buggy HunterBUGGY
buggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leakedbuggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leakedbuggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leaked
> 22 SKILLS ACTIVE
Web Hunting SECURITY DOMAIN
Deep-dive skills for SQL injection, XSS, SSRF, RCE, business logic, and 15+ other web vulnerability classes — each built from real bug bounty reports.
/hunt-sqli
Web HuntingSQLi HunterSQL and NoSQL injection across ORM raw fragments, GraphQL resolvers, OIDC-proxy backends, and SOQL. Built...
claude "/hunt-sqli https://target.com"
→ trigger: auto-loaded
/hunt-xss
Web HuntingXSS HunterCross-site scripting across DOM, reflected, stored, and mutation-based patterns. Built from 174 public bu...
claude "/hunt-xss https://target.com"
→ trigger: auto-loaded
/hunt-ssrf
Web HuntingSSRF HunterServer-side request forgery including cloud metadata endpoint exfiltration, internal network pivoting, an...
claude "/hunt-ssrf https://target.com"
→ trigger: auto-loaded
/hunt-rce
Web HuntingRCE HunterRemote code execution via deserialization, template injection, command injection, and unsafe eval pattern...
claude "/hunt-rce https://target.com"
→ trigger: auto-loaded
/hunt-idor
Web HuntingIDOR HunterInsecure direct object references including BOLA in REST/GraphQL, ID enumeration, and horizontal privileg...
claude "/hunt-idor https://target.com"
→ trigger: auto-loaded
/hunt-csrf
Web HuntingCSRF HunterCross-site request forgery including SameSite bypass, token fixation, and JSON-based CSRF in single-page ...
claude "/hunt-csrf https://target.com"
→ trigger: auto-loaded
/hunt-ssti
Web HuntingSSTI HunterServer-side template injection across Jinja2, Twig, Freemarker, Velocity, and Pebble with RCE escalation ...
claude "/hunt-ssti https://target.com"
→ trigger: auto-loaded
/hunt-xxe
Web HuntingXXE HunterXML external entity injection including blind OOB exfiltration, file read via error messages, and XXE-to-...
claude "/hunt-xxe https://target.com"
→ trigger: auto-loaded
/hunt-file-upload
Web HuntingFile Upload HunterUnrestricted file upload bypasses — MIME type spoofing, extension trickery, polyglots, path traversal via...
claude "/hunt-file-upload https://target.com"
→ trigger: auto-loaded
/hunt-cache-poison
Web HuntingCache Poison HunterWeb cache poisoning via unkeyed headers, parameter cloaking, fat GET exploitation, and cache-key normaliz...
claude "/hunt-cache-poison https://target.com"
→ trigger: auto-loaded
/hunt-http-smuggling
Web HuntingHTTP Smuggling HunterHTTP request smuggling — CL.TE, TE.CL, TE.TE variants with bypass and response queue poisoning escalation...
claude "/hunt-http-smuggling https://target.com"
→ trigger: auto-loaded
/hunt-race-condition
Web HuntingRace Condition HunterRace condition exploitation on payment flows, coupon redemption, rate-limit bypass, and parallel request ...
claude "/hunt-race-condition https://target.com"
→ trigger: auto-loaded
/hunt-business-logic
Web HuntingBusiness Logic HunterBusiness logic flaws — price manipulation, workflow bypass, state machine abuse, and trust boundary viola...
claude "/hunt-business-logic https://target.com"
→ trigger: auto-loaded
/hunt-graphql
Web HuntingGraphQL HunterGraphQL introspection abuse, batching attacks, IDOR through aliases, nested query DoS, and authorization ...
claude "/hunt-graphql https://target.com"
→ trigger: auto-loaded
/hunt-llm-ai
Web HuntingLLM/AI HunterLLM-integrated application vulnerabilities — prompt injection, insecure tool use, training data extractio...
claude "/hunt-llm-ai https://target.com"
→ trigger: auto-loaded
/hunt-dispatch
Web HuntingDispatch HunterSmart target triage and hunting path dispatch — routes to the right skill based on reconnaissance signals...
claude "/hunt-dispatch https://target.com"
→ trigger: auto-loaded
/hunt-misc
Web HuntingMisc Vuln HunterCatch-all for open redirect, CRLF injection, clickjacking, host header injection, and other frequently di...
claude "/hunt-misc https://target.com"
→ trigger: auto-loaded
/hunt-aspnet
Web HuntingASP.NET HunterASP.NET-specific attack surface — ViewState deserialization, __EVENTTARGET manipulation, IIS short filena...
claude "/hunt-aspnet https://target.com"
→ trigger: auto-loaded
/bug-bounty
Web HuntingBug Bounty PlannerStructured methodology for scoping, prioritizing, and executing a bug bounty engagement from program sele...
claude "/bug-bounty https://target.com"
→ trigger: auto-loaded
/bb-methodology
Web HuntingBB MethodologyEnd-to-end bug bounty methodology — recon, attack surface mapping, vulnerability testing order, and triag...
claude "/bb-methodology https://target.com"
→ trigger: auto-loaded
/bb-local-toolkit
Web HuntingLocal ToolkitLocal toolchain setup for bug bounty — ffuf, nuclei, sqlmap, burp configurations, and wordlist management...
claude "/bb-local-toolkit https://target.com"
→ trigger: auto-loaded
/security-arsenal
Web HuntingSecurity ArsenalCurated command arsenal for web security testing — one-liner reference for recon, fuzzing, exploitation, ...
claude "/security-arsenal https://target.com"
→ trigger: auto-loaded