Claude Bug Bounty Hunter

A Claude Code skill that turns Claude into your AI bug bounty co-pilot. Point it at any target and Claude maps the attack surface, runs your scanners, validates findings, and writes the HackerOne or Bugcrowd report — all from a single conversation.

Quick Start · Tools · Pipeline · Claude Prompts · Install

The Trilogy

Repo	What It Does
claude-bug-bounty ← you are here	AI-assisted web2 + web3 bug bounty — recon, scanning, validation, report writing
web3-bug-bounty-hunting-ai-skills	Smart contract security skills for Claude — 10 bug classes, Foundry PoC templates, real Immunefi case studies
public-skills-builder	Feed 500 public writeups → get skill files back out

Use all three together: public-skills-builder generates skills → web3-bounty-ai-skills holds the knowledge → claude-bug-bounty runs the hunt.

Also in This Repo

File	What's Inside
SKILL.md	Installable Claude Code skill — full hunting methodology, recon, validation, reporting
docs/payloads.md	Complete payload arsenal — XSS, SQLi, SSRF, XXE, SSTI, SAML, JWT, CSRF, race conditions, and more
docs/smart-contract-audit.md	Web3 audit guide — Immunefi workflow, EVM/Solana/CosmWasm, Foundry PoC templates, real paid writeups
web3/	Full smart contract security skill chain — 10 bug classes, Foundry PoC templates, case studies, AI tools
CLAUDE_INTEGRATION.md	Claude API integration examples

Target → Recon → Intel → Hunt → Validate → Report → Submit

Every step is Claude-assisted. Drop into Claude Code, point it at a target, and it will:

• Enumerate subdomains, live hosts, and crawl endpoints
• Pull CVEs and disclosed H1 reports for the detected tech stack
• Generate a prioritized attack mindmap
• Run scanners for IDOR, SSRF, XSS, SQLi, OAuth, GraphQL, LLM injection
• Walk you through the 4-gate validation checklist
• Write a submission-ready HackerOne or Bugcrowd report

Recommended: Use with Claude Code for the full AI co-pilot experience.

Step 1 — Clone and install tools

git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh

Step 2 — Install the Claude Code skill

mkdir -p ~/.claude/skills/bug-bounty
cp SKILL.md ~/.claude/skills/bug-bounty/SKILL.md

Step 3 — Start hunting

claude

Then just talk to Claude:

"Run recon on target.com and tell me what to hunt"
"I found a potential IDOR on /api/invoices — validate it"
"Write a HackerOne report for this SSRF finding"
"What GraphQL bugs should I look for on this target?"

Claude reads your recon files, reasons about the attack surface, and drives the tools.

Or run the pipeline directly (no Claude Code):

# Full automated hunt
python3 hunt.py --target hackerone.com

# Step by step
./recon_engine.sh target.com
python3 learn.py --tech "nextjs,graphql,jwt" --target target.com
python3 hunt.py --target target.com --scan-only
python3 validate.py
python3 report_generator.py findings/

# 1. Recon — enumerate subdomains, resolve DNS, find live hosts, crawl URLs
./recon_engine.sh target.com
# → recon/target.com/{subs.txt, live-hosts.txt, urls.txt}

# 2. Intel — pull CVEs and prior disclosures for the tech stack
python3 learn.py --tech "nextjs,graphql,jwt" --target target.com
# → recon/target.com/intel.md

# 3. Attack map — generate prioritized hunting checklist
python3 mindmap.py --target target.com --type api --tech "graphql,jwt"

# 4. Hunt — run all scanners
python3 hunt.py --target target.com --scan-only

# 5. Validate — 4-gate check before writing anything
python3 validate.py --output findings/target-finding.md

# 6. Report — generate submission-ready markdown
python3 report_generator.py findings/

Copy-paste these into Claude Code after running recon:

# Map the attack surface
"I've run recon on [target]. Here's live-hosts.txt and urls.txt.
What are the highest-priority endpoints to test for IDOR and why?"

# Tech-stack guided hunting
"Target uses NextJS + GraphQL + JWT auth. Rank the top 5 bug classes
I should hunt, ordered by payout likelihood on HackerOne."

# Validate a finding
"I found [vuln]. Here's the request and response. Walk me through
the 4 validation gates. What's the CVSS 3.1 score and business impact?"

# Write the report
"Write a HackerOne report for this [vuln type].
PoC steps: [1, 2, 3]. Target: [URL]. Impact: [what attacker can do]."

# Chain a low finding
"I have an open redirect at [URL]. How can I chain this into
an OAuth code theft or ATO? What conditions do I need?"

Prerequisites

# macOS
brew install go python3 node jq

# Linux (Debian/Ubuntu)
sudo apt install golang python3 nodejs jq

One-command install

chmod +x install_tools.sh && ./install_tools.sh

Installs: subfinder httpx dnsx nuclei katana waybackurls gau dalfox ffuf anew qsreplace assetfinder gf interactsh-client sqlmap XSStrike SecretFinder LinkFinder + nuclei-templates

Configuration

cp config.example.json config.json
# Add your ProjectDiscovery Chaos API key and HackerOne token

claude-bug-bounty/
├── recon/
│   └── target.com/
│       ├── subs.txt           # All subdomains
│       ├── live-hosts.txt     # Live HTTP(S) hosts with status codes
│       ├── urls.txt           # Crawled URLs
│       └── intel.md           # CVE + disclosed report intel
├── findings/
│   └── target-vuln-type.md   # Validated finding notes
└── reports/
    └── h1-report-YYYYMMDD.md # Submission-ready report

• HackerOne Hacktivity — Disclosed reports
• Bugcrowd Crowdstream — Public findings
• ProjectDiscovery Chaos — Free subdomain datasets
• PayloadsAllTheThings — Payload reference
• HackTricks — Attack technique bible
• PortSwigger Web Academy — Free vuln labs

For authorized security testing only.

Only test targets within an approved bug bounty scope. Never test systems without explicit permission. Follow responsible disclosure — report to the vendor, not publicly. Read each program's rules of engagement before hunting.

PRs are welcome. If you've found a bug class that's missing, have a better Claude prompt, or want to add platform support (YesWeHack, Synack, HackenProof) — open a PR.

Good contributions:

• New vulnerability scanners
• Claude prompt templates for specific bug classes
• Payload additions to docs/payloads.md
• Real-world hunting methodology improvements

git checkout -b feature/my-contribution
git commit -m "Add: description of what you added"
git push origin feature/my-contribution
# Open a PR with a short description

Questions, ideas, or want to collaborate? Reach out: