Skills

hunt-host-header

hunt-host-header is a skill in elementalsouls/Claude-BugHunter, last changed 7 Jun 2026. It can touch credentials, run shell commands, reach the network and name web addresses — read the findings before installing. Our pattern check flagged nothing at commit 258835b on 27 Oct 2026.

Pattern check: nothing flagged · commit 258835b · 27 Oct 2026

Install
From the author
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
Licence
MIT
Repo stars
5.3k
Folder last changed
7 Jun 2026 (opens in a new tab)
Publisher
elementalsouls
Files
1 file
Checked
258835b (opens in a new tab) · 27 Oct 2026

Install

Each tab says whether it installs commit 258835b, the one we checked, or the latest version.

No tab for your agent? Use Any agent for OpenCode, Goose, Windsurf (Devin Desktop), Zed, Roo Code, Factory Droid, Junie, Amp and Antigravity, and Claude Code for Cline. Kiro needs the folder copied by hand.

Pinned to commit 258835b, the one we checked.

From your project's root folder:

tmp="$(mktemp -d)" &&
  git clone -q --depth 1 --filter=blob:none --no-checkout https://github.com/elementalsouls/Claude-BugHunter.git "$tmp" &&
  git -C "$tmp" fetch -q --depth 1 origin 258835b9015d644f04dbf9ee2ddf52cf277334e1 &&
  git -C "$tmp" sparse-checkout set -- skills/hunt-host-header &&
  git -C "$tmp" checkout -q 258835b9015d644f04dbf9ee2ddf52cf277334e1 &&
  mkdir -p .claude/skills &&
  mkdir .claude/skills/hunt-host-header &&
  cp -R "$tmp"/skills/hunt-host-header/. .claude/skills/hunt-host-header/ &&
  rm -rf "$tmp"

If Claude Code was already running and this created the skills folder, run /reload-skills.

Claude Code docs (opens in a new tab)

What it can touch

From the files and frontmatter at commit 258835b. This is how much a skill can do, not whether it is risky.

What it can touch: Shell, network or credentials

  • Runs shell commands

    Its instructions or files give the agent commands to run on your computer.

  • Reaches the network

    It sends or fetches data over the internet, for example with curl, an HTTP library or a package install.

  • Names web addresses

    It mentions outside web addresses the agent may visit. We list them but don't follow them.

  • Touches credentials

    It reads, asks for or contains keys, tokens, passwords or similar secrets.

    SKILL.md:44 · SKILL.md:163 · SKILL.md:164 and 5 more

Pattern check

Pattern check: nothing flagged · commit 258835b · 27 Oct 2026

We checked every text file in this skill, at commit 258835b on 27 Oct 2026, against 45 published patterns such as download-and-run commands, hidden text and credential access. We don't run the skill, we don't read the web pages it points to, and we can't judge everything its instructions might lead an agent to do. In published tests, pattern checks like this one missed most malicious skills. Read the skill before you install it — especially anything it asks you to download or run.

How the check worksReport an incorrect finding

Outside links we did not follow

  • https://$TARGET/forgot-password
  • https://TARGET.evil.com/
  • https://$TARGET/
  • https://$TARGET/?cb=$RANDOM
  • https://$TARGET/?cb=poison$RANDOM
  • https://$TARGET/latest/meta-data/
  • https://$TARGET/latest/meta-data/iam/security-credentials/
  • https://$TARGET/computeMetadata/v1/
  • https://$TARGET/metadata/instance?api-version=2021-02-01
  • https://$TARGET/oauth/authorize?response_type=code&client_id=app&redirect_uri=https://$TARGET/cb
Show 1 more
  • https://$TARGET/.well-known/openid-configuration

Format check

Each agent reads SKILL.md a little differently. We check the file against each one's published rules; we don't run the skill in any agent.

  • Agent Skills specPasses with warnings

    The open format from agentskills.io, held to what the strictest agents enforce, so one folder loads everywhere.

    • Warning

      Fields outside the spec: sources and report_count. Uploads to the Claude apps and API, and the spec's validator, reject the file; most agents ignore these fields. O1

      Fix: Delete them for a portable skill, or keep them if you only target the agents that read them.

    • Note

      The first sentence of the description is 334 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      There is no license field, so readers can't tell whether they may reuse the skill. O2

      Fix: Add license: with an SPDX name such as MIT or Apache-2.0, or the name of a bundled licence file.

  • Claude CodePasses

    Claude Code reads its own extra fields, ignores unknown ones, and still loads a skill whose frontmatter is broken, without its fields.

    • Note

      The first sentence of the description is 334 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      Claude Code ignores fields it doesn't know: sources and report_count. O1

      Fix: Check the spelling against Claude Code's field list, or delete them.

  • Claude apps & API uploadFails

    Uploading to claude.ai or the Claude API, or packaging with Anthropic's script, accepts only the six spec fields and stops on anything else.

    • Error

      Upload and packaging fail on fields outside the spec: sources and report_count. O1

      Fix: Delete them, and keep your own data under metadata as text values.

    • Note

      The description is 662 characters. The claude.ai Help Center says 200 at most, though Anthropic's API docs and validator allow 1,024. D4

      Fix: If the claude.ai upload refuses it, trim the description to 200 characters.

  • OpenAI (Codex & API)Passes with warnings

    Codex finds SKILL.md by its exact name and needs a description; OpenAI's Skills API checks the frontmatter against the spec and caps uploads.

    • Warning

      Fields outside the spec: sources and report_count. Codex ignores them; OpenAI doesn't say whether its upload accepts them. O1

      Fix: Delete them, or move your own data under metadata as text values.

    • Note

      The first sentence of the description is 334 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

  • VS Code & CopilotPasses

    VS Code reads skills one folder below .github/skills, .claude/skills or .agents/skills and falls back to the folder name when the name is missing or differs; GitHub's Copilot docs require the exact name SKILL.md.

    • Note

      VS Code ignores fields it doesn't support: sources and report_count. O1

      Fix: Delete them unless another agent you target reads them.

SKILL.md

Files

1 file

PathSize
SKILL.md (opens in a new tab)13.8 KB

More from elementalsouls/Claude-BugHunter

  • apk-redteam-pipeline

    elementalsouls/Claude-BugHunter

    End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.

    • Downloads software
    • Runs shell commands
    • +2 more
    Pattern check: Nothing flagged

    MIT · 5.3k repo stars · Updated 18 May 2026

  • bb-local-toolkit

    elementalsouls/Claude-BugHunter

    Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use when you need the local install path of a tool / wordlist / clone for a hunt, or as the full-workflow variant when operating from this local toolkit; for general routing use the bug-bounty skill. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

    • Touches credentials
    • Downloads software
    • +4 more
    Pattern check: 1 item to review

    MIT · 5.3k repo stars · Updated 24 Aug 2026

  • bb-methodology

    elementalsouls/Claude-BugHunter

    Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

    • Touches credentials
    • Reaches the network
    Pattern check: Nothing flagged

    MIT · 5.3k repo stars · Updated 24 Aug 2026

  • bug-bounty

    elementalsouls/Claude-BugHunter

    Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

    • Touches credentials
    • Downloads software
    • +4 more
    Pattern check: 1 item to review

    MIT · 5.3k repo stars · Updated 24 Aug 2026

  • bugcrowd-reporting

    elementalsouls/Claude-BugHunter

    Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.

    • Instructions only
    Pattern check: Nothing flagged

    MIT · 5.3k repo stars · Updated 24 Aug 2026

  • cloud-iam-deep

    elementalsouls/Claude-BugHunter

    Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

    • Touches credentials
    • Runs shell commands
    • +2 more
    Pattern check: Nothing flagged

    MIT · 5.3k repo stars · Updated 5 Jun 2026

All skills in elementalsouls/Claude-BugHunter