bugbountyworkflow

# Bug Bounty Workflow Skill Complete workflow for bug bounty hunting, from reconnaissance to report submission. ## When to Activate - "bug bounty" → Full skill context - "write report" / "vulnerability report" → Report Writing section - "HackerOne" / "Bugcrowd" → Platform-Specific section - "PoC" / "proof of concept" → PoC Standards section - "severity" / "CVSS" → Severity Assessment section - "responsible disclosure" → Disclosure Workflow section - "recon" / "reconnaissance" → Reconnaissance section --- ## Reconnaissance Workflow ### 1. Scope Analysis ```bash # First: READ THE SCOPE CAREFULLY # - What domains are in scope? # - What's explicitly out of scope? # - Any rate limiting requirements? # - Specific vulnerability types excluded? ``` ### 2. Apex and Subdomain Enumeration Run the apexDiscovery skill to pull out other apexes for the main domain we find for the client. Then do subdomain discovery for ALL of them: ```bash # Passive enumeration subfinder -d target.com -o subdomains.txt amass enum -passive -d target.com >> subdomains.txt # Certificate transparency curl "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u # Combine and dedupe cat subdomains.txt | sort -u > unique-subdomains.txt ``` ### 3. Live Host Detection ```bash # Check which subdomains are alive cat unique-subdomains.txt | httpx -o alive.txt -status-code -title -tech-detect # With ports cat unique-subdomains.txt | httpx -ports 80,443,8080,8443 -o alive-with-port...