wattocyber/bug-bounty-libraryCurated bug-bounty methodology library with runbooks, recon/fuzz playbooks, checklists, and CLI helpers for target scoping, cert enumeration, and prior-art review.
Folders are numbered in the order a hunter actually works - first to last.
Start at 00-hunt/00-INDEX. Run the hunt from 00-hunt/ALPHA. This README is only the map.
Authorization only. Safe harbor, VDP, GitHub PVR, or coordinated disclosure. No other-customer data. No exploit recipes.
| # | Folder | What you do here | Do not skip to |
|---|
| 0 | 00-hunt/00-INDEX | Open the instruction book. Copy the Target Card. | Class playbooks |
| 1 | 01-authorize/00-INDEX | Quote the policy. Pick a lane. Classify. Score. Walk away if <8. | Recon on a brochure |
| 2 | 02-recon/00-INDEX | Name in-scope hosts, operations, JS, schemas. | Testing a host you have not named |
| 3 | 03-prior-art/00-INDEX | Build the packet before deep work. | “I’ll check Hacktivity later” |
| 4 | 04-map/00-INDEX | Actor × action × object × tenant × state. | Confirming an unnamed cell |
| 5 | 05-test/00-INDEX | Only the stack. Order inside is hunter-ROI, not OWASP. Every leftover class: 05-test/00-WATCH-ATLAS. | The whole index |
| 6 | 06-confirm-report/00-INDEX | Owned-fixture confirm → uniqueness gate → one ticket → ledger. | Submit to “see what triage says” |
| 7 | 07-writeups/00-INDEX | Distilled cards (methods, not copies). | Hunting from a blog |
| 8 | 08-tools/README | Read-only CLIs. | Live Nuclei |
| 9 | 09-prompts/00-INDEX | Extract / reject / structure. | Exploit prompts |
| 10 | 10-checklists/intake | Printable one-pagers. | A third spine |
| 11 | 11-theory/00-INDEX | Why the spine exists. | Hunting from theory |
Narrative companion (market + resume): BOOK-Original-Findings-Playbook. Not the runbook.
python3 tools/classify_target.py --intake out/target-card.yaml -o out/stack.yaml
python3 tools/target_score.py --intake out/target-card.yaml
python3 tools/crt_enum.py --intake out/target-card.yaml -o out/crt-names.txt
python3 tools/prior_art_desk.py --product "…" --repo "owner/name" -o out/prior-art.md
python3 tools/catalog_query.py --q "…" --year 2025 --sort bounty --limit 25
python3 tools/object_graph_stub.py --schema schema.graphql -o out/matrix.csv
Copy 00-hunt/templates/target-card.example to out/target-card.yaml. Hunt only if target_score.py prints ≥10.
This repo is the library only (extracted from WattoCyber/oscp-notes-2026). Known-CVE feeds are GHSA / OSV / NVD via tools/prior_art_desk.py, not a submission queue.