菜单
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
AV/EDR evasion and detection bypass — AMSI, ETW, API unhooking, process injection, AppLocker bypass, LOLBins, shellcode obfuscation.
Microsoft Exchange and SharePoint attack techniques — enumeration, ProxyLogon/ProxyShell/ProxyToken exploitation, mailbox access, SharePoint file exfiltration.
System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development.
Internal network pivoting and traffic tunneling — FRP, Chisel, Ligolo-ng, SSH, ReGeorg, DNS tunneling, EarthWorm, Ngrok.
Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.
基于 SOC 职业分类
| name | hackerone |
| description | HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports. |
Automates: scope parsing → parallel testing per asset → PoC validation → submission reports.
skills/coordination/SKILL.md).Expected columns:
identifier — asset URL/domain.asset_type — URL, WILDCARD, API, CIDR.eligible_for_submission — must be true.max_severity — critical / high / medium / low.instruction — asset-specific notes.Parse with tools/csv_parser.py. Filter for eligible_for_submission=true.
One coordinator per asset, spawned in parallel:
coordinator_role = Read("skills/coordination/SKILL.md")
Agent(prompt=f"{coordinator_role}\n\nTARGET: {asset_url}\nSCOPE: {program_guidelines}\nOUTPUT_DIR: ...",
run_in_background=True)
10 assets → 10 parallel coordinators (~2-4 h vs 20-40 h sequential). Each coordinator follows skills/coordination/SKILL.md and reference/role-matrix.md.
Every finding requires:
poc.py — executable exploit script.poc_output.txt — timestamped execution proof.workflow.md — manual repro steps if applicable.Use the standard engagement-thoroughness validator + finding validators (see skills/coordination/reference/validator-role.md). The HackerOne PoC contract is a superset of the standard finding contract.
Required sections per HackerOne standard:
Validate with tools/report_validator.py.
Standard OUTPUT_DIR (skills/coordination/reference/output-discipline.md) plus a per-asset reports/submissions/ containing the platform-ready markdown.
{OUTPUT_DIR}/
├── findings/
├── reports/
│ ├── submissions/
│ │ ├── H1_CRITICAL_001.md
│ │ └── H1_HIGH_001.md
│ └── SUBMISSION_GUIDE.md
├── recon/
├── logs/
└── artifacts/
High-value: new programs (< 30 days), fast response (< 24 h), high bounties, large attack surface. Avoid: slow response (> 1 week), low bounties, restrictive scope.
poc_output.txt.eligible_for_submission=true.| Rejection | Prevention |
|---|---|
| Out of Scope | Verify eligible_for_submission=true and asset-type match |
| Cannot Reproduce | Include poc.py + poc_output.txt; engagement-thoroughness validator catches missing artifacts |
| Duplicate | Search disclosed reports before submission; submit quickly |
| Insufficient Impact | Document realistic attack scenario in the report |
tools/csv_parser.py — parse HackerOne scope CSVs.tools/report_validator.py — validate report completeness.skills/coordination/SKILL.md — coordinator scaffold./hackerone <program_url_or_csv_path>