sanjaysaini1952/BugBounty-Arsenal

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Send 10 simultaneous transfer requests (same amount, same account). Check if balance allows multiple transfers beyond available funds.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

For every parameter, test: ; ls, | ls, ls , $(ls), && ls, || ls. Diff responses. Report any command execution.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Skill "request-smuggling" from sanjaysaini1952/BugBounty-Arsenal, covering http request smuggling hunting skill, types, detection, manual detection and h2.cl (http/2).

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Check for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

For each parameter (GET, POST, JSON body, headers), append ', ", \, '), ')). Diff responses. Report parameters that emit SQL errors or 500s differing from baseline.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Find every parameter accepting a URL (?url=, ?image=, ?webhook=, ?callback=). Replace with http://169.254.169.254/latest/meta-data/ (AWS), http://metadata.google.internal/, http://localhost:22. Report responses.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Send {{77}} in every parameter. If response contains 49, SSTI is confirmed. Also test ${77}, , #{77}.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Resolve all subdomains. Check if CNAME points to unclaimed resource (S3, Heroku, GitHub Pages, Azure).

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Run npm audit, pip-audit, trivy fs on target. Report known vulnerabilities in dependencies.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

GET / HTTP/1.1 Host: target.com X-Forwarded-Host: evil.com.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Send alert(1) via WebSocket. If other clients render it unescaped, report stored XSS.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Find every search input on the page. Check max character limits. Submit "> and report whether it reflects unescaped into the DOM. Capture request, response, and rendered HTML.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Send ]> &xxe; in XML body. Report if /etc/passwd is returned.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex needs its repo

Skill "payloads" from sanjaysaini1952/BugBounty-Arsenal, covering master payload library, xss payloads, sql injection payloads, ssrf payloads and ssti payloads.

sanjaysaini1952/BugBounty-Arsenal

Skill Claude CodeCodex

Skill "reporting" from sanjaysaini1952/BugBounty-Arsenal, covering reporting & triage skill, report structure (all platforms), title format, report sections and cvss scoring guide.