awarexone/Agentic-Bug-Hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

Python

5,328

241 commits

updated Oct 9, 2026

awarexone.com

See the code

README

AI-powered bug bounty hunting — recon to report, in your terminal.
What Is This · Trusted By · Free Setup · Quick Start · Commands · What It Finds · AXguard · Support · FAQ

Built and maintained by AwareXone · Website · X · GitHub

SocialSafe by AwareXone provides case review and assistance for hacked, disabled, locked, restricted, and inaccessible social media accounts in Malaysia and worldwide by remote review. Assistance is best-effort, and final decisions remain with the platform.

One API for GPT, Claude, and other leading AI models
_{Sign up and get $3 in API credit · partner for BugHunter standalone mode}

Register with partner link → · promo SDRBUGHUNTER · Docs · Model Plaza

Get started (30 seconds)

uv tool install agentic-bug-hunter   # install the CLI (or: pipx install agentic-bug-hunter)
bughunter setup                      # connect a free AI provider

Then hunt — straight from your terminal:

bughunter hunt target.com            # recon → find → validate → report

…or drive it from inside Claude Code:

/hunt target.com

_{The CLI and AI hunting work on their own. Full recon also uses external tools
(subfinder · httpx · nuclei · katana · ffuf · nmap) — install them with
install_tools.sh from the repo. Output lands in ~/.bughunter/.}

Trusted By Engineers At

Where this project's stargazers say they work.

_{Compiled from public GitHub profiles of this repository's stargazers -
43 people across 30 organizations, counted from the employer
each person lists on their own profile or from their public organization
memberships. No individual accounts are named. These companies have not
endorsed or sponsored this project; their logos are shown as trademarks of
their respective owners.}

What Is This?

Agentic Bug Hunter finds real, reportable bugs, not theoretical ones. Point it at a target and it runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes a submission-ready report for HackerOne, Bugcrowd, Intigriti, or Immunefi.

It remembers everything: patterns found on one target inform the next, and sessions pick up where they left off.

Works as a Claude Code plugin, or as a fully standalone CLI (bughunter) with no subscription required.

Standalone Mode: No Subscription Required

You no longer need Claude Code, Claude Pro, or any paid AI subscription.

Install once, use the bughunter command from any terminal on your machine:

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone

Rerun the same command after pulling updates. The installer detects and refreshes the active managed bughunter command, including older installations under /usr/local/bin or ~/.local/bin, while preserving your saved provider configuration in ~/.bughunter/config.json.

To uninstall the standalone command while keeping its configuration:

./uninstall.sh --agent standalone

Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller also supports claude, opencode, pi, codex, agents, and all targets.

bughunter help               # show every command
bughunter setup              # choose your AI provider (Ollama is free + offline)
bughunter recon target.com   # map the attack surface
bughunter hunt  target.com   # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report             # write a submission-ready report
bughunter chat               # interactive AI hunting shell
bughunter providers          # list all available AI providers
bughunter models             # list models and show the selected one
bughunter status             # check which provider is active
bughunter h target.com       # short alias for hunt
bughunter r target.com       # short alias for recon
bughunter v "finding"        # short alias for validate

Free AI Providers (auto-detected, free-first priority)

Provider	Cost	Privacy	Speed	Get Started
Ollama	100% free · runs locally	Full - stays on your machine	Fast	`ollama pull qwen2.5:14b`
Groq	Free tier available	Cloud	Very fast	console.groq.com → get API key
DeepSeek	Very cheap (v4-flash / v4-pro)	Cloud	Fast	platform.deepseek.com
Claude API	Paid	Cloud	Fast	console.anthropic.com
OpenAI	Paid	Cloud	Fast	platform.openai.com
Grok (xAI)	Paid	Cloud	Fast	console.x.ai → `grok-4.5`
OpenRouter	Subscription / pay-as-you-go	Cloud	Fast	openrouter.ai/keys → get API key
OrcaRouter	Subscription / pay-as-you-go	Cloud	Fast	orcarouter.ai → get API key
Sidrune AI	Subscription / pay-as-you-go	Cloud	Fast	sidrune.ai → get API key · docs · Model Plaza
LiteLLM	Uses your existing provider keys	Cloud / self-hosted proxy	Fast	docs.litellm.ai → one gateway for 100+ models
Requesty	Pay-as-you-go	Cloud	Fast	app.requesty.ai/api-keys → get API key · docs

BugHunter auto-detects providers in this order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Sidrune AI → Claude → OpenAI. LiteLLM is opt-in (selected explicitly or when LITELLM_API_KEY is set) so it never preempts a provider you already configured. Requesty is opt-in the same way (selected explicitly or when REQUESTY_API_KEY is set); set REQUESTY_BASE_URL=https://router.eu.requesty.ai/v1 to route through the EU region.

Switch providers or choose an installed Ollama model anytime: bughunter setup. The setup can also be fully non-interactive:

bughunter setup --provider ollama --model qwen2.5:14b

For a one-off override, put the option before the command:

bughunter --provider ollama --model qwen3:14b hunt target.com

Zero-cost fully offline setup

# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b          # ~9 GB, one-time download

# 2. Install BugHunter
git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone   # creates system-wide 'bughunter' command

# 3. Hunt
bughunter setup       # choose Ollama, then choose one of its installed models
bughunter recon target.com

Groq setup (free cloud, fastest option)

export GROQ_API_KEY="your-key-here"     # free at console.groq.com
./install.sh --agent standalone
bughunter setup       # choose Groq
bughunter hunt target.com

Sidrune AI setup (multi-model gateway)

Sidrune AI is an optional OpenAI-compatible gateway (https://fluxionai.world/v1). It is not the default provider — pick it in bughunter setup, or set BRAIN_PROVIDER=fluxion when you want it.

# 1. Register (AwareXone partner link) and create an API key
#    https://fluxionai.space/register?source=github&campaign=github-sidrune-agentic-bug-hunter&promo=SDRBUGHUNTER
#    Docs: https://docs.fluxionai.world/user-guide/help-center
#    Models: https://fluxionai.world/model-plaza

export FLUXION_API_KEY="your-key-here"
./install.sh --agent standalone
bughunter setup --provider fluxion --model openai/gpt-4o
bughunter hunt target.com

# Or one-off:
bughunter --provider fluxion --model openai/gpt-4o hunt target.com

Quick Start

Fastest - install from PyPI

pip install agentic-bug-hunter
bughunter setup                   # pick a free AI provider
bughunter recon target.com
bughunter hunt  target.com

Installs the bughunter and bughunter-agent commands. The AI hunting works out of the box; full recon also uses external CLIs (subfinder, httpx, nuclei, katana, ffuf, nmap). Get them with install_tools.sh from the repo, or your package manager. Output is written to ~/.bughunter/ (override with BUGHUNTER_HOME).

Option A - standalone (no subscription, works for everyone)

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone   # creates system-wide 'bughunter' command
bughunter setup                   # pick a free AI provider
bughunter recon target.com
bughunter hunt  target.com
bughunter validate "my finding"
bughunter report

Option B - Claude Code plugin (requires Claude Code)

git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
chmod +x install_tools.sh && ./install_tools.sh   # subfinder · httpx · nuclei · katana · ffuf
chmod +x install.sh      && ./install.sh          # skills + commands → ~/.claude/

claude
/recon target.com        # map the attack surface
/hunt target.com         # test for vulnerabilities
/validate                # run the 7-Question Gate
/report                  # write the submission

Option C - let Claude install it (Claude Code only)

Open your terminal, run claude, then paste:

Install the Claude Bug Bounty toolkit from https://github.com/Awarexone/Agentic-Bug-Hunter
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available.

MCP

Use Agentic-Bug-Hunter from AI agents (Cursor, Claude Code, Codex, OpenCode).

AI Agent → Agentic-Bug-Hunter MCP → Scope → Recon → Hunt → Validate → Report

pip install 'mcp>=2.2.0'
./install.sh --agent mcp
bughunter mcp doctor
bughunter mcp serve

MCP is an adapter over the existing research engine — not a second scanner. Active tools require scope and explicit approval. See docs/mcp.md.

Commands

Core Workflow

Command	What It Does
`/recon target.com`	Subdomain enum · live host probing · URL crawl · nuclei sweep
`/hunt target.com`	Tests IDOR · auth bypass · SSRF · XSS · SQLi · logic flaws and more
`/validate`	7-Question Gate - kills weak findings before you waste time reporting
`/report`	Generates an H1 · Bugcrowd · Intigriti · Immunefi submission in 60s
`/autopilot target.com`	Full loop, autonomous - scope → recon → hunt → validate → report

Recon & Enumeration

Command	What It Does
`/surface target.com`	Ranked attack surface from recon data + memory
`/scope-aggregate <program>`	All in-scope assets across H1 · Bugcrowd · Intigriti · YWH · Immunefi
`/cloud-recon --keyword <name>`	Public S3 · Azure · GCP buckets + CloudFlare-bypass origin IPs
`/param-discover <url>`	Hidden HTTP parameters via Arjun · x8
`/secrets-hunt --js-bundle <dir>`	Leaked credentials in source, JS bundles, or a GitHub org
`/takeover --recon <dir>`	Subdomain takeover candidates via dnsReaper · subjack
`/scan-cves <host>`	Focused nuclei high/critical sweep + optional log4j-scan
`/bypass-403 <url>`	Header · method · encoding tricks against 403/401
`/portscan <host>`	Open ports + non-web services (Redis · Docker API · DBs · RDP) via naabu/smap
`/screenshot -l urls.txt`	Screenshot live hosts into an HTML gallery - triage + PoC evidence

Scanners (Web + LLM)

Command	What It Does
`/cors <url>`	CORS misconfig - origin reflection · null · credentialed
`/crlf <url>`	CRLF / response-splitting + host-header injection
`/nosqli <url>`	NoSQL injection (operator bypass · `$where` timing)
`/jwt-scan <token>`	Offline JWT toolkit - alg:none · RS256→HS256 · secret crack
`/oob <target>`	Out-of-band listener (interactsh) for blind SSRF/XXE/SQLi
`/sast <path>`	Semgrep security packs over fetched JS/source → ranked sinks
`/domxss <url>`	Confirms DOM XSS in headless Chromium - reports only when the payload executes
`/llm-redteam <endpoint>`	LLM red-team corpus - prompt injection · jailbreak · exfil

Smart Contract (Web3)

Command	What It Does
`/web3-audit <contract.sol>`	10-class smart contract audit with Foundry PoC template
`/token-scan <contract>`	Rug pull scanner - mint authority · LP lock · honeypot · bonding curve

Session & Utility

Command	What It Does
`/pickup target.com`	Resume from last session - untested endpoints first
`/intel target.com`	CVEs + disclosed reports relevant to this target
`/chain`	Bug A found → finds bugs B and C that chain with it
`/scope <asset>`	Checks if a domain or URL is in scope before you test it
`/triage`	Quick 2-minute go/no-go check
`/remember`	Logs the current finding or technique to hunt memory
`/memory-gc`	Inspect or rotate hunt-memory JSONL files (10 MB cap, 3 backups)
`/arsenal [tool]`	Lists installed external tools or prints an install hint

What It Finds

26 Web2 Vulnerability Classes

Vulnerability	Typical Payout
IDOR / BOLA	$500 – $5K
Auth Bypass	$1K – $10K
XSS (Stored / Reflected / DOM)	$500 – $5K
SSRF	$1K – $15K
Business Logic	$500 – $10K
Race Conditions	$500 – $5K
SQL Injection	$1K – $15K
OAuth / OIDC	$500 – $5K
File Upload → RCE	$500 – $10K
GraphQL Auth Bypass	$1K – $10K
LLM / Prompt Injection	$500 – $10K
API Misconfiguration (mass assignment · JWT · CORS)	$500 – $5K
Account Takeover	$1K – $20K
SSTI	$2K – $10K
Subdomain Takeover	$200 – $5K
Cloud / Infra Exposure	$500 – $20K
HTTP Request Smuggling	$5K – $30K
Cache Poisoning	$1K – $10K
MFA / 2FA Bypass	$1K – $10K
SAML / SSO Attack	$2K – $20K
Error Disclosure / Debug Endpoints	$200 – $5K
CSS Injection	$500 – $5K
LFI → RCE	$1K – $15K
Insecure Deserialization	$5K – $30K
Dependency Confusion / Supply Chain	$1K – $20K
Padding Oracle / Crypto Misuse	$2K – $20K

10 Web3 / Smart Contract Bug Classes

Vulnerability	Typical Payout
Accounting Desync	$50K – $2M
Access Control	$50K – $2M
Incomplete Code Path	$50K – $2M
Off-By-One	$10K – $100K
Oracle Manipulation	$100K – $2M
ERC4626 Share Inflation	$50K – $500K
Reentrancy	$10K – $500K
Flash Loan Attack	$100K – $2M
Signature Replay	$10K – $200K
Proxy / Upgrade	$50K – $2M

AI Agents

Nine specialists, each built for one job:

Agent	Role
`recon-agent`	Subdomain enum · live host discovery · URL crawl
`report-writer`	Impact-first reports that get paid, not N/A'd
`validator`	Runs the 7-Question Gate - kills weak findings
`web3-auditor`	Smart contract audit across 10 bug classes
`chain-builder`	Bug A → finds bugs B and C that chain with it
`autopilot`	Full hunt loop with safety checkpoints
`recon-ranker`	Ranks attack surface by highest-value targets first
`token-auditor`	Meme coin / token rug pull and security scan
`credential-hunter`	Wordlist gen → OSINT → breach-check → spray (hard-stop before spray)

How It Works

   You ─▶ /recon ─▶ /hunt ─▶ /validate ─▶ /report
              │                  │
              ▼                  ▼
        Hunt Memory       7-Question Gate
   (persists across    (kills weak findings
       sessions)         before you submit)

Every tool in the pipeline is gated on whether it's installed - missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.

Project Structure

Click to expand the full tree

Agentic-Bug-Hunter/
│
├── skills/                    # AI knowledge bases - loaded as /skill-name
│   ├── bug-bounty/            # Master workflow - all vuln classes, LLM testing, chains
│   ├── bb-methodology/        # Hunting mindset · 5-phase workflow · session discipline
│   ├── web2-recon/            # Subdomain enum · live host discovery · URL crawl
│   ├── web2-vuln-classes/     # 26 bug classes with bypass tables
│   ├── security-arsenal/      # Payloads · bypass tables · gf patterns
│   ├── triage-validation/     # 7-Question Gate · 4 gates · never-submit list
│   ├── report-writing/        # Templates for H1 · Bugcrowd · Intigriti · Immunefi
│   ├── web3-audit/            # Smart contract bugs · Foundry PoC · 10 bug classes
│   ├── meme-coin-audit/       # Rug pull detection · LP attacks · bonding curve
│   ├── credential-attack/     # Password spray methodology · legal guardrails
│   └── client-reverse/        # Request-signing / anti-bot token reversal
│
├── commands/                  # 33 slash commands (/recon /hunt /validate /report …)
├── agents/                    # 9 specialized AI agents (recon, validator, reporter …)
│
├── tools/                     # Python + shell scanner pipeline (~35 tools)
│   ├── hunt.py                # Master orchestrator
│   ├── recon_engine.sh        # Subdomain + URL discovery
│   ├── vuln_scanner.sh        # XSS · SQLi · SSRF · SSTI probe pipeline
│   ├── validate.py            # 4-gate finding validator with identity checks
│   └── …                      # 30+ more scanners - see tools/README.md
│
├── memory/                    # Cross-session hunt memory (pattern DB · audit log)
├── rules/                     # Always-active hunting + reporting rules
├── tests/                     # Regression test suite (pytest)
├── web3/                      # 13-chapter smart contract audit guide
├── mcp/                       # MCP — native BugHunter server + Burp · Caido · HackerOne
├── wordlists/                 # Curated wordlists + SecLists / PayloadsAllTheThings refs
├── scripts/                   # Dork runner · full hunt pipeline
├── hooks/                     # Claude Code hook configuration
├── site/                      # bughunter.fun landing page
├── demo/                      # Local vulnerable target for tutorial recordings
│
├── docs/                      # Extended documentation
│   ├── advanced-techniques.md # Exploitation techniques + chaining strategies
│   ├── auth-sessions.md       # Auth header management guide
│   ├── payloads.md            # Payload reference for common vuln classes
│   ├── smart-contract-audit.md# Smart contract audit deep-dive
│   ├── TUTORIAL.md            # A→Z video tutorial walkthrough
│   └── TODOS.md               # Open improvement items
│
├── .github/                   # GitHub community health files
│   ├── CONTRIBUTING.md        # How to contribute
│   ├── CODE_OF_CONDUCT.md     # Community standards
│   ├── SECURITY.md            # Vulnerability reporting policy
│   ├── PULL_REQUEST_TEMPLATE.md
│   └── ISSUE_TEMPLATE/        # Bug report · Feature request · False positive
│
├── engine.py                  # Standalone CLI - 'bughunter' command, no subscription needed
├── brain.py                   # Multi-provider LLM layer (Ollama · Groq · DeepSeek · Claude · OpenAI)
├── agent.py                   # LangGraph-style ReAct hunting agent
├── install.sh                 # Install skills + commands → ~/.claude/ (or standalone mode)
├── install_tools.sh           # Install subfinder · httpx · nuclei · katana · ffuf …
├── uninstall.sh               # Remove skills + commands from ~/.claude/
├── uninstall_tools.sh         # Remove external scanning tools
├── serve.py                   # Launch local demo target (python3 serve.py)
├── config.example.json        # Auth session config template
├── requirements.txt           # Python dependencies
├── CLAUDE.md                  # Claude Code plugin manifest (auto-loaded)
├── AGENTS.md                  # Multi-harness plugin guide (OpenCode · Codex · Pi)
├── SKILL.md                   # Master skill shortcut (auto-loaded by agent harnesses)
├── OPENCODE.md                # OpenCode-specific installation guide
├── CHANGELOG.md               # Version history
├── FAQ.md                     # Frequently asked questions
└── TERMS.md                   # Terms of use + authorized testing only

Installation

Prerequisites:

# macOS
brew install go python3 jq

# Linux (Ubuntu/Debian)
sudo apt install golang python3 jq

Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):

chmod +x install_tools.sh && ./install_tools.sh

Standalone bughunter command (no subscription, works without Claude Code):

./install.sh --agent standalone
bughunter setup    # choose Ollama (free) · Groq (free tier) · DeepSeek (cheap) · Claude · OpenAI

AI skills + commands into Claude Code:

chmod +x install.sh && ./install.sh

Other agent harnesses:

./install.sh --agent opencode    # OpenCode
./install.sh --agent pi          # Pi Agent
./install.sh --agent codex       # Codex
./install.sh --agent all         # every supported target

Optional: Chaos API key (better subdomain coverage)

export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc

Rules

Seven rules run every session, no exceptions:

#	Rule	Why
1	Read full scope first	Only test what the program authorizes
2	Real bugs only	"Can an attacker do this RIGHT NOW?" - if no, stop
3	Kill weak findings	A 30-second check saves hours of wasted reporting
4	Never go out of scope	One wrong request can get you banned
5	5-minute rule	No progress after 5 minutes? Move on
6	Validate before report	`/validate` before spending 30 minutes writing
7	Impact first	Test the bugs with the worst consequences first

Contributing

PRs welcome. Most valuable:

New scanner modules or detection techniques
Payload additions to skills/security-arsenal/SKILL.md
Methodology improvements backed by paid reports
Platform support (YesWeHack · Synack · HackenProof)

git checkout -b feature/your-contribution
git commit -m "feat: short description"
git push origin feature/your-contribution

Used By

Teams and researchers running BugHunter in their workflow.

_shuvonsec	_awarexonedev	_letztek	_{bertolikimberly}	_venkatas	_{indraoverflow}
_{DebasishTripathy13}	_shivsin25	_adityaax	_{BeargleIndustries}	_ftacorn	_ultra-supara
_Amine-Genin	_AurisDSP	_Biruk121	_Edneam	_depapp	_{Realgagenichols}
_H4d3es	_thuvh	_onlybugs05	_savioruz	_Marc-oss-hub	_Paebak
_NaorYaacov	_{nurazhardotcom}	_OctoBored	_prodmanpd	_{SeekAndExploit}	_{Thibaultjaigu}
_Shawanga	_zeze-zeze	_amanssj3	_grave0x	_{kevinaimonster}

---

GitHub · Twitter · hello@awarexone.com · shuvon@awarexone.com
Built by bug hunters, for bug hunters.
_{MIT License · For authorized security testing only. Always test within an approved bug bounty program scope.}

_{Powered by AwareXone.com}
_{Website ·
X / Twitter ·
GitHub}

ai-security

bug-bounty

bugcrowd

claude-ai

claude-code

cti

ethical-hacking

hackerone

hacking

hacking-tool

penetration-testing

recon

vulnerability-scanner

Project health

PyPI

agentic-bug-hunter

Latest release

6.0.2 · Sep 22, 2026

Releases this year

Significant stargazers

hahwul

3,047 followers · starred Mar 2026

Chun-Hung Tseng

184 followers · starred Apr 2026

Jvr

63 followers · starred Mar 2026

zebbern

319 followers · starred Jun 2026

Similar repos

elementalsouls/Claude-BugHunter

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash…

5,016

Armur-Ai/Pentest-Swarm-AI

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification,…

2,849

CyberStrikeus/CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

3,117

usestrix/strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

68,167

Lazarus-AI/clearwing

1,075

Netw0rkNoob/VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排，配合大语言模型，自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

3,551

GreyDGL/PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

15,911

0x4m4/hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.)…

12,699