Hunt Ato (Grade A)Skill di prova di sicurezza testata per Claude AI di Classe A. Tassonomia di presa di controllo account, -9 percorsi distinti al ATO, compresi i percorsi a catena.

Why this exists

Most bug-hunting Claude setups are either too generic (one big "security" prompt) or too fragmented (you bookmark 30 disclosed reports and re-read them every engagement). Neither scales past the second target. This bundle was built and validated through authorized engagements that exposed different capability gaps: Bug-bounty engagement — surfaced four gaps a starter 3-skill stack could not close: 1. No hypothesis discipline — drafts written before validation → wasted hours, hurt validity ratio 2. No per-program reporting tactics — VRT defaults auto-downgraded P3-worthy findings to P4 3. No engagement coordination — findings, evidence, and submission IDs scattered across folders 4. No evidence hygiene — screenshots leaked cookies and victim PII External red-team engagement — exposed five additional gaps that bug-bounty defaults made worse: 1. Conservative defaults retracted real findings — WAPT mindset stopped tests early on defended targets where red-team continuation would have surfaced bypass chains → redteam-mindset 2. No mid-engagement situational awareness — client SOC patched confirmed SQLi within 30 min; external attacker locked 14 accounts during a live test session — both invisible without explicit detection methodology → mid-engagement-ir-detection 3. No enterprise-platform attack chains — M365 + Entra ID, on-prem SharePoint, Cisco SSL VPN, vCenter, and 7 Android APKs all needed current 2024-2026 CVE knowledge and platform-specific tradecraft → m365-entra-attack, o

Asked by Vasyl Kovalenko · Aug 2, 2025

Why your model switched mid-session

Separate from refusals, and easy to miss. On Opus 5, a narrow set of higher-risk cyber requests — Anthropic names exploit generation, binary-based vulnerability scanning and penetration testing — fall back to Opus 4.8 rather than being refused. You get a notice and the response is labelled with the model that answered, but in a long agentic run that is easy to scroll past, so it can look like Opus 5 quietly got worse. See why Claude switched models. What to do depends on what you are actually doing: | Situation | What helps | |---|---| | Auditing your own code — reviewing a repo you own for defects | Say so. "Defensive review of my own repo", "check this against the OWASP Top 10", "secure refactor to remediate" describe the work accurately and read as remediation. This is not a workaround; the work genuinely is defensive. | | Authorized offensive work — live engagement, PoC for a bounty submission | This is what the bundle is for, and the supported route is CVP. Do not reword an offensive engagement to look defensive to get past a classifier — enroll instead. | | You just want the switching off | Settings → Capabilities disables automatic model switching. | /hunt states the engagement frame (authorized, scope-bounded, remediable finding) on its first turn for exactly this reason — engagement context belongs in the session explicitly, not implied. ---

Asked by Katarzyna Zielinska · Jun 21, 2025

Come funziona

Un flusso di lavoro non lineare in 6 fasi — recon → map & rank → hunt → validate → report — con l'ambito imposto nel codice e un gate a 7 domande prima che qualsiasi cosa venga inviata. Due modalità per gestirlo: Plain English — descrivi ciò che stai testando e i relativi skill loads vengono caricati automaticamente. /hunt scaffold + cbh CLI — struttura engagement-folder, stato e orchestrazione. → Guida all'uso e esempio pratico · architettura a 6 fasi e mappa skill-fase · cbh CLI

Asked by Jarrah Whitlock · Jun 7, 2025

Cosa c'è dentro

82 skill, caricati automaticamente per argomento — nessuna invocazione per nome. Copertura dell’intera superficie di attacco esterna: | Categoria | # | Esempi | |---|---|---| | Hunting di applicazioni web | 13 | XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open‑redirect | | Autenticazione e identità | 7 | auth-bypass, session, OAuth, SAML, MFA-bypass, ATO | | API e infrastruttura | 15 | GraphQL, gRPC, WebSocket, API‑misconfig, host-header, RCE | | Avanzato e concorrenza | 6 | race‑condition, HTTP smuggling, deserialization, cache‑poison | | Specifico per framework | 4 | Next.js, Node.js, Laravel, Spring Boot | | Identità aziendale e cloud ★ | 3 | M365/Entra, Okta, cloud‑IAM‑deep | | Infrastruttura e appliance ★ | 4 | VMware vCenter, enterprise VPN, SharePoint, ASP.NET/NTLM | | Red‑team tradecraft ★ | 4 | redteam‑mindset, APK pipeline, supply‑chain recon, mid‑engagement IR | | Recon e OSINT | 4 | web2‑recon, offensive‑osint, subdomain | | Workflow, reporting e specializzato | 11 | metodologia, triage‑validation, evidence‑hygiene, VRT‑aware reporting | Catalogo completo ricercabile → docs/skills.md. Inoltre, fornisce 15 slash command (/hunt, /recon, /report, …) e un motore di engagement deterministico (engine/) che mappa la superficie di attacco di un target e indirizza ogni risultato alla skill che lo gestisce.

Asked by Sami Virtanen · May 30, 2025

Che cos’è questo?

claude-bughunter è un bundle di competenze a inserimento immediato per il sistema di competenze Claude Code. Installa una volta e Claude Code smette di essere un chatbot per iniziare a comportarsi come un ricercatore senior di bug hunting o un operatore red‑team: conosce le tecniche, i modelli di catena, le mappature VRT, le catene CVE delle piattaforme e l’igiene — e rimane entro le linee di scope. Quattro livelli impilati: Think — bb‑methodology + redteam‑mindset: il flusso di lavoro non lineare in 5 fasi, il framework del pensiero critico e la disciplina dell’operatore red‑team. Hunt webapps — 48 skill di caccia curate da 681 report divulgati da HackerOne: schemi di rilevamento per classe, payload, tabelle di bypass e modelli di catena. Hit the perimeter — catene della piattaforma enterprise (M365/Entra, Okta, vCenter, appliance SSL‑VPN, SharePoint, IAM cloud): catene CVE attuali 2024‑2026 + post‑escalation di credenziali. Ship it** — triage‑validation + reporting + evidence‑hygiene: la Porta a 7 Domande, gravità consapevole VRT, repliche OOS, ridazione PII e deliverable red‑team. Tutto attivato automaticamente per argomento — descrivi ciò che stai testando in inglese semplice e i carichi di competenza pertinenti. Nessuna invocazione per nome.

Asked by George Papadakis · May 24, 2025