Agentic-Bug-Hunter - AI-powered bug bounty hunting toolkit that works w

项目说明

<p align="center">
<img src=" alt="Agentic Bug Hunter - by AwareXone - AI-powered bug bounty reconnaissance and discovery" width="100%"/>
</p>

<p align="center">
<b>AI-powered bug bounty hunting — recon to report, in your terminal.

</b>
<br/>
<a href="#what-is-this">What Is This</a>
·
<a href="#trusted-by-engineers-at">Trusted By</a>
·
<a href="#standalone-mode-no-subscription-required">Free Setup</a>
·
<a href="#quick-start">Quick Start</a>
·
<a href="#commands">Commands</a>
·
<a href="#what-it-finds">What It Finds</a>
·
<a href="#more-from-awarexone">AXguard</a>
·
<a href="#support-this-project">Support</a>
·
<a href="FAQ.md">FAQ</a>
</p>

<p align="center">
<a href=" src=" alt="MIT License"></a>
<img src=" alt="Python 3.10+">
<a href=" src=" alt="PyPI "></a>
<a href=" src=" alt="PyPI Downloads"></a>
<a href=" src=" alt="Claude Code Plugin"></a>
<a href=" src=" alt="Tests"></a>
<a href=" src=" alt="GitHub Stars"></a>
</p>

<p align="center">
<a href=" target="_blank" rel="noopener noreferrer"><img src=" alt="Awarexone%2FAgentic-Bug-Hunter | Trendshift" width="250" height="55"/></a>
</p>

<p align="center">
Built and maintained by <b>AwareXone</b> · <a href=" · <a href=" · <a href="
</p>

<p align="center">
<img src=" alt="SocialSafe by AwareXone provides case review and assistance for hacked, disabled, locked, restricted, and inaccessible social media accounts in Malaysia and worldwide by remote review. Assistance is best-effort, and final decisions remain with the platform." width="720"/>
</p>

<p align="center">
<a href="
<img src=" alt="Apply for Case Review" height="48"/>
</a>
</p>

<p align="center">
<a href="
<img src=" alt="Fluxion AI — One gateway to the world's leading AI models" width="720"/>
</a>
</p>

<p align="center">
<b>One gateway to the world's leading AI models</b><br/>
_{AI model access &amp; operations · partner for BugHunter standalone mode}
</p>

<p align="center">
<a href=" with partner link →</b></a>
· promo <code>AWAREXONE</code>
· <a href="
· <a href=" Plaza</a>
</p>

---

Get started (30 seconds)

Then hunt — straight from your terminal:

…or drive it from inside Claude Code:

_{The CLI and AI hunting work on their own. Full recon also uses external tools
(subfinder · httpx · nuclei · katana · ffuf · nmap) — install them with
<code>install_tools.sh</code> from the repo. Output lands in <code>~/.bughunter/</code>.}

---

Trusted By Engineers At

<p align="center"><i>Where this project's stargazers say they work.</i></p>

<p align="center">
<img src=" alt="HackerOne"/>
<img src=" alt="Bugcrowd"/>
<img src=" alt="IBM"/>
<img src=" alt="Huawei"/>
<img src=" alt="Microsoft"/>
<img src=" alt="OffSec"/>
<img src=" alt="TCS"/>
<img src=" alt="Tencent"/>
<img src=" alt="Apple"/>
<img src=" alt="Canonical"/>
<img src=" alt="Cognizant"/>
<img src=" alt="Ericsson"/>
<img src=" alt="Goldman Sachs"/>
<img src=" alt="Google"/>
<img src=" alt="HashiCorp"/>
<img src=" alt="Intel"/>
<img src=" alt="KPMG"/>
<img src=" alt="Meta"/>
<img src=" alt="Mozilla"/>
<img src=" alt="Nvidia"/>
<img src=" alt="PwC"/>
<img src=" alt="Qualcomm"/>
<img src=" alt="Siemens"/>
<img src=" alt="Snap"/>
<img src=" alt="SpaceX"/>
<img src=" alt="Synack"/>
<img src=" alt="Tsinghua"/>
<img src=" alt="Wipro"/>
<img src=" alt="YesWeHack"/>
<img src=" alt="Zscaler"/>
</p>

<p align="center">
_{Compiled from public GitHub profiles of this repository's stargazers -
43 people across 30 organizations, counted from the employer
each person lists on their own profile or from their public organization
memberships. No indi accounts are named. These companies have not
endorsed or sponsored this project; their logos are shown as trademarks of
their respecti.}
</p>

---

What Is This?

Agentic Bug Hunter finds real, reportable bugs, not theoretical ones. Point it at a target and it runs recon, tests for , findings against a strict gate, and writes a submission-ready report for HackerOne, Bugcrowd, Intigriti, or Immunefi.

It remembers e: patterns found on one target inform the next, and sessions pick up where they left off.

Works as a Claude Code plugin, or as a fully standalone CLI (bughunter) with no subscription required.

---

Standalone Mode: No Subscription Required

You no longer need Claude Code, Claude Pro, or any paid AI subscription.

Install once, use the bughunter command from any terminal on your machine:

Rerun the same command after pulling updates. The installer detects and
refreshes the acti bughunter command, including older installations
under /usr/local/bin or ~/.local/bin, while preserving your sa
configuration in ~/.bughunter/config.json.

To uninstall the standalone command while keeping its configuration:

Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller
also supports claude, opencode, pi, codex, agents, and all targets.

Free AI Pro (auto-detected, free-first priority)

| Provider | Cost | Privacy | Speed | Get Started |
|:---|:---|:---|:---|:---|
| Ollama | 100% free · runs locally | Full - stays on your machine | Fast | ollama pull qwen2.5:14b |
| Groq | Free tier a | Cloud | Very fast | console.groq.com → get API key |
| DeepSeek | Very cheap ( / ) | Cloud | Fast | platform.deepseek.com |
| Claude API | Paid | Cloud | Fast | console.anthropic.com |
| OpenAI | Paid | Cloud | Fast | platform.openai.com |
| Grok (xAI) | Paid | Cloud | Fast | console.x.ai → grok-4.5 |
| OpenRouter | Subscription / pay-as-you-go | Cloud | Fast | openrouter.ai/keys → get API key |
| OrcaRouter | Subscription / pay-as-you-go | Cloud | Fast | orcarouter.ai → get API key |
| Fluxion | Subscription / pay-as-you-go | Cloud | Fast | fluxionai.world → get API key · docs · Model Plaza |
| LiteLLM | Uses your existing provider keys | Cloud / self-hosted proxy | Fast | docs.litellm.ai → one gateway for 100+ models |
| Requesty | Pay-as-you-go | Cloud | Fast | app.requesty.ai/api-keys → get API key · docs |

BugHunter auto-detects pro in this order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Fluxion → Claude → OpenAI. LiteLLM is opt-in (selected explicitly or when LITELLM_API_KEY is set) so it ne a provider you already configured. Requesty is opt-in the same way (selected explicitly or when REQUESTY_API_KEY is set); set REQUESTY_BASE_URL= to route through the EU region.

Switch pro or choose an installed Ollama model anytime: bughunter setup.
The setup can also be fully non-interactive:

For a one-off o, put the option before the command:

Zero-cost fully offline setup

Groq setup (free cloud, fastest option)

Fluxion setup (multi-model gateway)

Fluxion is an optional OpenAI-compatible gateway (). It is not the default provider — pick it in bughunter setup, or set BRAIN_PROVIDER=fluxion when you want it.

---

Quick Start

Fastest - install from PyPI

> Installs the bughunter and bughunter-agent commands. The AI hunting works out
> of the box; full recon also uses external CLIs (subfinder, httpx, nuclei, katana,
> ffuf, nmap). Get them with install_tools.sh from the repo, or your package
> manager. Output is written to ~/.bughunter/ (o with BUGHUNTER_HOME).

Option A - standalone (no subscription, works for e)

Option B - Claude Code plugin *(requires Claude Code)*

Option C - let Claude install it *(Claude Code only)*

Open your terminal, run claude, then paste:

---

MCP

Use Agentic-Bug-Hunter from AI agents (Cursor, Claude Code, Codex, OpenCode).

MCP is an adapter over the existing research engine — not a second scanner. Acti require scope and explicit approval. See docs/mcp.md.

---

Commands

Core Workflow

| Command | What It Does |
|:---|:---|
| /recon target.com | Subdomain enum · live host probing · URL crawl · nuclei sweep |
| /hunt target.com | Tests IDOR · auth bypass · SSRF · XSS · SQLi · logic flaws and more |
| / | 7-Question Gate - kills weak findings before you waste time reporting |
| /report | Generates an H1 · Bugcrowd · Intigriti · Immunefi submission in 60s |
| /autopilot target.com | Full loop, autonomous - scope → recon → hunt → → report |

Recon & Enumeration

| Command | What It Does |
|:---|:---|
| /surface target.com | Ranked attack surface from recon data + memory |
| /scope-aggregate <program> | All in-scope assets across H1 · Bugcrowd · Intigriti · YWH · Immunefi |
| /cloud-recon --keyword <name> | Public S3 · Azure · GCP buckets + CloudFlare-bypass origin IPs |
| /param-discover <url> | Hidden HTTP parameters · x8 |
| /secrets-hunt --js-bundle <dir> | Leaked credentials in source, JS bundles, or a GitHub org |
| /takeo <dir> | Subdomain takeo · subjack |
| /scan-cves <host> | Focused nuclei high/critical sweep + optional log4j-scan |
| /bypass-403 <url> | Header · method · encoding tricks against 403/401 |
| /portscan <host> | Open ports + non-web services (Redis · Docker API · DBs · RDP) /smap |
| /screenshot -l urls.txt | Screenshot li into an HTML gallery - triage + PoC e |

Scanners (Web + LLM)

| Command | What It Does |
|:---|:---|
| /cors <url> | CORS misconfig - origin reflection · null · credentialed |
| /crlf <url> | CRLF / response-splitting + host-header injection |
| /nosqli <url> | NoSQL injection (operator bypass · $where timing) |
| /jwt-scan <token> | Offline JWT toolkit - alg:none · RS256→HS256 · secret crack |
| /oob <target> | Out-of-band listener (interactsh) for blind SSRF/XXE/SQLi |
| /sast <path> | Semgrep security packs o JS/source → ranked sinks |
| /domxss <url> | Confirms DOM XSS in headless Chromium - reports only when the payload executes |
| /llm-redteam <endpoint> | LLM red-team corpus - prompt injection · jailbreak · exfil |

Smart Contract (Web3)

| Command | What It Does |
|:---|:---|
| /web3-audit <contract.sol> | 10-class smart contract audit with Foundry PoC template |
| /token-scan <contract> | Rug pull scanner - mint authority · LP lock · honeypot · bonding curve |

Session & Utility

| Command | What It Does |
|:---|:---|
| /pickup target.com | Resume from last session - untested endpoints first |
| /intel target.com | CVEs + disclosed reports relevant to this target |
| /chain | Bug A found → finds bugs B and C that chain with it |
| /scope <asset> | Checks if a domain or URL is in scope before you test it |
| /triage | Quick 2-minute go/no-go check |
| /remember | Logs the current finding or technique to hunt memory |
| /memory-gc | Inspect or rotate hunt-memory JSONL files (10 MB cap, 3 backups) |
| /arsenal [tool] | Lists installed external tools or prints an install hint |

---

What It Finds

<details>
<summary><b>26 Web2 Classes</b></summary>
<br>

| | Typical Payout |
|:---|:---|
| IDOR / BOLA | $500 – $5K |
| Auth Bypass | $1K – $10K |
| XSS (Stored / Reflected / DOM) | $500 – $5K |
| SSRF | $1K – $15K |
| Business Logic | $500 – $10K |
| Race Conditions | $500 – $5K |
| SQL Injection | $1K – $15K |
| OAuth / OIDC | $500 – $5K |
| File Upload → RCE | $500 – $10K |
| GraphQL Auth Bypass | $1K – $10K |
| LLM / Prompt Injection | $500 – $10K |
| API Misconfiguration (mass assignment · JWT · CORS) | $500 – $5K |
| Account Takeover | $1K – $20K |
| SSTI | $2K – $10K |
| Subdomain Takeover | $200 – $5K |
| Cloud / Infra Exposure | $500 – $20K |
| HTTP Request Smuggling | $5K – $30K |
| Cache Poisoning | $1K – $10K |
| MFA / 2FA Bypass | $1K – $10K |
| SAML / SSO Attack | $2K – $20K |
| Error Disclosure / Debug Endpoints | $200 – $5K |
| CSS Injection | $500 – $5K |
| LFI → RCE | $1K – $15K |
| Insecure Deserialization | $5K – $30K |
| Dependency Confusion / Supply Chain | $1K – $20K |
| Padding Oracle / Crypto Misuse | $2K – $20K |

</details>

<details>
<summary><b>10 Web3 / Smart Contract Bug Classes</b></summary>
<br>

| | Typical Payout |
|:---|:---|
| Accounting Desync | $50K – $2M |
| Access Control | $50K – $2M |
| Incomplete Code Path | $50K – $2M |
| Off-By-One | $10K – $100K |
| Oracle Manipulation | $100K – $2M |
| ERC4626 Share Inflation | $50K – $500K |
| Reentrancy | $10K – $500K |
| Flash Loan Attack | $100K – $2M |
| Signature Replay | $10K – $200K |
| Proxy / Upgrade | $50K – $2M |

</details>

---

AI Agents

Nine specialists, each built for one job:

| Agent | Role |
|:---|:---|
| recon-agent | Subdomain enum · live host discovery · URL crawl |
| report-writer | Impact-first reports that get paid, not N/A'd |
| | Runs the 7-Question Gate - kills weak findings |
| web3-auditor | Smart contract audit across 10 bug classes |
| chain-builder | Bug A → finds bugs B and C that chain with it |
| autopilot | Full hunt loop with safety checkpoints |
| recon-ranker | Ranks attack surface by highest-value targets first |
| token-auditor | Meme coin / token rug pull and security scan |
| credential-hunter | Wordlist gen → OSINT → breach-check → spray (hard-stop before spray) |

---

How It Works

<di="center">

</div>

Every tool in the pipeline is gated on whether it's installed - missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.

---

Project Structure

<details>
<summary><b>Click to expand the full tree</b></summary>
<br>

</details>

---

Installation

Prerequisites:

Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):

Standalone bughunter command (no subscription, works without Claude Code):

AI skills + commands into Claude Code:

Other agent harnesses:

Optional: Chaos API key (better subdomain co)

---

Rules

Se run every session, no exceptions:

| # | Rule | Why |
|:-:|:---|:---|
| 1 | Read full scope first | Only test what the program authorizes |
| 2 | Real bugs only | "Can an attacker do this RIGHT NOW?" - if no, stop |
| 3 | Kill weak findings | A 30-second check sa of wasted reporting |
| 4 | Never go out of scope | One wrong request can get you banned |
| 5 | 5-minute rule | No progress after 5 minutes? Move on |
| 6 | before report | / before spending 30 minutes writing |
| 7 | Impact first | Test the bugs with the worst consequences first |

---

Contributing

PRs welcome. Most :

---

Used By

<p align="center"><i>Teams and researchers running BugHunter in their workflow.</i></p>

<table align="center">
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="shu"/>
<br/>_<b>shu</b>
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="awarexonedev"/>
<br/>_{<b>awarexonedev</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="letztek"/>
<br/>_{<b>letztek</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="bertolikimberly"/>
<br/>_{<b>bertolikimberly</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt=""/>
<br/>_<b></b>
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="indrao"/>
<br/>_{<b>indrao</b>}
</a>
</td>
</tr>
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="DebasishTripathy13"/>
<br/>_{<b>DebasishTripathy13</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="shi"/>
<br/>_<b>shi</b>
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="adityaax"/>
<br/>_{<b>adityaax</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="BeargleIndustries"/>
<br/>_{<b>BeargleIndustries</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="ftacorn"/>
<br/>_{<b>ftacorn</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="ultra-supara"/>
<br/>_{<b>ultra-supara</b>}
</a>
</td>
</tr>
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Amine-Genin"/>
<br/>_{<b>Amine-Genin</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="AurisDSP"/>
<br/>_{<b>AurisDSP</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Biruk121"/>
<br/>_{<b>Biruk121</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Edneam"/>
<br/>_{<b>Edneam</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="depapp"/>
<br/>_{<b>depapp</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Realgagenichols"/>
<br/>_{<b>Realgagenichols</b>}
</a>
</td>
</tr>
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="H4d3es"/>
<br/>_{<b>H4d3es</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="thuvh"/>
<br/>_<b>thuvh</b>
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="onlybugs05"/>
<br/>_{<b>onlybugs05</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="sa"/>
<br/>_<b>sa</b>
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Marc-oss-hub"/>
<br/>_{<b>Marc-oss-hub</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Paebak"/>
<br/>_{<b>Paebak</b>}
</a>
</td>
</tr>
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="NaorYaacov"/>
<br/>_{<b>NaorYaacov</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="nurazhardotcom"/>
<br/>_{<b>nurazhardotcom</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="OctoBored"/>
<br/>_{<b>OctoBored</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="prodmanpd"/>
<br/>_{<b>prodmanpd</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="SeekAndExploit"/>
<br/>_{<b>SeekAndExploit</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Thibaultjaigu"/>
<br/>_{<b>Thibaultjaigu</b>}
</a>
</td>
</tr>
<tr>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="Shawanga"/>
<br/>_{<b>Shawanga</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="zeze-zeze"/>
<br/>_{<b>zeze-zeze</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="amanssj3"/>
<br/>_{<b>amanssj3</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="grave0x"/>
<br/>_{<b>grave0x</b>}
</a>
</td>
<td align="center" width="110">
<a href="
<img src=" width="64" height="64" alt="ke"/>
<br/>_<b>ke</b>
</a>
</td>
</tr>
</table>

<p align="center">
<a href=" src=" alt="Contributors"/></a>
<a href="#contributing"><img src=" alt="Contribute"/></a>
</p>
---

<p align="center">
<a href="
·
<a href="
·
<a href="mailto:"></a> · <a href="mailto:shu.com">shu.com</a><br>
<b>Built by bug hunters, for bug hunters.</b><br>
_{MIT License · For authorized security testing only. Always test within an approved bug bounty program scope.}
</p>

<p align="center">
<a href="
<img src=" alt="AwareXone" width="56"/>
</a>
<br/>
<sub>Powered by <a href="
<br/>
_{<a href=" ·
<a href=" / Twitter</a> ·
<a href="}
</p>

项目信息

开发语言：Python

Star 数：5271

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-powered bug bounty hunting toolkit that works with or without subscription.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。