#bug-bounty
41 resources
Results
- babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is…
- openai-docs
Provide authoritative, current guidance from OpenAI developer docs using the developers.openai.com MCP server.
- offensive-osint
Operational arsenal for authorized external red-team and bug-bounty recon.
- codex-issue-digest
Run a GitHub issue digest for openai/codex by feature-area labels, all areas, and configurable time windows.
- client-reverse
Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a…
- argus
Argus — the all-seeing scanner suite.
- bb-methodology
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next.
- credential-attack
Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode…
- graphql-audit
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via…
- meme-coin-audit
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token…
- report-writing
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1…
- triage-validation
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list,…
- web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash…
- bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity…
- enterprise-vpn-attack
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto…
- evidence-hygiene
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview…
- hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering.
- hunt-aspnet
Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass…
- hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities.
- hunt-brute-force
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing,…
- hunt-business-logic
Hunting skill for business logic vulnerabilities.
- hunt-cache-poison
Hunting skill for cache poison vulnerabilities.
- hunt-captcha-bypass
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA…
- hunt-clickjacking
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick…
- hunt-cors
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only),…
- hunt-csrf
Hunting skill for csrf vulnerabilities.
- hunt-deserialization
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load,…
- hunt-dispatch
Skill-set loader for /hunt orchestrator.
- hunt-dom
Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin…
- hunt-exceptional-conditions
Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null…
- hunt-fintech-graphql
Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups),…
- hunt-forgot-password
Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for…
- hunt-graphql
Hunting skill for graphql vulnerabilities.
- hunt-grpc
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints,…
- hunt-host-header
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF…
- hunt-html-injection
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags…
- mantis-pipeline
The master Mantis playbook -- how to run an authorized vulnerability-discovery engagement end to end, which subagent owns each stage, which…
- update-v8-version
Update Codex's pinned v8 / rusty_v8 versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds.
- codex-bug
Diagnose GitHub bug reports in openai/codex.
- findings-spine
Record and advance every vulnerability finding through the tool-owned mantis_findings service instead of tracking findings in prose
- path-types
Choose Rust types for operating system paths across the Codex repository.
