## https://sploitus.com/exploit?id=3B94F400-1648-5E72-85AC-142B59108070
# Eopi-Hunt-Skill
**Authorized security research toolkit** combining AutoPentest (OWASP WSTG MCP), SAST skills, bug-hunting skill packs, and a repeatable **SAST → runtime PoC → VulnCheck CVD → GitHub advisory** workflow.
| | |
|--|--|
| **Repo** | `Eopi-Hunt-Skill` |
| **Purpose** | Source review + dynamic verification of open-source apps (CVE-ready, VulnCheck-friendly) |
| **Audience** | Human operators and AI coding agents (Claude, Grok, Cursor, Codex, …) |
> **Legal:** Only test systems you own or have explicit written authorization to assess. This repo is not a license to attack third parties.
---
## English
### What is this?
A monorepo that packs:
1. **AutoPentest / wstg-pentest** — MCP server + Docker security tools + WSTG methodology (`CLAUDE.md`, `AGENTS.md`, `knowledge-base/`, `templates/`, `server/`)
2. **Claude-BugHunter** — large skill set for bug hunting (hunt-*, recon, reporting)
3. **sast-skills** — static analysis orchestration (architecture, SQLi, XSS, SSRF, IDOR, …)
4. **super-rouge-hunter-skills** — recon / analysis / exploitation methodologies
5. **template-report/** — sample VulnCheck-style report layouts
6. **Empty workspaces** — `MucTieu-Hunt/`, `File-Report/`, `Git-Pub/` for *your* targets and deliverables (not committed with data)
### Quick start
```bash
git clone https://github.com/tinykidpro/Eopi-Hunt-Skill.git
cd Eopi-Hunt-Skill
# Full install & workflow → docs/GUIDE.en.md | Tiếng Việt → docs/GUIDE.vi.md
```
### Layout
```text
Eopi-Hunt-Skill/
├── README.md # This file (EN + VI)
├── docs/
│ ├── GUIDE.en.md # Full operator / AI agent guide (English)
│ └── GUIDE.vi.md # Hướng dẫn đầy đủ (Tiếng Việt)
├── AGENTS.md / CLAUDE.md # AutoPentest charter + phase workflow
├── knowledge-base/ # WSTG + PortSwigger + elite payloads
├── templates/ # Agent roles, honesty, PoC standards
├── server/ # wstg-pentest MCP server
├── Claude-BugHunter/ # Bug-hunt skills
├── sast-skills/ # SAST skill pack
├── super-rouge-hunter-skills/
├── template-report/ # Report format samples
├── MucTieu-Hunt/ # LOCAL ONLY: targets (empty upstream)
├── File-Report/ # LOCAL ONLY: VulnCheck forms (empty upstream)
└── Git-Pub/ # LOCAL ONLY: public CVE write-ups (empty upstream)
```
### Pipeline (high level)
1. **Prepare** tools + skills (Docker tools, MCP, skill folders)
2. **SAST** — architecture, sources/sinks, taint, hypotheses with file:line evidence
3. **Plan** PoC — inputs, expected vs observed, conditions
4. **Runtime** — Docker target + HTTP PoCs (curl / tools)
5. **Classify** — Confirmed / Potential / Not verifiable / Not a vuln
6. **Disclose** — VulnCheck form (`File-Report/`) → optional `Git-Pub/cve-advisories/YYYY/Product/`
### Docs
| Doc | Language |
|-----|----------|
| [docs/GUIDE.en.md](docs/GUIDE.en.md) | English — install, config, hunt, report, AI instructions |
| [docs/GUIDE.vi.md](docs/GUIDE.vi.md) | Tiếng Việt — cài đặt, cấu hình, săn lỗi, báo cáo, hướng dẫn AI |
### License
See `LICENSE` (Apache-2.0 for the AutoPentest core; individual skill packs may carry their own licenses—respect each package’s LICENSE file).
---
## Tiếng Việt
### Đây là gì?
Bộ công cụ **nghiên cứu bảo mật có ủy quyền**, gộp:
1. **AutoPentest / wstg-pentest** — MCP + Docker tools + quy trình OWASP WSTG
2. **Claude-BugHunter** — skill săn lỗi
3. **sast-skills** — phân tích tĩnh mã nguồn
4. **super-rouge-hunter-skills** — recon / analysis / exploitation
5. **template-report/** — mẫu report kiểu VulnCheck
6. **Thư mục làm việc rỗng** — `MucTieu-Hunt/`, `File-Report/`, `Git-Pub/` (dữ liệu mục tiêu **không** đưa lên GitHub)
### Bắt đầu nhanh
```bash
git clone https://github.com/tinykidpro/Eopi-Hunt-Skill.git
cd Eopi-Hunt-Skill
# Đọc docs/GUIDE.vi.md để cài và chạy đầy đủ
```
### Quy trình tóm tắt
1. Chuẩn bị tool & skill
2. SAST (nguồn → sink, giả thuyết có bằng chứng)
3. Lập kế hoạch PoC
4. Runtime (Docker + request thật)
5. Phân loại: Đã xác nhận / Có khả năng / Không kiểm chứng / Không phải lỗ hổng
6. Disclose: form VulnCheck → (khi có CVE) publish `Git-Pub/`
### Tài liệu
- **Hướng dẫn đầy đủ (VI):** [docs/GUIDE.vi.md](docs/GUIDE.vi.md)
- **Full guide (EN):** [docs/GUIDE.en.md](docs/GUIDE.en.md)
---
**Maintainer note:** Keep `MucTieu-Hunt`, `File-Report`, and `Git-Pub` free of secrets, target source dumps, and unreleased CVE drafts on the public remote. Use `.gitignore` rules already included.