BugHunter
AI-powered bug bounty hunting — recon to report, in your terminal.
Free Setup
·
Quick Start
·
Commands
·
What It Finds
·
Install
·
FAQ
Powered by AwareXone.com — Your AI Agent Against Scams & Fraud
💜 Open for Sponsorship
BugHunter is open for sponsorship. Your support funds new features and keeps the free standalone mode running for everyone. Sponsors get a logo and link right here in the README, plus a credit in every release.
Want to sponsor? Reach out at AwareXone.com or email shuvonsec@gmail.com.
What Is This?
A professional bug bounty hunting toolkit that works with or without a Claude subscription. Give it a target — it handles recon, tests for vulnerabilities, validates findings through a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
It remembers everything. Patterns found on one target inform the next. Sessions pick up where they left off.
Works as a Claude Code plugin or as a fully standalone CLI (bughunter) powered by free AI providers.
Standalone Mode — No Subscription Required
You no longer need Claude Code, Claude Pro, or any paid AI subscription.
Install once, use the bughunter command from any terminal on your machine:
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone
Rerun the same command after pulling updates. The installer detects and
refreshes the active managed bughunter command, including older installations
under /usr/local/bin or ~/.local/bin, while preserving your saved provider
configuration in ~/.bughunter/config.json.
To uninstall the standalone command while keeping its configuration:
./uninstall.sh --agent standalone
Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller
also supports claude, opencode, pi, codex, agents, and all targets.
bughunter help # show every command
bughunter setup # choose your AI provider (Ollama is free + offline)
bughunter recon target.com # map the attack surface
bughunter hunt target.com # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report # write a submission-ready report
bughunter chat # interactive AI hunting shell
bughunter providers # list all available AI providers
bughunter models # list models and show the selected one
bughunter status # check which provider is active
bughunter h target.com # short alias for hunt
bughunter r target.com # short alias for recon
bughunter v "finding" # short alias for validate
Free AI Providers (auto-detected, free-first priority)
| Provider | Cost | Privacy | Speed | Get Started |
|---|---|---|---|---|
| Ollama | 100% free · runs locally | Full — stays on your machine | Fast | ollama pull qwen2.5:14b |
| Groq | Free tier available | Cloud | Very fast | console.groq.com → get API key |
| DeepSeek | Very cheap (v4-flash / v4-pro) | Cloud | Fast | platform.deepseek.com |
| Claude API | Paid | Cloud | Fast | console.anthropic.com |
| OpenAI | Paid | Cloud | Fast | platform.openai.com |
| Grok (xAI) | Paid | Cloud | Fast | console.x.ai → grok-4.5 |
| OpenRouter | Subscription / pay-as-you-go | Cloud | Fast | openrouter.ai/keys → get API key |
| OrcaRouter | Subscription / pay-as-you-go | Cloud | Fast | orcarouter.ai → get API key |
BugHunter auto-detects providers in this order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Claude → OpenAI
Switch providers or choose an installed Ollama model anytime: bughunter setup.
The setup can also be fully non-interactive:
bughunter setup --provider ollama --model qwen2.5:14b
For a one-off override, put the option before the command:
bughunter --provider ollama --model qwen3:14b hunt target.com
Zero-cost fully offline setup
# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b # ~9 GB, one-time download
# 2. Install BugHunter
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
# 3. Hunt
bughunter setup # choose Ollama, then choose one of its installed models
bughunter recon target.com
Groq setup (free cloud, fastest option)
export GROQ_API_KEY="your-key-here" # free at console.groq.com
./install.sh --agent standalone
bughunter setup # choose Groq
bughunter hunt target.com
Quick Start
Option A — standalone (no subscription, works for everyone)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
bughunter setup # pick a free AI provider
bughunter recon target.com
bughunter hunt target.com
bughunter validate "my finding"
bughunter report
Option B — Claude Code plugin (requires Claude Code)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh # subfinder · httpx · nuclei · katana · ffuf
chmod +x install.sh && ./install.sh # skills + commands → ~/.claude/
claude
/recon target.com # map the attack surface
/hunt target.com # test for vulnerabilities
/validate # run the 7-Question Gate
/report # write the submission
Option C — let Claude install it (Claude Code only)
Open your terminal, run claude, then paste:
Install the Claude Bug Bounty toolkit from https://github.com/shuvonsec/claude-bug-bounty
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available.
Commands
Core Workflow
| Command | What It Does |
|---|---|
/recon target.com | Subdomain enum · live host probing · URL crawl · nuclei sweep |
/hunt target.com | Tests IDOR · auth bypass · SSRF · XSS · SQLi · logic flaws and more |
/validate | 7-Question Gate — kills weak findings before you waste time reporting |
/report | Generates an H1 · Bugcrowd · Intigriti · Immunefi submission in 60s |
/autopilot target.com | Full loop, autonomous — scope → recon → hunt → validate → report |
Recon & Enumeration
| Command | What It Does |
|---|---|
/surface target.com | Ranked attack surface from recon data + memory |
/scope-aggregate <program> | All in-scope assets across H1 · Bugcrowd · Intigriti · YWH · Immunefi |
/cloud-recon --keyword <name> | Public S3 · Azure · GCP buckets + CloudFlare-bypass origin IPs |
/param-discover <url> | Hidden HTTP parameters via Arjun · x8 |
/secrets-hunt --js-bundle <dir> | Leaked credentials in source, JS bundles, or a GitHub org |
/takeover --recon <dir> | Subdomain takeover candidates via dnsReaper · subjack |
/scan-cves <host> | Focused nuclei high/critical sweep + optional log4j-scan |
/bypass-403 <url> | Header · method · encoding tricks against 403/401 |
/portscan <host> | Open ports + non-web services (Redis · Docker API · DBs · RDP) via naabu/smap |
/screenshot -l urls.txt | Screenshot live hosts into an HTML gallery — triage + PoC evidence |
Scanners (Web + LLM)
| Command | What It Does |
|---|---|
/cors <url> | CORS misconfig — origin reflection · null · credentialed |
/crlf <url> | CRLF / response-splitting + host-header injection |
/nosqli <url> | NoSQL injection (operator bypass · $where timing) |
/jwt-scan <token> | Offline JWT toolkit — alg:none · RS256→HS256 · secret crack |
/oob <target> | Out-of-band listener (interactsh) for blind SSRF/XXE/SQLi |
/sast <path> | Semgrep security packs over fetched JS/source → ranked sinks |
/domxss <url> | Confirms DOM XSS in headless Chromium — reports only when the payload executes |
/llm-redteam <endpoint> | LLM red-team corpus — prompt injection · jailbreak · exfil |
Smart Contract (Web3)
| Command | What It Does |
|---|---|
/web3-audit <contract.sol> | 10-class smart contract audit with Foundry PoC template |
/token-scan <contract> | Rug pull scanner — mint authority · LP lock · honeypot · bonding curve |
Session & Utility
| Command | What It Does |
|---|---|
/pickup target.com | Resume from last session — untested endpoints first |
/intel target.com | CVEs + disclosed reports relevant to this target |
/chain | Bug A found → finds bugs B and C that chain with it |
/scope <asset> | Checks if a domain or URL is in scope before you test it |
/triage | Quick 2-minute go/no-go check |
/remember | Logs the current finding or technique to hunt memory |
/memory-gc | Inspect or rotate hunt-memory JSONL files (10 MB cap, 3 backups) |
/arsenal [tool] | Lists installed external tools or prints an install hint |
What It Finds
26 Web2 Vulnerability Classes
| Vulnerability | Typical Payout |
|---|---|
| IDOR / BOLA | $500 – $5K |
| Auth Bypass | $1K – $10K |
| XSS (Stored / Reflected / DOM) | $500 – $5K |
| SSRF | $1K – $15K |
| Business Logic | $500 – $10K |
| Race Conditions | $500 – $5K |
| SQL Injection | $1K – $15K |
| OAuth / OIDC | $500 – $5K |
| File Upload → RCE | $500 – $10K |
| GraphQL Auth Bypass | $1K – $10K |
| LLM / Prompt Injection | $500 – $10K |
| API Misconfiguration (mass assignment · JWT · CORS) | $500 – $5K |
| Account Takeover | $1K – $20K |
| SSTI | $2K – $10K |
| Subdomain Takeover | $200 – $5K |
| Cloud / Infra Exposure | $500 – $20K |
| HTTP Request Smuggling | $5K – $30K |
| Cache Poisoning | $1K – $10K |
| MFA / 2FA Bypass | $1K – $10K |
| SAML / SSO Attack | $2K – $20K |
| Error Disclosure / Debug Endpoints | $200 – $5K |
| CSS Injection | $500 – $5K |
| LFI → RCE | $1K – $15K |
| Insecure Deserialization | $5K – $30K |
| Dependency Confusion / Supply Chain | $1K – $20K |
| Padding Oracle / Crypto Misuse | $2K – $20K |
10 Web3 / Smart Contract Bug Classes
| Vulnerability | Typical Payout |
|---|---|
| Accounting Desync | $50K – $2M |
| Access Control | $50K – $2M |
| Incomplete Code Path | $50K – $2M |
| Off-By-One | $10K – $100K |
| Oracle Manipulation | $100K – $2M |
| ERC4626 Share Inflation | $50K – $500K |
| Reentrancy | $10K – $500K |
| Flash Loan Attack | $100K – $2M |
| Signature Replay | $10K – $200K |
| Proxy / Upgrade | $50K – $2M |
AI Agents
Nine specialists, each built for one job:
| Agent | Role |
|---|---|
recon-agent | Subdomain enum · live host discovery · URL crawl |
report-writer | Impact-first reports that get paid, not N/A'd |
validator | Runs the 7-Question Gate — kills weak findings |
web3-auditor | Smart contract audit across 10 bug classes |
chain-builder | Bug A → finds bugs B and C that chain with it |
autopilot | Full hunt loop with safety checkpoints |
recon-ranker | Ranks attack surface by highest-value targets first |
token-auditor | Meme coin / token rug pull and security scan |
credential-hunter | Wordlist gen → OSINT → breach-check → spray (hard-stop before spray) |
How It Works
You ─▶ /recon ─▶ /hunt ─▶ /validate ─▶ /report
│ │
▼ ▼
Hunt Memory 7-Question Gate
(persists across (kills weak findings
sessions) before you submit)
Every tool in the pipeline is gated on whether it's installed — missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.
Project Structure
Click to expand the full tree
claude-bug-bounty/
│
├── skills/ # AI knowledge bases — loaded as /skill-name
│ ├── bug-bounty/ # Master workflow — all vuln classes, LLM testing, chains
│ ├── bb-methodology/ # Hunting mindset · 5-phase workflow · session discipline
│ ├── web2-recon/ # Subdomain enum · live host discovery · URL crawl
│ ├── web2-vuln-classes/ # 26 bug classes with bypass tables
│ ├── security-arsenal/ # Payloads · bypass tables · gf patterns
│ ├── triage-validation/ # 7-Question Gate · 4 gates · never-submit list
│ ├── report-writing/ # Templates for H1 · Bugcrowd · Intigriti · Immunefi
│ ├── web3-audit/ # Smart contract bugs · Foundry PoC · 10 bug classes
│ ├── meme-coin-audit/ # Rug pull detection · LP attacks · bonding curve
│ ├── credential-attack/ # Password spray methodology · legal guardrails
│ └── client-reverse/ # Request-signing / anti-bot token reversal
│
├── commands/ # 26 slash commands (/recon /hunt /validate /report …)
├── agents/ # 9 specialized AI agents (recon, validator, reporter …)
│
├── tools/ # Python + shell scanner pipeline (~35 tools)
│ ├── hunt.py # Master orchestrator
│ ├── recon_engine.sh # Subdomain + URL discovery
│ ├── vuln_scanner.sh # XSS · SQLi · SSRF · SSTI probe pipeline
│ ├── validate.py # 4-gate finding validator with identity checks
│ └── … # 30+ more scanners — see tools/README.md
│
├── memory/ # Cross-session hunt memory (pattern DB · audit log)
├── rules/ # Always-active hunting + reporting rules
├── tests/ # Regression test suite (pytest)
├── web3/ # 13-chapter smart contract audit guide
├── mcp/ # MCP integrations — Burp Suite · Caido · HackerOne API
├── wordlists/ # Curated wordlists + SecLists / PayloadsAllTheThings refs
├── scripts/ # Dork runner · full hunt pipeline
├── hooks/ # Claude Code hook configuration
├── site/ # bughunter.fun landing page
├── demo/ # Local vulnerable target for tutorial recordings
│
├── docs/ # Extended documentation
│ ├── advanced-techniques.md # Exploitation techniques + chaining strategies
│ ├── auth-sessions.md # Auth header management guide
│ ├── payloads.md # Payload reference for common vuln classes
│ ├── smart-contract-audit.md# Smart contract audit deep-dive
│ ├── TUTORIAL.md # A→Z video tutorial walkthrough
│ └── TODOS.md # Open improvement items
│
├── .github/ # GitHub community health files
│ ├── CONTRIBUTING.md # How to contribute
│ ├── CODE_OF_CONDUCT.md # Community standards
│ ├── SECURITY.md # Vulnerability reporting policy
│ ├── PULL_REQUEST_TEMPLATE.md
│ └── ISSUE_TEMPLATE/ # Bug report · Feature request · False positive
│
├── engine.py # Standalone CLI — 'bughunter' command, no subscription needed
├── brain.py # Multi-provider LLM layer (Ollama · Groq · DeepSeek · Claude · OpenAI)
├── agent.py # LangGraph-style ReAct hunting agent
├── install.sh # Install skills + commands → ~/.claude/ (or standalone mode)
├── install_tools.sh # Install subfinder · httpx · nuclei · katana · ffuf …
├── uninstall.sh # Remove skills + commands from ~/.claude/
├── uninstall_tools.sh # Remove external scanning tools
├── serve.py # Launch local demo target (python3 serve.py)
├── config.example.json # Auth session config template
├── requirements.txt # Python dependencies
├── CLAUDE.md # Claude Code plugin manifest (auto-loaded)
├── AGENTS.md # Multi-harness plugin guide (OpenCode · Codex · Pi)
├── SKILL.md # Master skill shortcut (auto-loaded by agent harnesses)
├── OPENCODE.md # OpenCode-specific installation guide
├── CHANGELOG.md # Version history
├── FAQ.md # Frequently asked questions
└── TERMS.md # Terms of use + authorized testing only
Installation
Prerequisites:
# macOS
brew install go python3 jq
# Linux (Ubuntu/Debian)
sudo apt install golang python3 jq
Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):
chmod +x install_tools.sh && ./install_tools.sh
Standalone bughunter command (no subscription, works without Claude Code):
./install.sh --agent standalone
bughunter setup # choose Ollama (free) · Groq (free tier) · DeepSeek (cheap) · Claude · OpenAI
AI skills + commands into Claude Code:
chmod +x install.sh && ./install.sh
Other agent harnesses:
./install.sh --agent opencode # OpenCode
./install.sh --agent pi # Pi Agent
./install.sh --agent codex # Codex
./install.sh --agent all # every supported target
Optional: Chaos API key (better subdomain coverage)
export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc
Rules
Seven rules run every session, no exceptions:
| # | Rule | Why |
|---|---|---|
| 1 | Read full scope first | Only test what the program authorizes |
| 2 | Real bugs only | "Can an attacker do this RIGHT NOW?" — if no, stop |
| 3 | Kill weak findings | A 30-second check saves hours of wasted reporting |
| 4 | Never go out of scope | One wrong request can get you banned |
| 5 | 5-minute rule | No progress after 5 minutes? Move on |
| 6 | Validate before report | /validate before spending 30 minutes writing |
| 7 | Impact first | Test the bugs with the worst consequences first |
Contributing
PRs welcome. Most valuable:
- New scanner modules or detection techniques
- Payload additions to
skills/security-arsenal/SKILL.md - Methodology improvements backed by paid reports
- Platform support (YesWeHack · Synack · HackenProof)
git checkout -b feature/your-contribution
git commit -m "feat: short description"
git push origin feature/your-contribution
Used By
Teams and researchers running BugHunter in their workflow.
|
AwareXone AI agent vs. scams & fraud |
Open a one-line PR |
Using BugHunter in your team, program, or workflow? Add yourself — a quick PR to ADOPTERS.md, or open an issue. Real, verifiable entries only.
Star History
Support
If BugHunter helps your hunts, you can fuel more of them:
Thanks
Thanks to everyone who has contributed to BugHunter. Click any avatar to open their GitHub profile.
GitHub
·
Twitter
·
shuvonsec@gmail.com
Built by bug hunters, for bug hunters.
MIT License · For authorized security testing only. Always test within an approved bug bounty program scope.
Powered by AwareXone.com · Your AI Agent Against Scams & Fraud