mcpField
B
bug-bounty-recon-pipeline

bug-bounty-recon-pipeline

github.com/securityskillsSecurity0179 installsUpdated 9w ago
Repository

About bug-bounty-recon-pipeline

Bug Bounty Recon Pipeline is a skill for building repeatable reconnaissance workflows that track a program’s in-scope attack surface. It combines asset discovery, service checks, content collection, and scheduled change detection to produce a prioritized target list.

Key features

  1. 01Parse and enforce program scope
  2. 02Enumerate and probe subdomains
  3. 03Collect URLs and identify notable endpoints
  4. 04Scan ports and tag non-HTTP services
  5. 05Compare scheduled runs for asset changes

Use cases

  1. 01Set up reconnaissance for a bug bounty program
  2. 02Find newly exposed subdomains, ports, or endpoints
  3. 03Prioritize changed assets for security testing

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill bug-bounty-recon-pipeline

After installing, type/bug-bounty-recon-pipelinein Claude Code to confirm it loaded.

Details

From the project README

Bug Bounty Recon Pipeline

Stand up an automated recon pipeline that surfaces new attack surface as it appears.

When to Use

  • You are starting a bug bounty program and need a repeatable recon workflow
  • You want to detect changes (new subdomains, ports, endpoints) over time

Pipeline Stages

1. Scope Ingestion
  • Parse program scope from the policy page; store exact in-scope patterns (*.example.com vs example.com)
  • Reject anything out of scope at query time, not by memory
2. Subdomain Enumeration
  • Passive: certificate transparency logs (crt.sh), amass passive, subfinder with multiple sources
  • Active: amass active, DNS bruteforce (puredns), permutations (gotator)
  • Resolve and probe live hosts (httpx): status, title, tech stack, CDN
3. Content Discovery
  • URL collection: waybackurls, gau, katana crawl
  • Pattern match for high-value endpoints: API keys, login portals, admin panels, GraphQL, .git, .env (report-worthy without reading contents)
  • Screenshot everything (gowitness / axiom) for manual review
4. Port and Service Scan
  • nmap -sV top ports on in-scope IPs, plus full range on interesting hosts
  • Tag non-HTTP services (RDP, SMB, databases) for targeted testing
5. Change Detection
  • Re-run stages on a schedule (daily/weekly)
  • Diff outputs; alert on new subdomains, new ports, new endpoints, changed tech stacks
  • Store everything in version-controlled or timestamped directories

Tooling Notes

  • Run from VPS/VPN only where program policy permits automated scanning
  • Rate-limit aggressively; many programs ban aggressive automation
  • Containers (e.g., via axiom/nuclei-templates) keep tool versions consistent

Output

A prioritized target list: new/changed assets, annotated with observed technologies and suspected entry points.

Comments

Markdown supported