# claude-bughunter

83-skill bug-hunting & external red-team bundle for Claude Code — 58 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands included.

- **Kind:** plugin (installs as one bundle)
- **Owner:** elementalsouls
- **Source:** https://github.com/elementalsouls/Claude-BugHunter
- **Pinned commit:** `2ad7a75ac2057d54da3f66ae56a3334b58714d91`
- **Page:** https://forefy.com/plugins/54a12af0-25ae-558c-ba3c-3ffdeaaa5a49
- **API (JSON):** https://forefy.com/api/asr/plugins/54a12af0-25ae-558c-ba3c-3ffdeaaa5a49

## Install

Ask your agent: `Install the claude-bughunter plugin securely from: https://forefy.com/plugins/54a12af0-25ae-558c-ba3c-3ffdeaaa5a49 globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/54a12af0-25ae-558c-ba3c-3ffdeaaa5a49/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (83)

- [cloud-iam-deep](https://forefy.com/skills/5aac391c-ecd2-4300-be2b-f769d9f07c5e): Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM en…
- [m365-entra-attack](https://forefy.com/skills/354bc1c6-1077-44e4-a885-4157b093df14): Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout m…
- [enterprise-vpn-attack](https://forefy.com/skills/41727fa9-4801-4450-ad6b-b6b17639138b): External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pul…
- [ios-redteam-pipeline](https://forefy.com/skills/7c4b5c93-7ab9-4b58-ae37-301f5462b4bf): End-to-end iOS red-team pipeline — IPA acquisition (App Store extraction, TestFlight, enterprise/ad-hoc sideload), class-dump/Hopper/Ghidra static analysis, In…
- [okta-attack](https://forefy.com/skills/8d59263b-904a-4f7c-a7f5-93e895e23f57): Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification…
- [hunt-k8s](https://forefy.com/skills/c9638b16-91cf-48a7-b50d-d4fd6b3e896e): Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboar…
- [evidence-hygiene](https://forefy.com/skills/213097d0-4f49-45f6-94b6-1d3cf3fcff2d): Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hidi…
- [hunt-auth-bypass](https://forefy.com/skills/0d2de04e-32fb-4afa-b04e-87b18df8de9f): Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/…
- [hunt-cache-poison](https://forefy.com/skills/af4d4c50-4215-4ffb-b738-2a4368ae9f6c): Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cach…
- [hunt-grpc](https://forefy.com/skills/044bb6a6-dbfb-488a-824e-28f4441b35a5): Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plai…
- [hunt-host-header](https://forefy.com/skills/57d6e780-ec42-4090-b1d2-5393eeb4d497): Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → c…
- [hunt-html-injection](https://forefy.com/skills/985ebf03-e4ee-4953-9c69-33188f7af0e1): Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but…
- [hunt-saml](https://forefy.com/skills/f7874394-12a2-4ecb-b486-b47d8142a1d2): Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injectio…
- [hunt-ssrf](https://forefy.com/skills/0f2be10c-caf2-4ea0-b2e2-5a9369b96145): Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25…
- [hunt-subdomain](https://forefy.com/skills/f768d9a8-005f-4a83-bdac-2c7598180a7f): Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issu…
- [hunt-websocket](https://forefy.com/skills/1b70aaf3-7394-4870-8e95-98e78781100c): Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, mes…
- [hunt-xss](https://forefy.com/skills/b800a47d-2f95-427e-9f42-eeb7641ddee7): Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTM…
- [osint-methodology](https://forefy.com/skills/7c1f7ab1-b2c1-476c-a6d5-e7406b8c4b01): Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery,…
- [triage-validation](https://forefy.com/skills/6feb9d40-050e-4bfc-92cf-f0e94bc3166c): Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain…
- [web3-audit](https://forefy.com/skills/f80ead84-cd8f-4805-9182-a20ed18c8d90): Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, s…
- [apk-redteam-pipeline](https://forefy.com/skills/8fb7eab0-5106-4838-a4f7-d33e7022e26a): End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase g…
- [bb-local-toolkit](https://forefy.com/skills/a72d8dae-3c71-4d47-9e81-a44d68fb89a3): Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolv…
- [bb-methodology](https://forefy.com/skills/54c5fb4b-8298-43d0-bc36-6d66faf09cc2): Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5…
- [bug-bounty](https://forefy.com/skills/93e79ba2-fe1a-4413-8171-4b7567755ada): Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed…
- [bugcrowd-reporting](https://forefy.com/skills/e6543543-1f4f-4848-9166-66dcebb340fa): Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity overrid…
- [hunt-api-misconfig](https://forefy.com/skills/6841207a-882c-4dd4-8513-04ab68f76cf4): Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true…
- [hunt-aspnet](https://forefy.com/skills/606f89c2-4858-40db-9b49-76b2d48be17e): Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validat…
- [hunt-ato](https://forefy.com/skills/62e71537-2bcf-43d6-863e-50e8dc49311c): Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/nume…
- [hunt-brute-force](https://forefy.com/skills/1d79fc29-6e12-4615-9eb5-61d7f67d2497): Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enume…
- [hunt-business-logic](https://forefy.com/skills/b9125ccc-a49d-4a4b-9f9c-c2dd2228d63e): Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-qu…
- [hunt-captcha-bypass](https://forefy.com/skills/95ac3926-ec4e-4251-84b2-0bb78ee70935): Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a…
- [hunt-cicd](https://forefy.com/skills/67e81a15-d2e8-4f1a-a332-6d80e34a0e31): Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OID…
- [hunt-clickjacking](https://forefy.com/skills/13af98a9-7493-4ca8-96f4-f68d3dc78386): Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking…
- [hunt-cloud-misconfig](https://forefy.com/skills/07867f2b-a2e0-4c69-9e9e-413ad8bc77b2): Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed…
- [hunt-cors](https://forefy.com/skills/c5061775-aa48-49d9-aa34-dad88337e70c): Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-fl…
- [hunt-csrf](https://forefy.com/skills/4a5f23f9-f1ca-457d-8e84-cd60f521ede6): Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-…
- [hunt-deserialization](https://forefy.com/skills/85e87075-c13d-43d8-afcc-f80cbc772723): Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI…
- [hunt-dispatch](https://forefy.com/skills/4dc7ad1c-58ea-4a72-847f-47da076bedf6): Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /h…
- [hunt-dom](https://forefy.com/skills/42d4a465-f027-42f2-9774-eabc0bbb540c): Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker a…
- [hunt-exceptional-conditions](https://forefy.com/skills/f70d218a-6038-484b-9687-39463451963c): Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail…
- [hunt-file-upload](https://forefy.com/skills/fc6a9410-f6b7-4d39-9a7e-7b36fcc798ab): Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension…
- [hunt-fintech-graphql](https://forefy.com/skills/e5af8940-a0f9-4527-9d32-0326adb78321): Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio query IDO…
- [hunt-forgot-password](https://forefy.com/skills/e3ef999b-b2db-4d86-a514-f63338f0436b): Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email…
- [hunt-graphql](https://forefy.com/skills/c699280c-b66a-414d-8ad3-32006e79f878): Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross…
- [hunt-http-smuggling](https://forefy.com/skills/c73c2b4a-0956-45e4-871f-1983f08eed31): Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Co…
- [hunt-idor](https://forefy.com/skills/7b4a762d-d15b-4b28-aa2a-a23919cf79fd): Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
- [hunt-jwt-crypto](https://forefy.com/skills/b66dc0c0-8401-4db7-a764-e27ee3e866a1): Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin…
- [hunt-laravel](https://forefy.com/skills/c6785944-6b54-4ba8-8a94-4313386b3df2): Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthoriz…
- [hunt-ldap](https://forefy.com/skills/c133c016-97a7-4c84-b8c5-adf2065f8f80): Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass.…
- [hunt-lfi](https://forefy.com/skills/3fafaa78-1f49-46cd-80e1-749fa7ec0672): Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload neede…
- [hunt-llm-ai](https://forefy.com/skills/3690d6a9-a0dd-431a-a12f-0f24ba8f267a): Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2…
- [hunt-mfa-bypass](https://forefy.com/skills/680b7805-9664-45c4-8154-d6e2053ff5ab): Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-…
- [hunt-misc](https://forefy.com/skills/a1eabecf-4cfb-4186-98a5-e461c009c845): Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
- [hunt-nextjs](https://forefy.com/skills/5480de1e-7c5c-4e4c-a271-26f0838c0495): Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image…
- [hunt-nodejs](https://forefy.com/skills/0cb4ea8f-624c-411f-a75c-2b8f9acf8c9f): Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval inject…
- [hunt-nosqli](https://forefy.com/skills/d17da7e1-631c-46aa-b68e-27a4ead384a0): Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when tar…
- [hunt-ntlm-info](https://forefy.com/skills/ee6baa4b-e49c-4487-ae33-e4e7e5d238e2): Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, interna…
- [hunt-oauth](https://forefy.com/skills/56a94cf4-0a5e-485c-8689-54523a28dba3): Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
- [hunt-open-redirect](https://forefy.com/skills/d1625ffb-7e01-4dc6-b82d-a4486410793b): Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta…
- [hunt-race-condition](https://forefy.com/skills/e3c0550b-ce01-42b7-b172-c9c9987547c4): Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF…
- [hunt-rag-vector](https://forefy.com/skills/9c29828e-3844-42b3-86c5-55b1a449591a): Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives acros…
- [hunt-rce](https://forefy.com/skills/849dfc71-8387-4814-9eb9-9d2e398d0b47): Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
- [hunt-session](https://forefy.com/skills/1d13b3fd-8c9f-444f-8b06-45b36cf6bb3e): Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, pr…
- [hunt-shadow-api](https://forefy.com/skills/b081c7a6-4cfa-4368-9e00-58ae53e78544): Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, h…
- [hunt-sharepoint](https://forefy.com/skills/950a1849-c4e5-430a-be19-3a13299c8a2e): Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login by…
- [hunt-source-leak](https://forefy.com/skills/ca7923d7-d4fa-47a6-b9f8-77521c39fa61): Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .…
- [hunt-spa-api](https://forefy.com/skills/4026ef78-b3fc-4c8d-bbdc-c8d77907d976): Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the hi…
- [hunt-springboot](https://forefy.com/skills/85e6c831-7593-454d-9642-5a427174bc4b): Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE,…
- [hunt-sqli](https://forefy.com/skills/9f1aa63c-808f-4f8e-aff3-4dad962f1841): Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mo…
- [hunt-ssti](https://forefy.com/skills/ffbc6f71-b235-4679-8d17-fd5905927ce3): Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Sma…
- [hunt-tls-network](https://forefy.com/skills/cc038293-a0e3-44e6-b080-cab115157fc5): Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC…
- [hunt-xxe](https://forefy.com/skills/1e483d7d-5f65-44ed-a0d6-17e08bf1a57f): Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionCo…
- [meme-coin-audit](https://forefy.com/skills/86e223fd-872d-458c-81e2-5cdbf8245b89): Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority,…
- [mid-engagement-ir-detection](https://forefy.com/skills/b0fcbaae-4771-4bf4-8bb2-a9653792246d): Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those obse…
- [offensive-osint](https://forefy.com/skills/d52c53bb-ec8c-4df7-9f1b-072aee7d711c): Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, Gra…
- [recon-scope-triage](https://forefy.com/skills/36537c2e-8b7d-47eb-85f4-44cf8ca904c3): Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the…
- [redteam-mindset](https://forefy.com/skills/fa723c37-13a0-40b0-be82-0ceaffd83062): Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservat…
- [redteam-report-template](https://forefy.com/skills/748aed3d-912c-4c70-840b-d692dc4aaf9e): Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-t…
- [report-writing](https://forefy.com/skills/8d6da7b8-9e6d-45c9-852b-b596da0403a0): Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula,…
- [security-arsenal](https://forefy.com/skills/3f089351-44f2-4340-a0cd-15f038101193): Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific p…
- [supply-chain-attack-recon](https://forefy.com/skills/ec37615d-70fd-4cdd-8618-493cee16cd46): External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injectio…
- [vmware-vcenter-attack](https://forefy.com/skills/7b630408-1cf2-4ae2-b3af-a495211a3348): VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-202…
- [web2-recon](https://forefy.com/skills/4b92b320-e2f8-4a1a-8abc-c2d55e87cda2): Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), di…