bug-bounty-methodology

What this skill does

Provides a complete cognitive and operational framework for bug bounty hunting sessions. Combines a 5-phase non-linear workflow (Recon → Map → Discover → Prove → Report) with four thinking domains (Critical, Multi-Perspective, Tactical, Strategic) and developer psychology reversal techniques. Routes decisions about what to test, which tool to use, and how to escalate findings based on phase, target type, and time elapsed.

When to use

• At the start of any new bug bounty hunting session
• When switching to a new program or target
• When feeling stuck or unsure what to do next
• When a finding has low impact and you want to escalate it
• When asking "what should I test next?" or "where am I in the process?"
• When a WAF or filter is blocking your payload and you need a bypass strategy

Prerequisites

• A valid, authorized bug bounty scope (HackerOne, Bugcrowd, Intigriti, Immunefi, or private program)
• A proxy tool (Burp Suite or Caido) running and intercepting traffic
• Two test accounts on the target application (attacker account A, victim account B)
• No external tools are required — this skill is a cognitive framework

Inputs

Variable	Required	Description
BB_TARGET	Yes	Target domain or program name
BB_SCOPE	Yes	In-scope assets (domains, features, APIs)
BB_SESSION_GOAL	Yes	One of: Confidentiality, Integrity, Availability, ATO, RCE
BB_VULN_CLASS	Yes	1-2 vuln classes to focus on this session (e.g., IDOR, SSRF)
BB_ROUTE	Optional	wide (breadth-first) or deep (depth-first, default: wide for new targets)
BB_TIME_LIMIT	Optional	Session time budget in minutes (default: 120)

Workflow

Step 1: Session start — define, select, execute

Before touching any tool, answer these three questions:

# Print your session contract — fill this in before starting
cat <<EOF
SESSION CONTRACT
===============
Target  : ${BB_TARGET}
Goal    : ${BB_SESSION_GOAL}   # One of: Confidentiality / Integrity / ATO / RCE / Availability
Focus   : ${BB_VULN_CLASS}     # 1-2 classes only (e.g., IDOR, SSRF)
Route   : ${BB_ROUTE:-wide}    # wide = many endpoints, deep = one feature thoroughly
Budget  : ${BB_TIME_LIMIT:-120} minutes
EOF

# Route selection guide
# Signal                          -> Route
# New program, first day          -> wide
# Wildcard scope *.target.com     -> wide
# Scope update (new domain added) -> wide
# Main webapp, been here >3 days  -> deep
# Found one interesting subdomain -> deep