wattocyber/bug-bounty-libraryCurated bug-bounty methodology library with runbooks, recon/fuzz playbooks, checklists, and CLI helpers for target scoping, cert enumeration, and prior-art review.
Run this first: [[06-alpha-runbook/ALPHA]]
That file is the if-then instruction book (recon → check → test → tools) with HUMAN / AI / TOOL on every step. This README is only the map.
Authorization only. Safe harbor, VDP, GitHub PVR, or coordinated disclosure. No other-customer data. No exploit recipes.
| Folder | What it is |
|---|---|
| [[06-alpha-runbook/ALPHA]] | Instruction book — do the hunt from here |
| [[00-methodology/00-INDEX]] | Why the spine/gates/agent contract exist |
| [[00-methodology/08-gap-search]] | Last internet pass: added holes vs rejected fluff |
| [[01-playbooks/00-INDEX]] | Class depth after ALPHA tells you the stack |
| [[01-playbooks/00-recon-fuzz]] | Phase 2 — inventory, JS harvest, directed ffuf, local OSS fuzz |
| [[02-writeups/00-INDEX]] | Distilled writeup cards + catalog patterns |
| [[02-writeups/2026-sources]] | 2026 catalogs and processes people actually used |
| [[03-tools/README]] | Read-only CLIs |
| [[04-prompts/00-INDEX]] | Extract / reject / structure — never exploits |
| [[05-checklists/intake]] | Printable one-pagers (same gates as ALPHA) |
| [[BOOK-Original-Findings-Playbook]] | Narrative market + resume packet — not the runbook |
python3 tools/classify_target.py --intake out/target-card.yaml -o out/stack.yaml
python3 tools/target_score.py --intake out/target-card.yaml
python3 tools/crt_enum.py --intake out/target-card.yaml -o out/crt-names.txt
python3 tools/prior_art_desk.py --product "…" --repo "owner/name" -o out/prior-art.md
python3 tools/catalog_query.py --q "…" --year 2025 --sort bounty --limit 25
python3 tools/object_graph_stub.py --schema schema.graphql -o out/matrix.csv
Copy [[06-alpha-runbook/templates/target-card.example]] to out/target-card.yaml. Hunt only if target_score.py prints ≥10.
This repo is the library only (extracted from WattoCyber/oscp-notes-2026). Hunt from ALPHA. Known-CVE feeds are GHSA / OSV / NVD via tools/prior_art_desk.py, not a submission queue.