bug-bounty-hunting-prompts README

The project's README from github.com/mdpsec/bug-bounty-hunting-prompts. As one markdown file: README.md.

Bug Bounty Hunting Prompts

Reusable prompt files for building a structured, evidence-first web bug bounty hunting workflow.

This repository contains prompts adapted from a private hunting workflow. It does not contain the original helpers, browser fleet, proxy or email services, dashboard, proof-of-concept runtime, credentials, private operating rules, or reference corpus. The prompts are intentionally not runnable without adapting those dependencies to your own environment.

Enjoy the workflow, and I hope it gives you plenty of ideas for building your own hunting system.

If you put it to use, I would love to hear what you build.

Follow me on @mdp_sec for more bug bounty research, workflow design, and updates.

Provided as-is

This prompt pack is provided as-is, without setup, integration, debugging, or usage support. We will not provide the private helpers, infrastructure, accounts, RAG corpus, orchestration services, or equivalent replacements used in our own workflow. Users are responsible for adapting the prompts, supplying their own tools and resources, validating results, and operating within their own authorization and program rules. Please do not expect maintainers to reproduce private environments or answer individual implementation questions.

Start with ADAPTATION.md. It is the replacement index for every private integration represented by a YOUR_* variable or an angle-bracket placeholder. Do not paste credentials, cookies, tokens, API keys, or private infrastructure details into these prompt files.

Prompt sequence

The public release contains this sequence:

Phase File Purpose
0 phase-00-recon.md Lightweight surface map
1 phase-01-access.md Account setup and authenticated access
2 phase-02-sweep.md Broad endpoint and vulnerability-class sweep
3 phase-03-closeout.md Validate the sweep handoff and release resources
4a phase-04a-scope.md Scope-only context
4b phase-04b-browser-walk.md Authenticated browser walk
5a phase-05a-scope.md Scope-only context for the critical hunt
5b phase-05b-critical.md Critical-impact hunting
6 phase-06-triage.md Initial triage and deduplication
7 phase-07-validate-escalate.md Validate and escalate findings
8 phase-08-verify-escalate.md Independent verification and escalation
8a phase-08a-independent-escalation.md One read-only pre-gate escalation pass
9 phase-09-triage-gate.md Independent live triage gate
10 phase-10-self-duplicate-check.md Same-program duplicate convergence

The duplicate second critical branch and duplicate second independent escalation branch are not included in this public sequence. The browser-walk phase remains available as an optional browser-focused stage.

How to use the prompts

These are prompt source files, not an application or orchestration engine. A typical adaptation is:

  1. Choose the phases that match your workflow.
  2. Replace the runtime variables and integration commands listed in ADAPTATION.md.
  3. Supply current target scope, researcher-owned accounts, and local evidence paths at runtime.
  4. Provide your agent with one phase at a time and preserve the phase handoff artifacts it requests.
  5. Run only against authorized, in-scope assets. Use bounded, non-destructive proofs and restore reversible test changes.

You can remove integrations you do not use. For example, an unauthenticated workflow can omit account setup, browser leases, email, SMS, and authenticated walks while retaining the recon, sweep, triage, and reporting principles.

Safety and disclosure

Use these prompts only for authorized security research. Do not target real users, submit or publish findings automatically, collect data in bulk, or leave state changes behind. Keep secrets outside the repository and report findings through the program's responsible disclosure channel.

Status

This is a reference prompt pack. It is expected to evolve as hunters adapt it to different agents, tools, and program rules.

bug-bounty-hunting-prompts (mdpsec/bug-bounty-hunting-prompts)

Searching Database…

612 ·GitHub
Bug-bounty-hunting-prompts
这是什么？一套可复用的提示词文件包，用于与 LLM 智能体一起运行结构化、证据优先的漏洞赏金挖掘工作流，覆盖从侦察到分类定级和上报的全过程。
这是开箱即用的工具，还是只是提示词文本文件？它是一组 markdown 提示词源文件，不是应用程序、编排引擎，也不是可运行的工具。
怎么开始使用这些提示词？从 ADAPTATION.md 开始，它是所有私有集成占位符的替换索引，然后挑选与你的工作流匹配的阶段，一次一个地喂给你的智能体。
要让这些提示词工作，我需要自己提供什么？你自己的浏览器集群、代理或邮件服务、仪表板、概念验证运行环境、凭据和参考语料，因为原始的私有辅助工具都没有包含在内。
作者会帮我安装配置或调试问题吗？不会，该包按原样提供，不提供安装、集成、调试或使用方面的支持，维护者也不会复现私有环境或回答实现问题。
这些提示词里有关于处理敏感数据的指引吗？有，README 明确警告不要把凭据、Cookie、令牌、API 密钥或私有基础设施细节粘贴到提示词文件中，并要把机密信息保存在仓库之外。
提示词序列覆盖哪些阶段？共十一个编号阶段：从侦察（phase-00）开始，经过访问、扫查、收尾、仅限范围的上下文、浏览器漫游、关键影响挖掘、分类定级、验证/上报、独立验证，直到自我查重（phase-10）。
我能只用工作流的一部分吗？比如跳过身份认证？可以，你可以删掉不需要的集成；例如无需认证的工作流可以去掉账户设置、浏览器租用、邮件和短信，同时保留侦察、扫查、分类定级和报告提示词。
随便对一个网站运行这些提示词，合法或安全吗？不行，这些提示词仅用于对授权范围内的资产进行安全研究，要以有边界的非破坏性证明为前提，不做批量数据收集，发现也应通过项目的披露渠道报告，而不是自动提交。
既然真正的系统没有包含在内，作者为什么要发布这个？这是一个私有挖掘工作流的参考版本，分享出来是让其他赏金猎人把阶段结构和推理方式适配到自己的工具和智能体上，而不是复制一套能直接运行的系统。
What are similar projects?Claude-Red, h4cker, Claude-BugHunter, redamon, PayloadsAllTheThings, evilginx2, Decepticon, hacker-roadmap
Which topics is it in?vulnerability-research, bug-bounty, application-security, ethical-hacking, pentest, redteam, web-security, security-research, vulnerability, prompt, agentic, offensive-security
Creator
mdpsec
Size
0.2 MB
Stars
612
Updated
CommitOct 03
Age
17d
Commits · 90 Days