Post cover image

August 9, 2026

How I Use AI as a Bug Bounty Hunter — Part 1: My Real Setup

Introduction

By BadYasser

4 min read

Introduction

Hey everyone, I'm BadYasser— a Jr. Penetration Tester and Bug Bounty Hunter. In this article, I'm going to share how I use AI in my bug bounty workflow — not the vague "I used ChatGPT to write my report" version, but the actual setup, models, prompts, and tools I use every day.

The Problem

The gap in bug bounty isn't finding something interesting — it's knowing what to do with it fast. You see an exposed endpoint, a weird response, a public SQL schema. The question is: how bad is it, what's the real impact, and how do I write this so it doesn't get triaged as Informative?

That thinking process used to slow me down. Now it doesn't.

My Actual Stack

Claude CLI + DeepSeek Models

I use Claude Code (CLI) from the terminal in Kali — connected to DeepSeek models, not Anthropic's own. Why? Cost and control.

The setup: Claude handles the agentic loop, file reading, tool use, and methodology. DeepSeek handles the thinking. And I split the models by job:

  • DeepSeek Flash → Recon phase. Fast and cheap. Questions like "what attack surface does a Next.js + Payload CMS typically expose?" or "common TYPO3 misconfigurations?" don't need the smartest model — they need a fast answer so I keep moving.
  • DeepSeek Pro → Exploitation and report writing. Slower, more expensive, significantly smarter. When I'm reasoning about real impact, chaining bugs, or writing a report that needs to survive triage — this is the one I trust.

Everything stays in the terminal. No browser tab switching mid-recon. I'm running curl, reading responses, piping output — Claude is right there in the same flow.

skills.sh — Where I Get My Skills

skills.sh is where I build the context Claude works from. I search by vulnerability type — "Broken Access Control", "IDOR", "information disclosure" — and pull targeted skills that I load directly into my session.

Important distinction: these are skills, not articles. Structured, reusable context — not blog posts I have to summarize myself.

The best skills I have aren't from the platform though. They're built from my own accepted reports and from published agents on GitHub. When Claude is working with a skill built from my real findings, it reasons from my actual experience. That's a different quality of output.

The best skill for a bug class is one extracted from a report where you already found that bug.

preview.is — Fast Research When I'm Stuck

preview.is is a hybrid search API over real bug bounty write-ups — semantic + keyword, ranked by relevance, with source URLs.

I use it in two situations specifically:

1. Finding real precedents fast:

bash

curl -X POST "https://api.preview.is/search" \
  -H "X-API-Key: YOUR_KEY" \
  -d '{"query": "unauthenticated REST API PII disclosure Next.js", "k": 5, "min_score": 0.1}'

Feed the results to Claude → instant grounded context from real hunters, not training data.

2. WAF bypass and 403 Forbidden: This is where it saves me most. When I hit a wall — WAF blocking my requests, 403 on an endpoint I know should be accessible — instead of burning time guessing payloads, I search for exactly what others did in the same situation. Real bypass techniques, from real reports, ranked by relevance. Much faster than googling.

The CLAUDE.md File — Persistent Context

In ~/myclaude/, I keep a CLAUDE.md that Claude reads at the start of every session. My full recon methodology in order, my triage standard, my report format, and — most importantly — what's NOT worth reporting.

I never re-explain myself. Every session starts with Claude already knowing how I work and what standard I hold.

CLAUDE.md isn't something you install — it's a file you write yourself. One time. Then every session starts with Claude already knowing who you are and how you work.

The "not worth reporting" list saves the most time: self-XSS, missing security headers without direct impact, rate limiting without real risk, open redirect in Host header. Claude knows to skip these immediately.

My Prompts — The Ones That Actually Work

The /goal Prompt — Main Hunting Session

When I start a new target, I use a prompt that sets the mindset for the whole session. The key principles behind it:

  • Don't come back without a finding — keep going
  • Don't surface something shallow and stop there (found an admin panel? go deeper. found Swagger? test every endpoint)
  • If you find a bug, escalate it or chain it — reach full impact
  • Internal subdomains with no real impact don't count
  • Use the preview.is API when you're stuck on a bypass
  • Follow my methodology from CLAUDE.md

The prompt I use (cleaned up for readability):

/goal
I work as a bug bounty hunter. Target: recon files + target scope
Don't stop until I tell you to. Scan all JS files, IPs, endpoints.
Search for all bug classes. If you find something, escalate it or
chain it to reach full impact — don't stop at surface level.
Rules:
- Found an admin panel? Go deeper, don't just report it exists.
- Found Swagger/API docs? Test every single endpoint listed.
- Found an internal subdomain? Prove real impact or skip it.
- Use my methodology from CLAUDE.md.
- Stuck on a WAF or 403? Use preview.is to find bypass techniques.
- If you find a WordPress install, hunt it like WordPress — plugins,
  themes, xmlrpc, user enumeration, the works.

Harsh? Yes. But it stops the model from doing shallow work — flagging an exposed panel without testing it, or finding Swagger and not touching the endpoints.

The JS Analysis Prompt

You are an experienced bug bounty hunter.
Analyze this JS file and produce a security assessment
1. All REST API endpoints grouped by functionality
2. GraphQL queries and mutations
3. Authentication and authorization mechanisms
4. Hidden, undocumented, or debug endpoints
5. Administrative functionality
6. File upload functionality and risks
7. Hardcoded secrets, API keys, tokens
8. Third-party integrations
All REST API endpoints grouped by functionality
2. GraphQL queries and mutations
3. Authentication and authorization mechanisms
4. Hidden, undocumented, or debug endpoints
5. Administrative functionality
6. File upload functionality and risks
7. Hardcoded secrets, API keys, tokens
8. Third-party integrations

Maps the attack surface in minutes instead of hours staring at minified code.

What the Research Shows (and What I've Seen Myself)

A recent deep test of Claude Code against blind PortSwigger labs confirmed what I've experienced:

Where AI is strong:

  • Recon and attack surface mapping — fast and thorough
  • Reading and reasoning through code — excellent
  • Building a plan across multiple vulnerability classes

Where AI falls short:

  • The last mile — turning a discovery into a working PoC
  • Small but critical details (following a redirect, sequencing requests correctly)
  • Getting stuck in loops, repeating failed approaches

The Honest Summary

AI made me a more efficient thinker. It didn't make me a better hunter. Those are different things. The recon is still mine. The judgment is still mine. The creativity to chain bugs and escalate impact — still human. What changed is the speed between "I see something" and "I understand what it means and how to write it." That gap used to cost me hours. Now it doesn't.

— — — — -

Part 2

I'll walk through real accepted findings with the my full AI workflow.

Do follow me on X for more security findings and updates —

@Badyasseer

This is where you add value. The AI covers more ground faster. You validate the finding and build the PoC. That's what gets a report paid.