# Bug Bounty Automation

> [View this product on lib-pro](https://lib-pro-3f8437.gitlab.io/libs/bug-bounty-automation) · The methodology + tooling to ship real submissions, not 'run subfinder'.

**Outcome:** A system that ships real submissions, not a list of tools to run.

21 battle-tested skills covering the full hunting workflow — from 'open a target' through 'submit a verified report'. Plus a working recon pipeline (subfinder → httpx → nuclei → LLM triage → report), a SQLite state store, and a redacted walkthrough of a real P1 find. The same system used to ship real submissions on HackerOne, Intigriti, YesWeHack.

**Price:** £60 — lifetime · **Category:** Skills Bundle · **Tech:** pi-agent, subfinder, httpx, nuclei, SQLite, Llama 3 8B, Markdown

| Metric | Value |
|--------|-------|
| Skills | 21 |
| Methodology content | 281 KB |
| Worked examples | 1 |
| Adapters | 4 |

## Quick start

```bash
tar -xzf bug-bounty-automation-0.2.0.tgz && cd bug-bounty-automation-0.2.0 && ./scripts/init.sh
```

- # Extract + initialise
- ./scripts/init.sh
- # Edit .env + your target config
- make start TARGET=my-program DAG=recon
- # Skills work in pi-agent, Claude Code, Cursor, Cline, Aider

## Code preview

```
# bb-methodology — Workflow + Mindset

The master orchestrator. Loads first, routes to everything else.

## Daily Discipline: Define, Select, Execute

Before touching any tool:

1. **Define**: "Today I target [feature/domain] to achieve [CIA impact]"
2. **Select**: Choose 1-2 vuln classes (IDOR, Race Condition, etc.)
3. **Execute**: Focus ONLY on selected techniques. No wandering.

## 5 Ultimate Goals (Pick One Per Session)

1. **Confidentiality** — steal data the attacker shouldn't see
2. **Integrity** — modify data the attacker shouldn't change
3. **Availability** — disrupt service (app-level DoS only)
4. **Account Takeover** — control another user's account
5. **RCE** — execute commands on the server

## The 5-Phase Non-Linear Flow

Every hunter has the same five phases. Top 1% run them fast and bounce between them as the data flows.

```

## Use cases

### 1. Your first bug bounty submission

Signed up for HackerOne, stared at the target, didn't know where to start. The bb-methodology skill gives you the discipline.

**Outcome:** First report submitted within 2 weeks.

### 2. Scaling from 1 to 5 programs

Currently hunting one program at a time. The pipeline + ops skill lets you run parallel recon across multiple targets.

**Outcome:** 5x more reconnaissance, same time investment.

### 3. Client security audits

Selling pentest services. The methodology + reporting framework gives you repeatable, defensible audit results.

**Outcome:** Reusable audit playbooks you can run junior consultants through.

### 4. Web3-specific hunting

Solidity + smart contract vulnerabilities are a different game. The web3-audit skill covers reentrancy, access control, MEV.

**Outcome:** A new revenue stream in a less-saturated market.

## Built for

- New hunters who signed up but don't know where to start
- Part-time hunters who want to ship more reports without burning out
- Security consultants who want reusable methodology
- AI coders who want the methodology baked into their workflow
- Solo founders looking for a high-leverage side income

## Highlights

### Methodology, not a workflow

These skills name the moves: explore, design, apply, verify. Once you have the words, you stop arguing about steps and start shipping.

### Top 1% thinking patterns

The persona pattern and anomaly-detection rubric are what separates a scanner from a hunter. The skills teach both.

### Real submissions, real payouts

Worked example: a P1 account-takeover via CORS misconfiguration, triaged in 4 hours, paid $5,000 in 5 days. Redacted, but the methodology is real.

## What's in the box

- `21 skills` — 281 KB of methodology
- `Recon pipeline` — subfinder → httpx → nuclei → triage
- `SQLite schema` — subdomains, responses, findings, triage, reports
- `LLM provider config` — OpenAI, Anthropic, local — $0–$50/mo
- `Docker stack` — swarm-deployable
- `Real worked example` — P1 account takeover, redacted
- `Claude Code adapter` — .claude/commands + CLAUDE.md
- `Cursor / Cline / Aider adapters` — drop-in rules

## Adapters included

These skills were authored for pi-agent, but we include drop-in adapters for the major AI coding tools.

| Tool | Adapter location | What you get |
|------|------------------|--------------|
| pi-agent | `adapters/pi-agent/` | SKILL.md files for the host's ~/.pi/agent/skills/ |
| Claude Code | `adapters/claude-code/` | CLAUDE.md + slash commands |
| Cursor | `adapters/cursor/` | .cursorrules rule sets |
| Cline / Continue | `adapters/cline/` | System-prompt rules |
| Aider / generic | `adapters/generic/` | INSTRUCTIONS.md snippets |

**Same playbook, different packaging.** The adapters translate the methodology into the format each tool expects. Install once, swap agents without re-learning the method.

## Features

- bb-methodology skill — master orchestrator + 5-phase non-linear workflow
- bug-bounty skill — program navigation, scope rules, payment tiers
- web2-recon + web2-vuln-classes — 24 KB of hunt-tested recon methodology
- triage-validation skill — eliminate false positives before reporting
- report-writing skill — templates that get accepted on first submission
- threat-model + credential-attack + coverage — advanced playbooks
- 3 platform-specific skills — HackerOne, Intigriti, YesWeHack rules
- Working recon pipeline (subfinder → httpx → nuclei → LLM triage → report)
- Sample target walkthrough with a redacted P1 report
- Adapters for Claude Code, Cursor, Cline, Aider
- Web3 + meme-coin audit methodologies (lucrative niches)
- $0–$50/mo operating budget — small LLM for triage, free static recon

## FAQ

### Is this for beginner bug bounty hunters?

It's for anyone who has signed up for a program and doesn't know where to start. The methodology assumes you understand HTTP, basic dev tools, and reading code. It does NOT assume you've ever submitted a report.

### Will the methodology work for HackerOne / Intigriti / YesWeHack?

Yes. Three platform-specific skills ship (HackerOne, Intigriti, YesWeHack) covering scope rules, submission patterns, and response-time expectations. The core methodology is platform-agnostic.

### What's the operating cost?

$0–$50/month depending on how many targets you run. Static recon (subfinder, httpx, nuclei) is free. The LLM triage step uses a small model on tight budget caps. Most hunters run at $0–$10/mo by using a local 4B model.

### Does this work for Web3 / smart contract audits?

Yes. The web3-audit skill covers reentrancy, access control, MEV, and the unique tooling of smart contract hunting. The meme-coin-audit skill digs into the very specific (and lucrative) world of token launches.

### Do I need to run the pipeline to use the skills?

No. The skills are the methodology. The pipeline is a tool that uses the methodology. You can read the skills yourself, run recon by hand, or load them into an AI coder for guidance.

### What does the worked example show?

A redacted walkthrough of a real engagement — the recon run, the triage findings, the actual report that was submitted. The program name is anonymised but the methodology, evidence, and impact are genuine.