Agent skill · security · davila7
Red Team Tools and Methodology
This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.
Why this skill is useful
Adds multiple executable scripts for reconnaissance and vulnerability discovery that are not commonly found in public documentation.
What it needs
Requires go, python, ruby installed locally. Requires censys, shodan account access. About 4k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Red Team Tools and Methodology Purpose Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces. Inputs/Prerequisites Target scope definition (domains, IP ranges, applications) Linux-based attack machine (Kali, Ubuntu) Bug bounty program rules and scope Tool dependencies installed (Go, Python, Ruby) API keys for various services (Shodan, Censys, etc.) Outputs/Deliverables Comprehensive subdomain enumeration Live host discovery and technology fingerprinting Identified vulnerabilities and attack vectors Automated recon pipeline outputs Documented findings for reporting Core Workflow 1. Project Tracking and Acquisitions Set up reconnaissance tracking: 2. Subdomain Enumeration Comprehensive subdomain discovery: 3. Live Host Discovery Identify responding hosts: 4. Technology Fingerprinting Identify technologies for targeted attacks: 5. Content Discovery Find hidden endpoints and files: 6. Application Analysis (Jason Haddix Method) Heat Map Priority Areas: 1. File Uploads - Test for injection, XXE, SSRF, shell upload 2. Content Types - Filter Burp for multipart forms 3. APIs - Look for hidden methods, lack of auth 4. Profile Sections - Stored XSS, custom fields 5. Integrations - SSRF through third parties 6. Error Pages - Exotic injection points Analysis Questions: How does the app pass data? (Params, API, Hybrid) Where does the app talk about users? (UID, UUID endpoints) Does the site have multi-tenancy or user levels? Does it have a unique threat model? How does the site handle XSS/CSRF? Has the site had past writeups/exploits? 7. Automated XSS Hunting 8. Vulnerability Scanning 9. API Enumeration Wordlists for API fuzzing: 10. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/red-team-tools