Bug-Bounty-Agents - AI-Powered Agents for Bub-Bounty Pentesting and Re

项目说明

<di="center">

Bug-Bounty-Agents

**A curated arsenal of specialized AI agent prompts for bug bounty hunting,
penetration testing, and offensi workflows.**

*Drop-in personas for Claude Code, Copilot Chat, Cursor, and any agent-capable LLM -
no frameworks, no dependencies, just disciplined prompts.*

<br />


_{43 agents&nbsp;&nbsp;·&nbsp;&nbsp;6 engagement phases&nbsp;&nbsp;·&nbsp;&nbsp;4 supported clients&nbsp;&nbsp;·&nbsp;&nbsp;0 dependencies}

<br />

Quick Start&nbsp;&nbsp;·&nbsp;&nbsp;Catalog&nbsp;&nbsp;·&nbsp;&nbsp;Setup&nbsp;&nbsp;·&nbsp;&nbsp;Workflows&nbsp;&nbsp;·&nbsp;&nbsp;Examples&nbsp;&nbsp;·&nbsp;&nbsp;Contributing&nbsp;&nbsp;·&nbsp;&nbsp;Disclaimer

</div>

---

O

Each .md file in this repository defines a focused, production-ready agent
persona - recon, web hunting, exploit chaining, reporting, and more - that
you can drop into Claude Code, GitHub Copilot Chat, Cursor, or
any agent-capable LLM client.

No frameworks. No dependencies. Just disciplined prompts that turn a generic
LLM into a specialist, with strict scope enforcement built in.

> These are prompts, not scanners. They make an LLM act like a
> specialist; they do not bring their own tooling. You still drive the
> engagement.

---

Table of Contents

1. Quick Start
2. Agent Catalog
3. Prerequisites
4. Per-Tool Setup
- One-line installer
- Claude Code
- GitHub Copilot Chat
- Cursor
- ChatGPT / Gemini / Generic
5. Using an Agent
6. Workflows
7. Examples
8. Burp Suite MCP Integration
9. Updating
10. Project Files
11. Contributing
12. Security
13. Disclaimer

---

Quick Start

Or pick a specific target:

---

Agent Catalog

Agents are grouped by phase of an offensi. The full
machine-readable index lives in AGENTS.md.

Reconnaissance & Intelligence

| Agent | Purpose |
|---|---|
| recon-advisor | Surface enumeration and asset discovery |
| osint-collector | Open-source intelligence gathering |
| subdomain-takeover | Dangling DNS and subdomain takeo |
| threat-modeler | STRIDE / attack-surface modeling |
| engagement-planner | Scope, rules of engagement, test plans |
| attack-planner | Multi-stage attack path planning |

Web, API & Application

| Agent | Purpose |
|---|---|
| web-hunter | Web application hunting |
| api-security | REST and GraphQL API testing |
| graphql-hunter | Schema introspection, authz, complexity attacks |
| bizlogic-hunter | Business logic flaws and abuse cases |
| ssrf-hunter | SSRF discovery, filter bypass, cloud-metadata abuse |
| jwt-cracker | JWT / OIDC token attacks (alg confusion, kid/jku, weak HMAC) |
| | Automated scanning orchestration and triage |

Infrastructure, Cloud & Network

| Agent | Purpose |
|---|---|
| cloud-security | AWS / GCP / Azure misconfiguration hunting |
| container-escape | Docker / Kubernetes pod-to-node-to-cluster breakout |
| cicd-redteam | CI/CD pipeline and supply-chain attacks |
| ad-attacker | Acti enumeration and abuse |
| wireless-pentester | Wi-Fi, Bluetooth, and RF assessments |
| mobile-pentester | iOS / Android application testing |
| hardware-hacker | Embedded, JTAG, firmware extraction |

Exploitation & Post-Ex

| Agent | Purpose |
|---|---|
| exploit-chainer | Combine findings into impactful chains |
| exploit-guide | Step-by-step exploitation reference |
| payload-crafter | Custom payload generation and tuning |
| binary-exploit | Memory corruption, ROP, pwn |
| crypto-analyst | Crypto primitive and protocol analysis |
| credential-tester | Password spraying, stuffing, brute force |
| pri | Linux / Windows pri escalation paths |
| poc- | , stabilize, and minimize PoCs |
| red-team-operator | C2, OPSEC, long-haul operations |

Specialized & Ad

| Agent | Purpose |
|---|---|
| llm-redteam | Prompt injection, tool abuse, RAG poisoning, agent loops |
| phishing-operator | Phishing infrastructure and campaign design |
| social-engineer | Pretexting, , human-layer attacks |
| malware-analyst | Static and dynamic malware analysis |
| re | Binary RE, decompilation, patching |
| forensics-analyst | DFIR, artifact analysis, timeline building |
| ctf-solver | CTF challenge sol categories |

Defense, Reporting & Orchestration

| Agent | Purpose |
|---|---|
| detection-engineer | Detection and response engineering |
| purple-team | Detection-as-you-attack collaboration |
| stig-analyst | STIG / CIS / compliance hardening review |
| report-generator | Triage-ready bug bounty reports |
| bug-bounty | General-purpose bounty assistant |
| swarm-orchestrator | Coordinate multiple agents in parallel |
| _scope-guard | Hard scope enforcement layered on any agent |

---

Prerequisites

git and bash installed on your machine

An LLM client that supports custom system prompts or instruction files:

- Claude Code
- GitHub Copilot Chat (VS Code)
- Cursor
- ChatGPT (Custom GPTs / Projects), Gemini, or any chat UI accepting a system prompt

---

Per-Tool Setup

One-line installer

The installer auto-detects claude, code, and cursor on your PATH,
copies agents to the correct directory for each, and renames files
appropriately (e.g. .chatmode.md for Copilot). Use --dry-run to
preview, --uninstall to remove.

<details>
<summary><b>Claude Code</b> - manual install</summary>

<br />

Claude Code reads agent definitions from ~/.claude/agents/ (global) or
.claude/agents/ (per-project).

</details>

<details>
<summary><b>GitHub Copilot Chat</b> (VS Code) - manual install</summary>

<br />

Copilot Chat supports custom chat modes via .chatmode.md files.

Reload VS Code, then select the mode from the Copilot Chat dropdown.

</details>

<details>
<summary><b>Cursor</b> - manual install</summary>

<br />

Each file becomes a selectable rule in Cursor's chat panel.

</details>

<details>
<summary><b>ChatGPT / Gemini / Generic</b> - copy-paste</summary>

<br />

Open the agent file, copy its full contents, and paste into:

ChatGPT - Custom GPT → Instructions, or Project → Instructions

Gemini - Gem instructions

Open WebUI / LM Studio - System prompt field

API clients - system role message

</details>

---

Using an Agent

Once installed, give the agent a concrete target and scope:

Well-beha will:

Ask clarifying questions before acting

Stay strictly within scope

Produce reproducible PoCs

Output triage-ready findings with se and impact

---

Workflows

Use swarm-orchestrator or attack-planner to coordinate a full engagement:

Layer _scope-guard on top of any agent to enforce hard scope boundaries
during long-running sessions. For purple-team work, run red-team-operator
and purple-team side by side.

---

Examples

End-to-end engagement walkthroughs (sanitized) live in examples/:

web-bug-bounty.md - recon → web-hunter →

bizlogic → chain → → report, ending in a Critical-tier
HackerOne submission.

---

Burp Suite MCP Integration

PortSwigger's MCP Server lets
your LLM client drive Burp Suite directly - issue requests through the
proxy, query Repeater/Intruder, read site maps, and pivot off li
while an agent in this repo provides the methodology.

> Pairing tip: load web-hunter, api-security, ssrf-hunter, or
> bizlogic-hunter alongside the Burp MCP so the agent can both *think*
> like a specialist and *act* through Burp.

<details>
<summary><b>Setup walkthrough</b> - prerequisites, build, load, wire-up, smoke test</summary>

<br />

Prerequisites

Burp Suite (Community or Professional) installed and running

Ja on PATH (ja)

jar a on PATH (jar --) - required to build

An MCP-capable client (Claude Desktop, Claude Code, Cursor, etc.)

Build the extension

Load into Burp Suite

1. Launch Burp Suite.
2. Go to Extensions → Add.
3. Set Extension Type to Java.
4. Select build/libs/burp-mcp-all.jar and click Next.
5. Open the new MCP tab and tick Enabled.
- Optional: enable *tools that can edit your config* if you trust the client.
- Default listener: .

Wire up your MCP client

Claude Desktop (auto): in the Burp MCP tab, click the installer button -
it writes the config for you. Restart Claude Desktop.

Claude Desktop (manual): edit
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or
%APPDATA%\Claude\claude_desktop_config.json (Windows):

Use the Burp MCP tab's installer to extract mcp-proxy-all.jar if you
don't already have it.

SSE-capable clients (Cursor, Claude Code, custom): point them straight
at the SSE endpoint - no proxy needed:

Smoke test

With Burp running, the extension loaded, and your client restarted, ask:

If the client returns li from your Burp session, you're wired up.

</details>

---

Updating

---

Project Files

| File | Purpose |
|---|---|
| README.md | This file |
| AGENTS.md | Machine-readable index (phase, ATT&CK tactic, risk tier) |
| CHANGELOG.md | history |
| CONTRIBUTING.md | How to add or update agents |
| SECURITY.md | How to report prompt-safety issues |
| LICENSE | MIT |
| install.sh | Auto-detecting installer |
| templates/AGENT_TEMPLATE.md | Boilerplate for new agents |
| examples/ | Sanitized engagement walkthroughs |
| .github/ | Issue / PR templates and CI |

---

Contributing

PRs and issues are welcome. See CONTRIBUTING.md for the
contribution workflow, agent template, and style guide. Use the issue
templates for bug reports and new-agent proposals.

---

Security

Found a prompt-safety or supply-chain issue? See SECURITY.md
and report pri Security Ad.

---

Disclaimer

> These agents are intended for authorized security testing only -
> bug bounty programs you are enrolled in, systems you own, or en
> where you ha written permission to test.
>
> Unauthorized testing is illegal in most jurisdictions. You alone are
> responsible for how you use these prompts.

---

<di="center">

_{Built for hunters who prefer disciplined prompts o frameworks.}

<br />

Star on GitHub&nbsp;&nbsp;·&nbsp;&nbsp;Report an issue&nbsp;&nbsp;·&nbsp;&nbsp;Contribute

_{MIT licensed&nbsp;·&nbsp;Authorized testing only}

</div>

项目信息

开发语言：Shell

Star 数：440

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-Powered Agents for Bub-Bounty Pentesting and Red-Teaming purposes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。