bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents
This repository also configures its own agents. See what bb-huge tells them →
Skill Claude CodeCodex needs its repo
Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.
Skill Claude CodeCodex needs its repo
Identify and exploit GraphQL API vulnerabilities by leveraging Introspection queries to dump the entire database schema, performing query batching to bypass rate limits (brute forcing), and extracting deeply nested unauthorized data via graph relationship abuse.
Skill Claude CodeCodex needs its repo
Exploit exposed GraphQL introspection endpoints to map the entire API schema. This skill details how to extract available queries, mutations, types, and fields, which significantly aids in identifying hidden endpoints, Broken Object Level Authorization (BOLA/IDOR), and mass assignment vulnerabilities.
Skill Claude CodeCodex needs its repo
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques.
Skill Claude CodeCodex
Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.
Skill Claude CodeCodex needs its repo
Use the H1 Brain MCP Server to pull HackerOne program policies, scope definitions, and disclosed vulnerability reports directly into Claude's context. Based on Critical Thinking Bug Bounty Podcast Episode 166.
Skill Claude CodeCodex
Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.
Skill Claude CodeCodex
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.
Skill Claude CodeCodex needs its repo
Exploit insecure handling of the HTTP Host header to poison password resets, generate cache poisoning vectors, or bypass internal routing restrictions. Use this skill when web applications dynamically generate URLs, links, or redirects based on the arbitrary Host header value supplied by the client rather than relying…
Skill Claude CodeCodex needs its repo
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques.
Skill Claude CodeCodex
HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.
Skill Claude CodeCodex
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.
Skill Claude CodeCodex needs its repo
Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.
Skill Claude CodeCodex needs its repo
Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of…
Skill Claude CodeCodex
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting Content-Length and Transfer-Encoding: chunked headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking…
Skill Claude CodeCodex needs its repo
HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
Skill Claude CodeCodex
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
Skill Claude CodeCodex needs its repo
Detect and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. Use this skill when testing for unauthorized access to resources by manipulating object identifiers like user IDs, order numbers, file references, or API endpoints. Covers parameter tampering, UUID prediction, hash…
Skill Claude CodeCodex needs its repo
Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing…
Skill Claude CodeCodex needs its repo
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques.
Skill Claude CodeCodex
Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.
Skill Claude CodeCodex needs its repo
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging…
Skill Claude CodeCodex needs its repo
File upload endpoints that validate file type only by extension or Content-Type header allow attackers to upload executable files, XSS payloads, XXE-triggering documents, or path-traversal archives. Depending on where files are stored and served, impact ranges from stored XSS to full remote code execution.
Skill Claude CodeCodex needs its repo
Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: