Claude-BugHunter packages 83 Claude Code skills, 15 slash commands, and a deterministic engagement engine to guide authorized bug bounty and external red-team work from recon to report.
| Tool | elementalsouls/Claude-BugHunter — a Claude Code skill bundle for bug hunting and external red-team methodology |
| Category | AI-assisted offensive security methodology / agent skill bundle (Python, MIT) |
| Primary Use | Running a structured 6-phase workflow — recon, mapping, hunting, validation, reporting — against in-scope bug bounty and authorized pentest targets |
| Safe Use | Intended for assets you own or have written authorization to assess — bug bounty in-scope programs, pentest engagement letters, CTFs, and training labs such as DVWA and OWASP Juice Shop; built-in gates ask about scope before proceeding |
| Telemetry Note | The bundle itself is methodology text driving standard tools (subfinder, httpx, Burp MCP); defenders observe the usual recon fingerprinting — certificate-transparency enumeration, subdomain brute forcing, and scanner-style probes from the operator's egress — while its evidence-hygiene skill encourages PII redaction in reports |
Claude-BugHunter is an interesting entry in the rapidly growing category of security knowledge packaged for AI coding agents: rather than being a scanner or an exploitation framework, it is a bundle of 83 skills in the standard SKILL.md Agent Skills format, 15 slash commands, and a deterministic engagement engine under engine/, all designed to make Claude Code behave like a disciplined senior bug-hunting researcher instead of a general-purpose chatbot. The repository sits at roughly 4.4k stars, is written in Python, and ships under an MIT license, with topics spanning bug-bounty, red-team, claude-skills, and web-security. What it actually encodes is methodology — curated from 681 disclosed HackerOne reports, 433 of them individually cited — covering 24 core vulnerability classes, plus enterprise identity and perimeter attack matrices.
The architecture is described as four stacked layers. The Think layer (bb-methodology, redteam-mindset) encodes a five-phase non-linear workflow and operator discipline. The webapp hunting layer contains 58 hunt-* skills, each mapping to a vulnerability class — XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open redirect — with per-class detection patterns, bypass tables, and chain templates derived from disclosed reports. A perimeter layer covers enterprise platform chains across M365/Entra ID, Okta-as-IdP, on-prem SharePoint (including ToolShell and legacy SOAP surfaces), VMware vCenter and Workspace ONE, SSL-VPN appliances, and cloud IAM misconfigurations. Finally, a shipping layer handles triage, VRT-aware severity, report writing, and evidence hygiene.
What makes this more than a prompt library is the loading mechanism: skills trigger automatically by topic rather than by name. You describe what you're testing in plain English and the relevant skills load — the README's illustrative transcript shows recon running subfinder and crt.sh for subdomain enumeration, httpx for liveness, and tech fingerprinting, before ranking the surface by interest (a GraphQL endpoint with introspection enabled, an OAuth/SSO authentication host). The deterministic engine/ component maps a target's attack surface and routes each finding to the skill that handles that class, which keeps the agent from freelancing outside its curated knowledge.
Installation is straightforward and non-weaponized — it's methodology, not munitions. Option A installs it as a Claude Code plugin via /plugin marketplace add elementalsouls/Claude-BugHunter followed by /plugin install claude-bughunter@elementalsouls, which namespaces all 83 skills under claude-bughunter: and updates with plugin version bumps. Option B is a clone install: git clone the repository and run scripts/install.sh on macOS/Linux or scripts/install.ps1 on Windows, which copies skills into ~/.claude/ and wires the hunt engagement scaffolder. A standalone cbh CLI is available via pipx install for orchestration without a full clone.
A notable engineering decision is multi-harness portability. Because the skills are plain SKILL.md files, the same bundle loads into OpenCode, OpenAI's Codex CLI, Hermes Agent, and Google AntiGravity; the installer's --all flag detects installed harnesses and copies skills into each one's directory (~/.agents/skills, ~/.hermes/skills, ~/.gemini/config/skills), while --burp-mcp wires a Burp Suite MCP server into each harness for live proxy integration. The full knowledge layer ports everywhere; the slash commands and the /hunt engine remain Claude-Code-only by design, which tells you the orchestration logic depends on Claude Code's specific execution model.
The scope discipline is unusually explicit for this genre, and it's worth reading closely. The bundle covers only the external attack surface — what's reachable from the internet without first compromising an internal endpoint. The README deliberately excludes internal Active Directory attacks (no BloodHound, Kerberoasting, DCSync, or AD CS abuse tradecraft), C2 frameworks, post-exploitation and persistence, EDR/AV evasion, and binary exploitation. The author frames these as design decisions rather than gaps, on the theory that internal-domain and post-exploit work carries a different operational risk profile and deserves its own bundle. For an operator, that boundary matters: this is a recon-to-report tool for perimeter work, not an all-phase red-team toolkit.
The workflow itself is a six-phase non-linear cycle — recon, map and rank, hunt, validate, report — with scope enforced in code and a 7-Question Gate in triage-validation that runs before anything is submitted. The gate explicitly asks whether the asset is in scope (Q3) and whether the finding class is on the program's accepted-impact list (Q2), which functions as a guardrail against the classic bug bounty failure mode of testing beyond authorization or submitting out-of-scope impact. The evidence-hygiene skill adds PII redaction for report artifacts, and bugcrowd-reporting includes researcher-side hygiene intended to signal legitimate authorized testing to a target's fraud team.
For defensive readers, the value proposition inverts cleanly. The same 681-report-derived detection patterns that guide an authorized hunter describe what defenders should be alerting on: introspection-enabled GraphQL endpoints, permissive OAuth redirect_uri handling, IMDS and STS confusion in cloud IAM, unpatched SSL-VPN appliance CVE chains. Blue teams can use the skill catalog in docs/skills.md as a checklist for external attack-surface management, and the platform matrices for M365/Entra and Okta read as well as a hardening guide as an attack map. The triage-validation severity logic, being VRT-aware, also maps cleanly onto how Bugcrowd programs triage incoming reports.
From a trust standpoint, treat the bundle as you would any third-party prompt-supply chain: the skills are instructions your agent will follow, so review SKILL.md contents before pointing the agent at anything real. The README itself acknowledges Anthropic runtime cyber safeguards as a constraint on what the agent will do, and directs the excluded categories — 0-day weaponization against unauthorized targets, post-exploitation tooling, malware development, mass-targeting infrastructure — to a SECURITY.md posture document. The authorization framing is consistent: assets you own, written engagement authorization, or training platforms like DVWA, OWASP Juice Shop, Hacker101, and testphp.vulnweb.com.
Where this fits in an authorized workflow is as a force multiplier between raw tooling and human judgment. subfinder, httpx, and Burp still do the technical work; the bundle contributes the curatorial layer — what to look for, in what order, how to validate before reporting, and how to write it up for HackerOne, Bugcrowd, Intigriti, or Immunefi. Its honest scoping, citation-backed patterns, and built-in authorization gates make it one of the more responsible examples of AI-assisted offensive methodology, and a useful reference artifact for defenders mapping their own external perimeter against what hunters are being taught to look for.
elementalsouls/Claude-BugHunter.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.