# Red Team Tools and Methodology

> This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

- Skill: `dokhacgiakhoa/red-team-tools-and-methodology` (Agent Skill, multi-file: 17 files)
- Install (CLI): `npx skillmds@latest add dokhacgiakhoa/red-team-tools-and-methodology`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dokhacgiakhoa/red-team-tools-and-methodology/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Dokhacgiakhoa (https://skillmd.com/u/dokhacgiakhoa)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/dokhacgiakhoa/red-team-tools-and-methodology

---


# Red Team Tools and Methodology

## Purpose

Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.

## Inputs/Prerequisites

- Target scope definition (domains, IP ranges, applications)
- Linux-based attack machine (Kali, Ubuntu)
- Bug bounty program rules and scope
- Tool dependencies installed (Go, Python, Ruby)
- API keys for various services (Shodan, Censys, etc.)

## Outputs/Deliverables

- Comprehensive subdomain enumeration
- Live host discovery and technology fingerprinting
- Identified vulnerabilities and attack vectors
- Automated recon pipeline outputs
- Documented findings for reporting

## Core Workflow

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [1. Project Tracking and Acquisitions](./sub-skills/1-project-tracking-and-acquisitions.md)
### 2. [2. Subdomain Enumeration](./sub-skills/2-subdomain-enumeration.md)
### 3. [3. Live Host Discovery](./sub-skills/3-live-host-discovery.md)
### 4. [4. Technology Fingerprinting](./sub-skills/4-technology-fingerprinting.md)
### 5. [5. Content Discovery](./sub-skills/5-content-discovery.md)
### 6. [6. Application Analysis (Jason Haddix Method)](./sub-skills/6-application-analysis-jason-haddix-method.md)
### 7. [7. Automated XSS Hunting](./sub-skills/7-automated-xss-hunting.md)
### 8. [8. Vulnerability Scanning](./sub-skills/8-vulnerability-scanning.md)
### 9. [9. API Enumeration](./sub-skills/9-api-enumeration.md)
### 10. [10. Automated Recon Script](./sub-skills/10-automated-recon-script.md)
### 11. [Essential Tools](./sub-skills/essential-tools.md)
### 12. [Key API Endpoints to Check](./sub-skills/key-api-endpoints-to-check.md)
### 13. [XSS Filter Testing](./sub-skills/xss-filter-testing.md)
### 14. [Example 1: Quick Subdomain Recon](./sub-skills/example-1-quick-subdomain-recon.md)
### 15. [Example 2: XSS Hunting Pipeline](./sub-skills/example-2-xss-hunting-pipeline.md)
### 16. [Example 3: Comprehensive Scan](./sub-skills/example-3-comprehensive-scan.md)