Awarexone/Agentic-Bug-Hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

Agentic Bug Hunter – AI‑powered bug‑bounty assistant

What it is – A command‑line toolkit that lets security researchers run a full bug‑bounty workflow (recon → vulnerability testing → validation → report generation) with the help of large language models. It can be used as a standalone CLI (bughunter) or as a plugin for Claude Code, and it works with a variety of free or paid LLM providers (Ollama, Groq, DeepSeek, Claude, OpenAI, etc.).

Key capabilities

  • Recon – sub‑domain enumeration, live‑host probing, URL crawling, nuclei scans, port scanning, cloud‑bucket discovery, etc.
  • Automated hunting – tests for 26 common Web2 bug classes (IDOR, XSS, SSRF, SQLi, auth bypass, etc.) and 10 Web3/smart‑contract bug classes.
  • 7‑question validation gate – a lightweight checklist that discards weak findings before you spend time reporting.
  • Report writer – produces ready‑to‑submit templates for HackerOne, Bugcrowd, Intigriti, Immunefi.
  • Memory across sessions – findings, patterns, and successful techniques are persisted in ~/.bughunter and reused for later targets.
  • Nine specialised AI agents – dedicated agents for recon, validation, report writing, web‑3 auditing, chaining bugs, autopilot, ranking, token audit, and credential hunting.
  • Pluggable LLM back‑ends – auto‑detects the best free provider first (Ollama locally, then Groq, DeepSeek, etc.) and lets you override with --provider/--model flags.
  • Standalone mode – no subscription required; install once and run bughunter from any terminal.

Installation (stand‑alone)

# clone the repo
git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter

# install the CLI and external scanners (subfinder, httpx, nuclei, …)
./install.sh --agent standalone

The installer creates a system‑wide bughunter command and stores configuration in ~/.bughunter/config.json. To uninstall, run ./uninstall.sh --agent standalone (add --purge-config to delete the config file).

Typical workflow

# pick an AI provider (Ollama is free & offline)
bughunter setup               # interactive or: bughunter setup --provider ollama --model qwen2.5:14b

# map the attack surface
bughunter recon example.com

# hunt for vulnerabilities
bughunter hunt example.com

# run the 7‑question validation gate on a finding
bughunter validate "my finding"

# generate a submission‑ready report
bughunter report

Short aliases (h, r, v) are also provided.

AI integration

  • The core LLM layer lives in brain.py and supports multiple providers via a unified API.
  • Each specialist agent (e.g., recon-agent, validator, report-writer) follows a ReAct/​LangGraph pattern: they decide what tool to call, run it, and incorporate the result into the next reasoning step.
  • When used as a Claude Code plugin, the same agents are exposed as slash commands (/recon, /hunt, /validate, /report, /autopilot).

Supported vulnerability classes

  • Web2: IDOR/BOLA, auth bypass, XSS (stored/DOM), SSRF, business‑logic, race conditions, SQLi, OAuth/OIDC, file‑upload RCE, GraphQL auth bypass, LLM prompt injection, API misconfig, account takeover, SSTI, sub‑domain takeover, cloud exposure, request smuggling, cache poisoning, MFA/2FA bypass, SAML/SSO attacks, error disclosure, CSS injection, LFI→RCE, insecure deserialization, dependency confusion, padding‑oracle, etc.
  • Web3: accounting desync, access‑control, incomplete code paths, off‑by‑one, oracle manipulation, ERC4626 share inflation, reentrancy, flash‑loan attacks, signature replay, proxy/upgrade issues.

Project layout (high‑level)

  • skills/ – knowledge bases the agents draw from (methodology, bug classes, payloads, report templates, etc.).
  • commands/ – slash‑command definitions.
  • agents/ – the nine specialised AI agents.
  • tools/ – wrappers around external scanners (subfinder, nuclei, ffuf, etc.) and custom Python/bash scripts.
  • memory/ – JSONL files that store cross‑session hunt memory.
  • engine.py – entry point for the standalone CLI.
  • brain.py & agent.py – LLM abstraction and ReAct‑style orchestration.
  • install.sh, install_tools.sh, uninstall.sh – scripts for setting up/removing the toolkit.

License – MIT (per the badge in the README).

Who might use it – Individual bug‑bounty hunters, security consulting teams, or anyone who wants to automate the repetitive parts of recon and testing while keeping a human‑in‑the‑loop for validation and reporting.

Related

  • Project
    Gabson0x/bountyforge

    An AI-powered pentesting framework for Claude Code that uses parallel specialized agents to audit smart contracts and web APIs, validating findings through a multi-gate process to generate submission-ready bug bounty reports.

  • Project
    elementalsouls/Claude-BugHunter

    A comprehensive skill bundle for Claude Code and other AI agents that provides specialized knowledge and methodologies for bug hunting and external red-team engagements.

  • Project
    adithyan-ak/AgentHound

    AgentHound is an open‑source offensive security framework that scans AI‑agent infrastructure from a foothold, harvests credentials, validates real access, and builds a graph‑based attack surface. It works via a static collector binary (active or stealth mode) and an optional Neo4j‑backed server for visual analysis.

  • Project
    tony1223/better-agent-terminal

    Better Agent Terminal (BAT) is a cross‑platform desktop app (Windows/macOS/Linux) built with Tauri 2 and React. It lets you manage multiple project workspaces, each with split‑panel terminals, a file browser, Git viewer, snippet manager, and an embedded AI coding assistant (Claude Code or OpenAI Codex). The AI runs inside the app, offering streaming output, permission modes, session resume/fork, and detailed usage stats. Optional integration with the `cx` CLI provides lightweight semantic code navigation. Install via Homebrew, AppImage, or a one‑line script; you can also build from source with Rust and Node. Ideal for developers who want a single window to run commands and interact with LLMs safely and efficiently.

  • Project
    MoizIbnYousaf/ai-agent-skills

    AI Agent Skills is an npm‑based CLI/TUI that ships a curated library of ~115 AI‑agent “skills” (prompt‑code bundles) organized into shelves (frontend, backend, mobile, workflow, agent‑engineering, marketing). It lets you browse, search, install, and manage both local “house‑copy” skills and upstream metadata‑only skills. You can also bootstrap a personal library with `init-library`, add or catalog new skills, vendor copies, sync updates, and generate documentation. Works with any Agent‑Skills‑compatible agent (Claude, Cursor, Gemini, etc.) and supports multiple install targets. Ideal for developers or teams who want a tidy, searchable toolbox of reusable agent capabilities.