[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DF2DFZ8G4YMA0T3CV96CAP":3,"skill-same:01M7DF2DFZ8G4YMA0T3CV96CAP":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":33,"install":34,"resources":47},"01M7DF2DFZ8G4YMA0T3CV96CAP","bounty-hunting-methodology",null,"Bug bounty white-box hunting methodology. Load when the target is an open-source project with a security advisory program, bug bounty, or responsible disclosure policy.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fanalyst\u002Fbounty-hunting\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: bounty-hunting-methodology\ndescription: Bug bounty white-box hunting methodology. Load when the target is an open-source project with a security advisory program, bug bounty, or responsible disclosure policy.\nmetadata:\n  subdomain: analyst\n  when_to_use: \"bug bounty white-box methodology open source security advisory program responsible disclosure policy h1 bugcrowd\"\n  upstream_ref: \"Raptix analyst lane: white-box bounty hunting methodology\"\n---\n\n# Bug Bounty Hunting Methodology\n\nYou are not scanning. You are reading code, mapping architecture, and proving\nexploitability. Volume is the enemy — signal is the metric. Every report must\nsurvive triage by an experienced security engineer.\n\n## Target Assessment\n\nBefore committing iteration budget, evaluate the target:\n\n1. **Impact surface**: downloads\u002Fweek, GitHub stars, dependency depth. A vuln in\n   lodash or React Router has 10-100x the impact of a vuln in a 200-star project.\n2. **Trust boundary complexity**: Does the app load config from untrusted sources?\n   Handle plugins? Parse user-controlled serialized data? Multi-tenant auth?\n   Complex trust boundaries = more attack surface.\n3. **Security advisory history**: Check `github.com\u002Fadvisories?query=\u003Cpackage>`.\n   Projects that accept and credit researchers will work with you. Projects with\n   zero advisories are either very secure or don't have a disclosure process.\n4. **Reward program**: HackerOne, Bugcrowd, Immunefi, GitHub Security Advisories,\n   Google VRP. Check scope, excluded vuln classes, and reward tiers.\n\nRecord the assessment (`kg_record` from your KG slot):\n```\nkg_record('[{\"kind\": \"Repository\", \"key\": \"repo::\u003Cname>\", \"label\": \"\u003Cname>\",\n  \"props\": {\"stars\": N, \"downloads_weekly\": N,\n            \"has_security_policy\": true, \"advisory_count\": N,\n            \"bounty_program\": \"hackerone\"}}]')\n```\n\n## White-Box Methodology\n\nThis is the core loop. Fork. Read. Trace. Prove.\n\n### Step 1 — Map the project\n```bash\nfind \u002Fworkspace\u002Ftarget -name 'package.json' -o -name 'pyproject.toml' \\\n  -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'composer.json' | head -20\n```\nIdentify: language, framework, entry points, config loading, auth middleware.\n\n### Step 2 — Map trust boundaries\nWhere does untrusted input enter the system? Trace these sources:\n- HTTP request params, headers, body\n- Environment variables and `.env` files\n- Config files from current directory (`.gemini\u002Fsettings.json`, `.vscode\u002Fsettings.json`)\n- Plugin\u002Fextension loading paths\n- Deserialization of user-controlled data (pickle, YAML, JSON with class hints)\n- IPC channels, WebSocket messages, MCP tool inputs\n\nFor each source, record an ENTRYPOINT observation:\n```\nkg_record('[{\"kind\": \"Entrypoint\", \"key\": \"entrypoint::POST \u002Fapi\u002Fupload body\",\n  \"label\": \"POST \u002Fapi\u002Fupload body\",\n  \"props\": {\"type\": \"http\", \"file\": \"routes\u002Fupload.py\", \"line\": 42}}]')\n```\n\n### Step 3 — Identify crown jewels\nWhat is the most valuable thing an attacker could reach?\n- Admin access \u002F account takeover\n- RCE \u002F command execution\n- Database contents \u002F PII\n- Secret keys \u002F credentials\n- File system read\u002Fwrite\n\nAdd CROWN_JEWEL nodes for each.\n\n### Step 4 — Trace source → sink\nFor each entrypoint, trace the data flow to dangerous sinks:\n- `exec()`, `eval()`, `spawn()`, `subprocess.run()`, `os.system()`\n- `db.query()` with string interpolation\n- `render()` \u002F `innerHTML` with unescaped input\n- `open()` \u002F `readFile()` with user-controlled paths\n- `pickle.loads()`, `yaml.unsafe_load()`, `JSON.parse()` with reviver\n- `redirect()` with unvalidated URLs\n\nUse `semgrep`, `grep`, or `bash` to find sinks, then manually trace backwards\nto see if untrusted input reaches them without sanitization.\n\n### Step 5 — Prove or discard\nEvery finding MUST go through `validate_finding` with:\n- A working `poc_command`\n- `success_patterns` that uniquely match the exploit signal\n- A `negative_command` (same request without payload)\n- `negative_patterns` matching the baseline response\n- Full `cvss_vector` string\n\nIf you cannot reproduce it, it is NOT a finding. Record the failure and move on.\n\n## High-Value Vulnerability Classes\n\nPrioritize by typical bounty payout and acceptance rate:\n\n1. **Remote Code Execution** — deserialization, template injection, command injection,\n   unsafe `eval`\u002F`exec`, `shell: true` with user input. Highest payouts.\n2. **Access Control Bypass** — IDOR, BOLA, missing ownership validation, broken\n   function-level authorization. Most common accepted finding class.\n3. **Authentication Bypass** — token leakage, session fixation, OAuth state confusion,\n   JWT `alg=none`, password reset flaws.\n4. **Path Traversal \u002F File Write** — directory escape in upload\u002Fdownload handlers,\n   session file storage with crafted IDs, zip slip.\n5. **Server-Side Request Forgery** — redirect bypass, DNS rebinding, cloud metadata\n   access via internal URL parameters.\n6. **Injection** — SQLi, XSS (stored > reflected), LDAP injection, GraphQL injection.\n7. **Information Disclosure** — API key leakage, user enumeration via error codes,\n   schema\u002Fdebug endpoint exposure, directory listing.\n\n## Report Title Convention\n\nEvery report title MUST follow: `[Impact] via [Mechanism] in [Component]`\n\nGood:\n- \"Path traversal in plugin file upload enables arbitrary directory deletion and file write\"\n- \"Cloud function validator bypass via prototype chain traversal\"\n- \"Unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy\"\n\nBad:\n- \"XSS vulnerability found\" (no mechanism, no component)\n- \"Possible SQL injection\" (speculative)\n- \"Security issue in API\" (says nothing)\n\n## What NOT to Do\n\n- Do NOT submit without a validated PoC\n- Do NOT inflate CVSS beyond demonstrated impact\n- Do NOT submit theoretical findings (\"an attacker could potentially...\")\n- Do NOT spam multiple low-quality reports — one rejected report damages signal\n- Do NOT submit to out-of-scope targets\n- Do NOT submit duplicate findings without checking your recorded\n  findings (workspace `findings\u002F` + `inspect_evidence`)\n","# Bug Bounty Hunting Methodology\n\nYou are not scanning. You are reading code, mapping architecture, and proving\nexploitability. Volume is the enemy — signal is the metric. Every report must\nsurvive triage by an experienced security engineer.\n\n## Target Assessment\n\nBefore committing iteration budget, evaluate the target:\n\n1. **Impact surface**: downloads\u002Fweek, GitHub stars, dependency depth. A vuln in\n   lodash or React Router has 10-100x the impact of a vuln in a 200-star project.\n2. **Trust boundary complexity**: Does the app load config from untrusted sources?\n   Handle plugins? Parse user-controlled serialized data? Multi-tenant auth?\n   Complex trust boundaries = more attack surface.\n3. **Security advisory history**: Check `github.com\u002Fadvisories?query=\u003Cpackage>`.\n   Projects that accept and credit researchers will work with you. Projects with\n   zero advisories are either very secure or don't have a disclosure process.\n4. **Reward program**: HackerOne, Bugcrowd, Immunefi, GitHub Security Advisories,\n   Google VRP. Check scope, excluded vuln classes, and reward tiers.\n\nRecord the assessment (`kg_record` from your KG slot):\n```\nkg_record('[{\"kind\": \"Repository\", \"key\": \"repo::\u003Cname>\", \"label\": \"\u003Cname>\",\n  \"props\": {\"stars\": N, \"downloads_weekly\": N,\n            \"has_security_policy\": true, \"advisory_count\": N,\n            \"bounty_program\": \"hackerone\"}}]')\n```\n\n## White-Box Methodology\n\nThis is the core loop. Fork. Read. Trace. Prove.\n\n### Step 1 — Map the project\n```bash\nfind \u002Fworkspace\u002Ftarget -name 'package.json' -o -name 'pyproject.toml' \\\n  -o -name 'go.mod' -o -name 'Cargo.toml' -o -name 'composer.json' | head -20\n```\nIdentify: language, framework, entry points, config loading, auth middleware.\n\n### Step 2 — Map trust boundaries\nWhere does untrusted input enter the system? Trace these sources:\n- HTTP request params, headers, body\n- Environment variables and `.env` files\n- Config files from current directory (`.gemini\u002Fsettings.json`, `.vscode\u002Fsettings.json`)\n- Plugin\u002Fextension loading paths\n- Deserialization of user-controlled data (pickle, YAML, JSON with class hints)\n- IPC channels, WebSocket messages, MCP tool inputs\n\nFor each source, record an ENTRYPOINT observation:\n```\nkg_record('[{\"kind\": \"Entrypoint\", \"key\": \"entrypoint::POST \u002Fapi\u002Fupload body\",\n  \"label\": \"POST \u002Fapi\u002Fupload body\",\n  \"props\": {\"type\": \"http\", \"file\": \"routes\u002Fupload.py\", \"line\": 42}}]')\n```\n\n### Step 3 — Identify crown jewels\nWhat is the most valuable thing an attacker could reach?\n- Admin access \u002F account takeover\n- RCE \u002F command execution\n- Database contents \u002F PII\n- Secret keys \u002F credentials\n- File system read\u002Fwrite\n\nAdd CROWN_JEWEL nodes for each.\n\n### Step 4 — Trace source → sink\nFor each entrypoint, trace the data flow to dangerous sinks:\n- `exec()`, `eval()`, `spawn()`, `subprocess.run()`, `os.system()`\n- `db.query()` with string interpolation\n- `render()` \u002F `innerHTML` with unescaped input\n- `open()` \u002F `readFile()` with user-controlled paths\n- `pickle.loads()`, `yaml.unsafe_load()`, `JSON.parse()` with reviver\n- `redirect()` with unvalidated URLs\n\nUse `semgrep`, `grep`, or `bash` to find sinks, then manually trace backwards\nto see if untrusted input reaches them without sanitization.\n\n### Step 5 — Prove or discard\nEvery finding MUST go through `validate_finding` with:\n- A working `poc_command`\n- `success_patterns` that uniquely match the exploit signal\n- A `negative_command` (same request without payload)\n- `negative_patterns` matching the baseline response\n- Full `cvss_vector` string\n\nIf you cannot reproduce it, it is NOT a finding. Record the failure and move on.\n\n## High-Value Vulnerability Classes\n\nPrioritize by typical bounty payout and acceptance rate:\n\n1. **Remote Code Execution** — deserialization, template injection, command injection,\n   unsafe `eval`\u002F`exec`, `shell: true` with user input. Highest payouts.\n2. **Access Control Bypass** — IDOR, BOLA, missing ownership validation, broken\n   function-level authorization. Most common accepted finding class.\n3. **Authentication Bypass** — token leakage, session fixation, OAuth state confusion,\n   JWT `alg=none`, password reset flaws.\n4. **Path Traversal \u002F File Write** — directory escape in upload\u002Fdownload handlers,\n   session file storage with crafted IDs, zip slip.\n5. **Server-Side Request Forgery** — redirect bypass, DNS rebinding, cloud metadata\n   access via internal URL parameters.\n6. **Injection** — SQLi, XSS (stored > reflected), LDAP injection, GraphQL injection.\n7. **Information Disclosure** — API key leakage, user enumeration via error codes,\n   schema\u002Fdebug endpoint exposure, directory listing.\n\n## Report Title Convention\n\nEvery report title MUST follow: `[Impact] via [Mechanism] in [Component]`\n\nGood:\n- \"Path traversal in plugin file upload enables arbitrary directory deletion and file write\"\n- \"Cloud function validator bypass via prototype chain traversal\"\n- \"Unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy\"\n\nBad:\n- \"XSS vulnerability found\" (no mechanism, no component)\n- \"Possible SQL injection\" (speculative)\n- \"Security issue in API\" (says nothing)\n\n## What NOT to Do\n\n- Do NOT submit without a validated PoC\n- Do NOT inflate CVSS beyond demonstrated impact\n- Do NOT submit theoretical findings (\"an attacker could potentially...\")\n- Do NOT spam multiple low-quality reports — one rejected report damages signal\n- Do NOT submit to out-of-scope targets\n- Do NOT submit duplicate findings without checking your recorded\n  findings (workspace `findings\u002F` + `inspect_evidence`)\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"upstream_ref":27},"analyst","bug bounty white-box methodology open source security advisory program responsible disclosure policy h1 bugcrowd","Raptix analyst lane: white-box bounty hunting methodology","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fanalyst\u002Fbounty-hunting","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add Akapi895\u002Fraptix --skill bounty-hunting-methodology",{"tool":40,"command":41},"bunx","bunx skills add Akapi895\u002Fraptix --skill bounty-hunting-methodology",{"tool":43,"command":44},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill bounty-hunting-methodology","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fanalyst\u002Fbounty-hunting\u002FSKILL.md",true,[],[49,56,63,70,77,84],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]