre-auth RCE, SSRF, path traversal, and default credentials.

Evidence Hygiene guides redaction of cookies, PII, and HAR files in bug-bounty evidence capture, ensuring sessions and user data are protected before screenshots or attachments are shared. Use it before any PoC capture to avoid leaking secrets.

Exceptional Conditions Hunter probes web endpoints with malformed or unexpected input to surface verbose error pages, stack traces, and internal file paths or library versions. Use it when testing APIs, forms, or query parameters for error-disclosure vulnerabilities.

Hunt ASP.NET detects ASP.NET Webforms, WCF, and SharePoint attack surfaces such as ViewState deserialization, machineKey recovery, and trace.axd/elmah.axd disclosure to find high-value vulnerabilities in bug bounty programs.

Hunt ATO catalogs nine distinct account takeover paths, including password reset flaws, email change without re-auth, OAuth account-link CSRF, MFA bypass, session fixation, JWT manipulation, and SSO subdomain takeover. Use it when hunting ATO chains or testing password reset, email change, MFA, OAuth, session, and JWT primitives toward a critical finding.

Hunt Brute Force identifies missing or weak rate limiting on login, OTP/2FA, password-reset, and credential-stuffing endpoints to find brute force, enumeration, and ReDoS vulnerabilities. Use it when testing web apps for brute force, user enumeration, or rate-limit bypass via headers like X-Forwarded-For.

Hunt CI/CD finds and validates vulnerabilities in CI/CD pipelines, including Jenkins RCE, GitHub Actions injection, self-hosted runner poisoning, OIDC abuse, and Terraform state leakage. Use it when targeting public orgs, CI dashboards, or build artifacts.

Hunt CORS Misconfigurations probes CORS headers and browser behavior to find credentialed cross-origin read flaws, including origin reflection with credentials, null-origin trust, and subdomain regex bypass. Use it when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

Hunt CSRF identifies cross-site request forgery vulnerabilities in authenticated web applications using patterns from 15 public bug bounty reports, including SameSite bypasses and account takeover chains. Use it when testing state-changing endpoints, token validation, and cookie SameSite attributes.

Hunt Clickjacking tests for missing X-Frame-Options and CSP frame-ancestors headers, then proves a sensitive page can be framed and clicked cross-site to confirm a UI redressing vulnerability.

Hunt Deserialization detects and exploits insecure deserialization vulnerabilities in Java, PHP, Python, .NET, and Ruby applications to achieve RCE. Use when testing targets that process serialized objects, including Log4Shell/JNDI, ysoserial, PHP object injection, pickle, BinaryFormatter, and Marshal.load.

Hunt Dispatch is a skill-set loader for the /hunt orchestrator. It fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set when /hunt receives a mode answer.