Password spraying в bug bounty

★ 8.1 · general

credential-attack is a Claude Code skill that provides a password spraying methodology for bug bounty hunters — covering when credential attacks are worth running versus standard web-vuln hunting, and how to execute them without wasting lockout budget. The four-stage pipeline chains /wordlist-gen (cewler crawl + hashcat rules), /breach-check (HIBP k-anonymity enrichment), /osint-employees (theHarvester + username-anarchy), and /spray, which supports http-form, oauth, o365, and okta modes. Built-in guidance on rate-limit and lockout tactics, BBP legal guardrails, and success detection helps practitioners stay within scope. Use this skill when evaluating whether a credential attack is worth attempting on a target, selecting the right spray mode, or recovering from common pitfalls like over-broad wordlists or aggressive WAF blocking.