Claude Bug Bounty

AI-powered bug bounty hunting — recon to report, in your terminal.

_{Find vulnerabilities. Validate them. Get paid.}

Quick Start · Commands · What It Finds · Install · FAQ

What Is This?

A Claude Code plugin that turns your AI assistant into a professional bug bounty hunting partner. Give it a target — it handles recon, tests for vulnerabilities, validates findings through a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

It remembers everything. Patterns found on one target inform the next. Sessions pick up where they left off.

Requires Claude Code with a Claude Pro / Max plan or an Anthropic API key.

Quick Start

Option A — let Claude install it (recommended)

Open your terminal, run claude, then paste:

Install the Claude Bug Bounty toolkit from https://github.com/shuvonsec/claude-bug-bounty
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available. If anything breaks, tell me
which tool failed and the exact one-line fix.

Option B — manual

git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh   # subfinder · httpx · nuclei · katana · ffuf · dalfox
chmod +x install.sh      && ./install.sh          # skills + commands → ~/.claude/

Then start hunting:

claude
/recon target.com        # map the attack surface
/hunt target.com         # test for vulnerabilities
/validate                # run the 7-Question Gate
/report                  # write the submission

Commands

Core Workflow

Recon & Enumeration

Smart Contract (Web3)

Session & Utility

What It Finds

20 Web2 Vulnerability Classes

10 Web3 / Smart Contract Bug Classes

AI Agents

Nine specialists, each built for one job:

How It Works

You  →  /recon  →  /hunt  →  /validate  →  /report
              ↓                     ↓
         Hunt Memory          7-Question Gate
      (persists across      (kills weak findings
          sessions)          before you submit)

Every tool in the pipeline is gated on whether it's installed — missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.

Project Structure

claude-bug-bounty/
│
├── skills/                    # AI knowledge bases — loaded as /skill-name
│   ├── bug-bounty/            # Master workflow — all vuln classes, LLM testing, chains
│   ├── bb-methodology/        # Hunting mindset · 5-phase workflow · session discipline
│   ├── web2-recon/            # Subdomain enum · live host discovery · URL crawl
│   ├── web2-vuln-classes/     # 21 bug classes with bypass tables
│   ├── security-arsenal/      # Payloads · bypass tables · gf patterns
│   ├── triage-validation/     # 7-Question Gate · 4 gates · never-submit list
│   ├── report-writing/        # Templates for H1 · Bugcrowd · Intigriti · Immunefi
│   ├── web3-audit/            # Smart contract bugs · Foundry PoC · 10 bug classes
│   ├── meme-coin-audit/       # Rug pull detection · LP attacks · bonding curve
│   └── credential-attack/     # Password spray methodology · legal guardrails
│
├── commands/                  # 26 slash commands (/recon /hunt /validate /report …)
├── agents/                    # 9 specialized AI agents (recon, validator, reporter …)
│
├── tools/                     # Python + shell scanner pipeline (~35 tools)
│   ├── hunt.py                # Master orchestrator
│   ├── recon_engine.sh        # Subdomain + URL discovery
│   ├── vuln_scanner.sh        # XSS · SQLi · SSRF · SSTI probe pipeline
│   ├── validate.py            # 4-gate finding validator
│   └── …                      # 30+ more — see tools/README.md
│
├── memory/                    # Cross-session hunt memory (pattern DB · audit log)
├── rules/                     # Always-active hunting + reporting rules
├── web3/                      # 13-chapter smart contract audit guide
├── docs/                      # Advanced techniques · auth sessions · payloads ref
├── mcp/                       # MCP integrations — Burp Suite · Caido · HackerOne API
├── wordlists/                 # Curated wordlists + SecLists / PayloadsAllTheThings refs
├── scripts/                   # Dork runner · full hunt pipeline
├── hooks/                     # Claude Code hook configuration
├── site/                      # bughunter.fun landing page
├── demo/                      # Tutorial demo server (video walkthroughs)
│
├── install.sh                 # Install skills + commands → ~/.claude/
├── install_tools.sh           # Install subfinder · httpx · nuclei · katana · ffuf …
├── uninstall.sh               # Remove from ~/.claude/
└── config.example.json        # Auth session config template

Installation

Prerequisites:

# macOS
brew install go python3 jq

# Linux (Ubuntu/Debian)
sudo apt install golang python3 jq

Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):

chmod +x install_tools.sh && ./install_tools.sh

AI skills + commands into Claude Code:

chmod +x install.sh && ./install.sh

Other agent harnesses:

./install.sh --agent opencode    # OpenCode
./install.sh --agent pi          # Pi Agent
./install.sh --agent codex       # Codex
./install.sh --agent all         # every supported target

Optional: Chaos API key (better subdomain coverage)

export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc

Rules

These run every session, no exceptions:

1. Read full scope first — only test what the program says you can
2. Real bugs only       — "Can an attacker do this RIGHT NOW?" if no, stop
3. Kill weak findings   — 30-second check saves hours of wasted reporting
4. Never go out of scope — one wrong request can get you banned
5. 5-minute rule        — no progress after 5 min? move to the next target
6. Validate before report — /validate before spending 30 min writing
7. Impact first         — test the bugs with the worst consequences first

Contributing

PRs welcome. Most valuable: - New scanner modules or detection techniques - Payload additions to skills/security-arsenal/SKILL.md - Methodology improvements backed by paid reports - Platform support (YesWeHack · Synack · HackenProof)

git checkout -b feature/your-contribution
git commit -m "feat: short description"
git push origin feature/your-contribution

Star History

<img alt="Star History Chart" src="https://api.star-history.com/chart?repos=shuvonsec/claude-bug-bounty&type=date&legend=top-left" />

GitHub · Twitter · shuvonsec@gmail.com

Built by bug hunters, for bug hunters.

_{MIT License · For authorized security testing only. Always test within an approved bug bounty program scope.}