PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to use Claude Code for Bug Bounty: find fast, validate manually

yeswehack.com | blog | #ai-security | #bug-bounty | #pentesting | #claude-code | #xss | #http-desync | #request-smuggling | #llm | #yeswehack
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

In blind bug bounty labs, Claude Code excelled at recon and source review for DOM XSS and H2.TE request smuggling but stalled at proving exploitability — a teammate, not a replacement.
Published
Collected

Related coverage

blog · yeswehack.com
James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup
This roundup covers James Kettle's autonomous research cascade, CRLF-powered desync attacks, a CSS bomb in webmail, and unauthenticated root RCE on Unitree G1 robots.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Bug Bounty Hunters
For bug bounty hunters, HTTP/1.1 Must Die is a major opportunity: desync flaws bypass traditional fixes and netted the research team over $200k in bounties in just two weeks.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
For contract pentesters and MSSPs, HTTP/1.1 Must Die highlights a service gap: demonstrating hidden desync risks in client environments can deliver findings competitors miss.
blog · portswigger.net
The Desync Delusion: Are You Really Protected Against HTTP Request Smuggling?
Most DAST tools detect only basic CL.TE/TE.CL smuggling or fingerprint known CVEs; Burp Suite DAST probes desync primitives directly to deliver comprehensive request smuggling detection.
blog · portswigger.net
HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle
NahamSec and James Kettle break down request smuggling basics in a video: parser disagreements between front-end and back-end servers, HTTP/2 downgrades and real-world cases like Netflix.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
Back