Implement the 5-stage Funnel workflow (Notes → Leads → Primitives → Findings → Reports) for structured bug bounty hunting. Based on Critical Thinking Bug Bounty Podcast Episode 166.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
"Structure your hacking data like a sales funnel. Raw observations at the top, polished reports at the bottom." — Critical Thinking Podcast, Ep. 166 [37:42]
flowchart TB
N["📝 NOTES<br/>(All raw observations)"]
L["🔍 LEADS<br/>(Interesting patterns)"]
P["🔧 PRIMITIVES / GADGETS<br/>(Reusable techniques & entry points)"]
F["🐛 FINDINGS<br/>(Confirmed vulnerabilities)"]
R["📄 REPORTS<br/>(Submission-ready documentation)"]
N --> L --> P --> F --> R
style N fill:#1a1a2e,stroke:#e94560,color:#fff
style L fill:#1a1a2e,stroke:#f9a826,color:#fff
style P fill:#1a1a2e,stroke:#16c79a,color:#fff
style F fill:#1a1a2e,stroke:#11999e,color:#fff
style R fill:#1a1a2e,stroke:#6c5ce7,color:#fff
Everything goes here. No filtering. No judgment. Write it down NOW, evaluate LATER.
Directory structure:
target-name/
├── notes/
│ ├── 2025-01-15-initial-recon.md
│ ├── 2025-01-15-auth-flow-analysis.md
│ ├── 2025-01-16-api-endpoint-mapping.md
│ └── 2025-01-16-js-source-review.md
Note template:
# [Date] [Topic]
## Context
- Target: [subdomain/endpoint/feature]
- Tool used: [Burp/Browser DevTools/ffuf/etc]
- Time spent: [duration]
## Observations
- [Observation 1]
- [Observation 2]
## Raw Data
[Paste interesting requests/responses/code snippets here]
## Gut Feeling
- [ ] Worth investigating further
- [ ] Dead end
- [ ] Need more context
What belongs in Notes:
Leads are notes that survived initial triage. Something here is worth deeper investigation.
Promotion criteria (Notes → Leads):
| Signal | Example |
|---|---|
| Reflected user input | Parameter value appears in response body/headers |
| Inconsistent authorization | Different responses for same endpoint with different user roles |
| Verbose error messages | Stack trace leaking framework version, file paths |
| Unprotected API endpoints | /api/internal/ accessible without auth |
| Client-side security controls | JavaScript validation with no server-side enforcement |
| Unusual HTTP headers | X-Debug: true, X-Powered-By: Express 4.17.1 |
Lead template:
# LEAD: [Short Description]
## Source Note
- Link: [notes/2025-01-15-auth-flow-analysis.md]
## Hypothesis
[What vulnerability might this lead to?]
## Evidence
[Specific request/response or code snippet proving this is worth pursuing]
## Next Steps
1. [Action item 1]
2. [Action item 2]
## Priority: [HIGH / MEDIUM / LOW]
Primitives are common attack techniques or entry points you discover that can be reused across multiple targets. Think of them as building blocks for exploitation chains.
Examples:
| Primitive | Description | Reuse Potential |
|---|---|---|
| Unsigned JWT | Application accepts alg: none JWTs | Any endpoint using this auth |
| GraphQL Introspection | __schema query returns full type system | Enumerate all mutations |
| Predictable ID sequence | User IDs are sequential integers | IDOR on any user-scoped endpoint |
| Open redirect on login | /login?redirect= accepts any URL | OAuth token theft chain |
| File upload → path traversal | Upload filename is used in storage path | Write to any directory |
Primitive template:
# PRIMITIVE: [Technique Name]
## Description
[What is this technique and why does it work?]
## How to Detect
[Specific test to confirm this primitive exists on a target]
## Exploitation
[Step-by-step usage]
## Chain Potential
[What can this be combined with? SSRF + this = ? IDOR + this = ?]
## Seen On
- [Target 1] — [Date]
- [Target 2] — [Date]
A finding is a CONFIRMED bug with a working proof-of-concept. No speculation — only reproducible exploitation.
Promotion criteria (Leads → Findings):
Finding template:
# FINDING: [Vulnerability Type] in [Component]
## Severity: [Critical / High / Medium / Low]
## CVSS 4.0: [Score] — [Vector String]
## Summary
[2-3 sentences: what is broken, how it is exploited, worst-case impact]
## Proof of Concept
[Exact curl command / Burp request / script that reproduces the bug]
## Impact
[Specific business impact with numbers if possible]
## Root Cause
[Why does this vulnerability exist? Missing validation? Broken access control?]
## Remediation
[Specific code fix, not generic advice]
## Status: [CONFIRMED / SUBMITTED / TRIAGED / RESOLVED / DUPLICATE]
The final polished document submitted to the bug bounty platform. This is where money is made or lost.
Report quality directly correlates with bounty amount.
See the elite-report-writing skill for the full HackerOne-optimized report template.
Quick Report Checklist:
[VulnType] in [Component] Allows [BusinessImpact]Use Claude to automate transitions between stages:
Prompt to Claude:
"Review all files in notes/ and identify any that should be promoted to leads/.
For each promotion, create a lead file with hypothesis, evidence, and priority.
Explain why each note was or was not promoted."
Prompt to Claude:
"Take the finding in findings/idor-user-profiles.md and generate a
HackerOne-ready report in reports/. Use the elite report template.
Validate the CVSS score against the described impact."
programs/
└── example-corp/
├── .claudemd # Scope, policy, auth tokens (see ai-pair-hunting skill)
├── notes/ # Stage 1: Everything goes here
├── leads/ # Stage 2: Worth investigating
├── primitives/ # Stage 3: Reusable gadgets
├── findings/ # Stage 4: Confirmed bugs
├── reports/ # Stage 5: Submitted reports
└── scripts/ # Custom automation for this target
IMPORTANT: The 5-stage funnel is a framework, not a cage. You are expected to adapt it:
- Add sub-stages if a target is complex (e.g., Leads-High / Leads-Low).
- Create cross-references between primitives and findings.
- Auto-generate statistics (conversion rate: notes→findings).
- Build a "dormant leads" watchlist for findings that need updated tool versions.
Think like an attacker. Adapt. Improvise.
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
日本語の概要は準備中です。原文の説明を表示しています。
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
日本語の概要は準備中です。原文の説明を表示しています。
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
日本語の概要は準備中です。原文の説明を表示しています。