evidence-hygiene

Featured

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.

Code & Development 4,432 stars 669 forks Updated today MIT

Install

View on GitHub

Quality Score: 96/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# EVIDENCE HYGIENE — PoC Capture & Redaction Discipline > Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage. The core principle: **Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.** --- ## 1. Two Categories of Sensitive Data Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment. | Category | Examples | Treatment | |---|---|---| | **Your-account secrets** | Session cookies, OAuth tokens, refresh tokens, API keys | Always redact. Even in private bug-bounty platform attachments. Your account, your session — protect it. | | **Other users' PII** | Real names, emails, phone numbers, addresses, profile photos, account IDs | Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display. | | **Triager-useful metadata** | Trace IDs (`x-datadog-trace-id`), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes | **Leave visible** — these help the triager correlate to logs and reproduce. | | **Test-account passwords (limited use)** | Throwaway passwords on...

Details

Author
elementalsouls
Repository
elementalsouls/Claude-BugHunter
Created
4 months ago
Last Updated
today
Language
Python
License
MIT

Integrates with

Anthropic · AI Datadog · Monitoring OAuth · Auth GraphQL · API

Bundled in these plugins

Claude-BugHunter

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Listed

bug-bounty-reporting

Use when an agent drafts, revises, freezes, or independently verifies a bug bounty vulnerability report, executable PoC, evidence bundle, CVSS rationale, or cleanup proof for HackerOne, Bugcrowd, Intigriti, or a vendor-managed program. The skill maps material claims to exact final-run artifacts.

2 Updated today
Lu1sDV
Code & Development Listed

bugbounty-poc-video-runner

Designs a one-command, triager-friendly live security PoC video runner with staged evidence, expected-versus-actual output, a negative control, optional UI pause, and cleanup proof.

2 Updated today
Lu1sDV
Data & Documents Featured

offensive-anti-forensics

Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the d

3,234 Updated 1 weeks ago
SnailSploit