AI Bug Hunting 101: From Setup to Your First Scan

Introduction

In this post, I'll walk through how I sped up and automated my bug hunting process using AI. I'll show step by step how I set up Burp Suite, the MCP (Model Context Protocol) integration, and the skill files, and share how I approached finding vulnerabilities using specific commands.

The goal here isn't to hand the entire process over to AI. Instead, on endpoints where I got stuck or had a hunch, I used AI as an assistant to move faster and with more confidence — positioning it as a layer that supports the pentesting process, not one that replaces it.

I want to say this upfront: AI produces a lot of false positives — it can suggest security issues that are nonsensical or have no real impact. Because of this, you should only use AI to speed up certain checks, not to blindly turn every suggestion into a report. Handing the entire job over to AI with a single "find vulnerabilities on this site" prompt is a seriously flawed approach — it leads to irrelevant false positive reports and ends up wasting programs' time and resources.

A) SETUP

A1. Burp MCP Setup

Open Burp Suite → go to Extensions → BApp Store tab → type "MCP Server" in the search box → select the extension you find and click Install.

Before running Claude Code, enter the following command in your terminal:

Before running Claude Code, enter the following command in your terminal:

claude mcp add burp --transport sse http://127.0.0.1:9876

claude mcp add burp --transport sse http://127.0.0.1:9876

After opening Claude Code, you can check whether the connection was established by typing the /mcp command.

A2. Installing the Skill (.md) Files

There are various skill sets available on GitHub for bug bounty work. I used the elementalsouls/Claude-BugHunter repo; feel free to try other alternatives as well.

/plugin marketplace add elementalsouls/Claude-BugHunter
# Then install the plugin:
/plugin install claude-bughunter@elementalsouls

/plugin marketplace add elementalsouls/Claude-BugHunter
# Then install the plugin:
/plugin install claude-bughunter@elementalsouls

B) Pentest

Once the setup was complete, the first step was running the /recon command. The command lists the assets it finds on the target site and suggests which command to use next. I won't list every command in the skill set here; if you're interested, you can check the USAGE.md file.

An endpoint that caught my attention led me to run the /hunt-xss command. It gave me a few options; I picked the first one and provided the endpoint URL. Once a payload was found, I asked it to send the request to Burp Suite's Repeater so I could test it, and it went straight into Repeater.

1. https://ginandjuice.shop/catalog?searchTerm=asd — If you find a suitable payload that works, send it to the Repeater section in Burp Suite.

1. https://ginandjuice.shop/catalog?searchTerm=asd — If you find a suitable payload that works, send it to the Repeater section in Burp Suite.

Next, it occurred to me to test whether this endpoint was also vulnerable to SQL injection. I ran the /hunt-sqli command, and it identified a SQL injection vulnerability on the endpoint and obtained user credentials — the pair carlos:hunter2. It again sent the request to Burp Suite's Repeater; the carlos:hunter2 credentials were clearly visible in the response.

After identifying and validating the vulnerabilities, the next step was preparing the report. We used the following command for that. Writing reports is honestly my least favorite part of the process, but this command is, in my opinion, one of the most useful ones out there — it saves a serious amount of time.

/report Can you report these 2 security vulnerabilities?

/report Can you report these 2 security vulnerabilities?

Closing Thoughts and Recommendations

First and foremost, I have to say this clearly: handing the entire process over to AI is absolutely the wrong approach. There are certain points where you must step in manually and review the results yourself — because AI can hallucinate or make mistakes. You need to use it with that in mind.

Beyond that, you can also develop your own skill files. From what I've observed, there's room to add more techniques to the bug classes currently in use; the approach right now is somewhat formulaic. I do think this formulaic approach will significantly speed you up when it comes to finding well-known, common vulnerabilities — but keep in mind that every target's scope may include bugs specific to that website, ones that fall outside the usual patterns. That's exactly why manual review, as I said, is non-negotiable.