StanleyNull/AutoHunter

自动化 SRC 漏洞挖掘系统：FOFA 资产测绘 + LLM 多 worker 自主挖掘/审核/情报沉淀。Powered By StanleyNull

AutoHunter – AI‑driven, 24/7 automated vulnerability hunting

What it is – AutoHunter is a self‑contained platform that runs a fleet of AI‑powered agents to discover security flaws in web assets. One machine can operate continuously, collecting targets, probing them with real tools (nmap, nuclei, sqlmap, httpx, …), and using a large language model (LLM) to decide which findings are worth keeping. Humans only intervene at the final review stage to approve, reject or edit the results.

Key components

Component	Role
Collector	Pulls targets from FOFA (or other search engines) or a manual list, checks if they are alive, scores them and adds them to the queue.
Worker	One worker per target. The LLM drives the reconnaissance, then launches the bundled tools to actually test for vulnerabilities.
Reviewer	An “AI‑first” reviewer that filters out obvious false‑positives before the findings reach a human.
Console	Vue‑based dashboard showing live status of every worker, priority of targets, and a result pane for quick human triage.

Why it matters – By delegating the repetitive scanning and initial analysis to LLM‑guided agents, security teams can keep a machine running overnight and only spend a few minutes each day on the final decisions. The system also records proven credentials, fingerprints and proof‑of‑concepts for reuse in later runs.

Highlighted features

Multi‑agent workflow – Collector → Worker → Reviewer → Human → optional “mass‑exploit” analysis.
24/7 unattended operation – Docker‑compose deployment; containers restart automatically.
Real tool execution – nmap, nuclei, sqlmap, httpx, whatweb, curl, etc. are run inside the worker containers, not just simulated.
LLM‑driven decision making – Supports any OpenAI‑compatible API (DeepSeek, Claude, OpenAI, etc.) with tool‑calling; falls back to prompt‑based simulation for models without native function calls.
Target attribution – Automatic lookup of IP/ASN info (ip138) and JSON export for EduSRC reporting.
Batch “kill‑chain” analysis – After a finding is confirmed, the system can scan similar hosts to see if the same issue can be exploited en‑mass.
Built‑in WAF & role‑based tokens – Access control for the web UI; optional reverse‑proxy for HTTPS.
SQLite persistence + backup – One‑click export/import of a consistent snapshot; Docker volumes keep data across upgrades.

Quick start (Docker‑Compose)

# Install Docker (if needed)
curl -fsSL https://get.docker.com | sh && sudo systemctl enable --now docker
# Clone and run the installer
git clone https://github.com/StanleyNull/AutoHunter.git autohunter && cd autohunter
bash scripts/install.sh   # interactive: enter LLM API key, optional FOFA key

The script builds the backend, the Vue frontend, and the vulnerability‑tool images, then starts the stack on port 18800. Open http://<host>:18800/ and log in with the token printed by the installer.

Windows (Docker Desktop + WSL2) and macOS instructions are also provided in the README.

Core configuration (environment variables)

Variable	Required?	Purpose
`LLM_API_KEY`	✅	API key for the chosen LLM provider (DeepSeek, OpenAI, Claude, etc.).
`LLM_BASE_URL`	optional	Custom endpoint (defaults to DeepSeek).
`LLM_MODEL`	optional	Model name that supports tool‑calling.
`FOFA_KEY`	recommended	Access to FOFA for automatic target collection.
`AUTOHUNTER_API_TOKEN`	strongly recommended	Bearer token that protects the web UI; without it the console is open to anyone.
`AUTOHUNTER_HOST_PORT`	optional	Port exposed to the outside (default 18800).
`AUTOHUNTER_TOOL_COMPAT`	optional	How the system handles tool‑calling (`auto`, `prompt`, `native`).

All other knobs (worker concurrency, budget caps, WAF toggle, etc.) have sensible defaults and can be overridden in .env or via the UI’s Settings page.

Technology stack

Backend – Python 3.12, FastAPI, SQLAlchemy (SQLite with WAL), asyncio.
Frontend – Vue 3 + Vite, served through the same Docker compose.
LLM integration – OpenAI‑compatible chat completions or Anthropic messages; supports function calling or prompt‑based simulation.
Embedded tools – nmap, nuclei, sqlmap, httpx, whatweb, curl, wget, jq (all pre‑installed in the worker image).
Orchestration – Docker Compose v2; containers restart unless‑stopped and can be managed with systemd if desired.

Who might use it?

Red‑team / pentest teams that need a continuously running scanner for a specific asset pool (e.g., university networks, corporate intranets).
Bug‑bounty platforms wanting to automate the first‑pass triage of large numbers of reports.
Security researchers interested in experimenting with LLM‑guided tool orchestration.

License & safety note

AutoHunter is released under the Apache 2.0 license. The authors stress that it must only be pointed at assets for which you have explicit written permission. The tool can delete or modify data on a target; misuse is the user’s responsibility.

Bottom line – AutoHunter combines a modern LLM interface with proven network scanning tools, wraps them in a multi‑agent pipeline, and ships everything as a Docker‑compose stack that can run unattended. It lets you turn a single server into a “hunt‑all‑day” machine while keeping the human workload to a quick daily review.