Today we're talking about Claude again, but probably differently than usual. From using it every day and watching how other hunters use it, I figured out how to get the best out of it, and it was pretty far from how I use it myself.
I also realized how important it is to talk to people and build connections, in every field. It might be the single most important thing.
Why you're using Claude wrong (and so am I)
There are as many ways to use Claude as there are users. Some people spend their time hunting for the perfect prompt, others fire off 10,000 subagents, and some have an ultra-optimized hackbot running in 18 steps.
And it's wild to see how everyone uses it these days. One of the first questions you ask when you see a friend using it is: how do you do it? Do you have custom skills? How do you manage the usage?
Here's roughly how I've been using it these past few months:
- Some skills based on old reports and CTF writeups
- A skill to drive Caido
- I ask it to connect to Caido, set up a clean folder structure, and launch Playwright to start testing
- I set it loose on a full recon of the scope, to find me interesting leads and bugs
- I tell it to keep going and push further (roughly 10,000 times)
- I triage the 50 bugs it hands me to end up with 1 or 2
- Profit
All of this is very optimizable. From the results I got, it's pretty tedious, it goes in circles a lot, and it burns a lot of tokens for not much in the end.
Then I thought back to the analogy we used at the start of the AI wave, the one where it's like an intern. If you think about it, you'd never use an intern this way. Here you've got an intern who has all the knowledge in the world and can recall it easily, a huge brain but two tiny arms to actually use it.
If I had a bug bounty intern, would I just tell them "keep going" on a loop until they found bugs for me? No, and it would be completely counterproductive. I think you have to use Claude much more precisely than the way I've been using it.
So a much more detailed prompt, and guiding it a lot more. Spending time taking it to the right place, giving it leads and the parts of the app that smell bad. Guiding it through the whole process while still letting it do the work for you.
That's how my friends Icare and Truff work, and it's pretty effective. Here is an overview of the tooling of Icare : https://www.yeswehack.com/community/llms-bug-bounty-interview-icare
My problem is I'm a lazy bastard, and asking it to keep going is way easier than doing anything else. That's also the difference between a good and a bad manager.
And I feel like we're getting dumber the more we use agents, and it drives me crazy. Using your brain less and less at its full potential. We went from a job where the best were the ones with the most knowledge and knew how to use it, to a job where it's whoever has the most tokens.
Networking
I realize it every time I meet new people, but it's the most important part, and in every field. I'm not talking about LinkedIn networking, welcome-to-my-network and all the associated bullshit.
I'm just talking about taking a genuine interest in people, building real relationships with the ones who gravitate around you. That's what can bring the most opportunities.
That's how I get invited to events, how I get special access to some things. Where big companies can be completely opaque, having a human contact changes everything, especially in bug bounty.
Knowing the triagers helps you understand what they want and negotiate your bugs better. Knowing other hunters lets you talk through bugs, learn techniques, collaborate.
And sharing too, through a blog, X, or whatever, gets your name out there and brings other opportunities.
So if I had one piece of advice to give, in bug bounty or any other field, it's this: make friends, share your experience, and stay open to everything.
Vacation
I also took 4 or 5 days off in the Vosges, in France, and it was really nice. It's a place I didn't know at all, very green and restful.
The quiet, the mountains, it's genuinely pleasant. It lets you slow down compared to Parisian life. Less of the constant speed, more taking the time to do things.
I also went paddleboarding for the first time, that was fun. And tree-top climbing too.
Funny enough, the three things come back to the same idea. Don't hand your brain, your relationships, or your time over to the machine. Guide the tool instead of looping it, talk to actual people instead of collecting a network, take the time to slow down instead of running on autopilot. The human part is still the part that matters.
So I'm going to enjoy my last moments here before heading back into the Parisian heat.
Comments