AI-powered bug bounty hunting toolkit that works with or without subscription.
概览
AI-powered bug bounty hunting — recon to report, in your terminal. Find vulnerabilities. Validate them. Get paid. No subscription required. Free Setup · Quick Start · Commands · What It Finds · Install · FAQ A professional bug bounty hunting toolkit that works . Give it a target — it handles recon, tests for vulnerabilities, validates findings through a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi. Patterns found on one target inform the next. Sessions pick up where they left off. Works as a Claude Code plugin as a fully standalone CLI (bughunter) powered by free AI providers. Install once, use the bughunter command from any terminal on your machine: BugHunter auto-detects providers in this order: Switch providers anytime: bughunter setup
README
BugHunter
AI-powered bug bounty hunting — recon to report, in your terminal. Find vulnerabilities. Validate them. Get paid. No subscription required.
Free Setup · Quick Start · Commands · What It Finds · Install · FAQ
Here’s what you see when you launch it.
██████ ██████ ██ ██ ██ ██ ███ █ ███████
██ ██ ██ ██ ██ ██ ██ ██ ████ █ ███
██████ ██████ ███████ ██ ██ ██ ██ █ ███
██████ ██████ ███████ ██ ██ ██ ███ ███
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ███
██████ ██████ ██ ██ ███████ ██ ██ ███
+ Recon. Hunt. Validate. Report. +
┌──────────────────────────────────────────────────────┐
│ Target target.com │
│ Mode full │
│ Output recon/target.com/ │
│ Auth session loaded │
└──────────────────────────────────────────────────────┘
● local Ready type /hunt to begin
bbhunter v4.3
What Is This?
A professional bug bounty hunting toolkit that works with or without a Claude subscription. Give it a target — it handles recon, tests for vulnerabilities, validates findings through a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
It remembers everything. Patterns found on one target inform the next. Sessions pick up where they left off.
Works as a Claude Code plugin or as a fully standalone CLI (bughunter) powered by free AI providers.
🆓 Standalone Mode — No Subscription Required
You no longer need Claude Code, Claude Pro, or any paid AI subscription.
Install once, use the bughunter command from any terminal on your machine:
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone
bughunter help # show every command
bughunter setup # choose your AI provider (Ollama is free + offline)
bughunter recon target.com # map the attack surface
bughunter hunt target.com # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report # write a submission-ready report
bughunter chat # interactive AI hunting shell
bughunter providers # list all available AI providers
bughunter status # check which provider is active
bughunter h target.com # short alias for hunt
bughunter r target.com # short alias for recon
bughunter v "finding" # short alias for validate
Free AI Providers (auto-detected, free-first priority)
| Provider | Cost | Privacy | Speed | Get Started |
|---|---|---|---|---|
| Ollama | 100% free · runs locally | Full — stays on your machine | Fast | ollama pull qwen2.5:14b |
| Groq | Free tier available | Cloud | Very fast | console.groq.com → get API key |
| DeepSeek | Very cheap ($0.001/1K tokens) | Cloud | Fast | platform.deepseek.com |
| Claude API | Paid | Cloud | Fast | console.anthropic.com |
| OpenAI | Paid | Cloud | Fast | platform.openai.com |
BugHunter auto-detects providers in this order: Ollama → Groq → DeepSeek → Claude → OpenAI
Switch providers anytime: bughunter setup
Zero-cost fully offline setup
# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b # ~9 GB, one-time download
# 2. Install BugHunter
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
# 3. Hunt
bughunter setup # choose Ollama
bughunter recon target.com
Groq setup (free cloud, fastest option)
export GROQ_API_KEY="your-key-here" # free at console.groq.com
./install.sh --agent standalone
bughunter setup # choose Groq
bughunter hunt target.com
Quick Start
Option A — standalone (no subscription, works for everyone)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
bughunter setup # pick a free AI provider
bughunter recon target.com
bughunter hunt target.com
bughunter validate "my finding"
bughunter report
Option B — Claude Code plugin (requires Claude Code)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh # subfinder · httpx · nuclei · katana · ffuf
chmod +x install.sh && ./install.sh # skills + commands → ~/.claude/
claude
/recon target.com # map the attack surface
/hunt target.com # test for vulnerabilities
/validate # run the 7-Question Gate
/report # write the submission
Option C — let Claude install it (Claude Code only)
Open your terminal, run claude, then paste:
Install the Claude Bug Bounty toolkit from https://github.com/shuvonsec/claude-bug-bounty
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available.
Commands
Core Workflow
| Command | What It Does |
|---|---|
/recon target.com |
Subdomain enum · live host probing · URL crawl · nuclei sweep |
/hunt target.com |
Tests IDOR · auth bypass · SSRF · XSS · SQLi · logic flaws and more |
/validate |
7-Question Gate — kills weak findings before you waste time reporting |
/report |
Generates an H1 · Bugcrowd · Intigriti · Immunefi submission in 60s |
/autopilot target.com |
Full loop, autonomous — scope → recon → hunt → validate → report |
Recon & Enumeration
| Command | What It Does |
|---|---|
/surface target.com |
Ranked attack surface from recon data + memory |
/scope-aggregate |
All in-scope assets across H1 · Bugcrowd · Intigriti · YWH · Immunefi |
/cloud-recon --keyword |
Public S3 · Azure · GCP buckets + CloudFlare-bypass origin IPs |
/param-discover |
Hidden HTTP parameters via Arjun · x8 |
/secrets-hunt --js-bundle |
Leaked credentials in source, JS bundles, or a GitHub org |
/takeover --recon |
Subdomain takeover candidates via dnsReaper · subjack |
/scan-cves |
Focused nuclei high/critical sweep + optional log4j-scan |
/bypass-403 |
Header · method · encoding tricks against 403/401 |
Smart Contract (Web3)
| Command | What It Does |
|---|---|
/web3-audit |
10-class smart contract audit with Foundry PoC template |
/token-scan |
Rug pull scanner — mint authority · LP lock · honeypot · bonding curve |
Session & Utility
| Command | What It Does |
|---|---|
/pickup target.com |
Resume from last session — untested endpoints first |
/intel target.com |
CVEs + disclosed reports relevant to this target |
/chain |
Bug A found → finds bugs B and C that chain with it |
/scope |
Checks if a domain or URL is in scope before you test it |
/triage |
Quick 2-minute go/no-go check |
/remember |
Logs the current finding or technique to hunt memory |
/memory-gc |
Inspect or rotate hunt-memory JSONL files (10 MB cap, 3 backups) |
/arsenal [tool] |
Lists installed external tools or prints an install hint |
What It Finds
AI Agents
Nine specialists, each built for one job:
| Agent | Role |
|---|---|
recon-agent |
Subdomain enum · live host discovery · URL crawl |
report-writer |
Impact-first reports that get paid, not N/A’d |
validator |
Runs the 7-Question Gate — kills weak findings |
web3-auditor |
Smart contract audit across 10 bug classes |
chain-builder |
Bug A → finds bugs B and C that chain with it |
autopilot |
Full hunt loop with safety checkpoints |
recon-ranker |
Ranks attack surface by highest-value targets first |
token-auditor |
Meme coin / token rug pull and security scan |
credential-hunter |
Wordlist gen → OSINT → breach-check → spray (hard-stop before spray) |
How It Works
Every tool in the pipeline is gated on whether it’s installed — missing tools are skipped, not errors. Auth headers set once carry through httpx · katana · ffuf · nuclei · dalfox automatically.
Project Structure
Installation
Prerequisites:
# macOS
brew install go python3 jq
# Linux (Ubuntu/Debian)
sudo apt install golang python3 jq
Scanning tools (installs subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox and more):
chmod +x install_tools.sh && ./install_tools.sh
Standalone bughunter command (no subscription, works without Claude Code):
./install.sh --agent standalone
bughunter setup # choose Ollama (free) · Groq (free tier) · DeepSeek (cheap) · Claude · OpenAI
AI skills + commands into Claude Code:
chmod +x install.sh && ./install.sh
Other agent harnesses:
./install.sh --agent opencode # OpenCode
./install.sh --agent pi # Pi Agent
./install.sh --agent codex # Codex
./install.sh --agent all # every supported target
Optional: Chaos API key (better subdomain coverage)
export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc
Rules
Seven rules run every session, no exceptions:
| # | Rule | Why |
|---|---|---|
| 1 | Read full scope first | Only test what the program authorizes |
| 2 | Real bugs only | “Can an attacker do this RIGHT NOW?” — if no, stop |
| 3 | Kill weak findings | A 30-second check saves hours of wasted reporting |
| 4 | Never go out of scope | One wrong request can get you banned |
| 5 | 5-minute rule | No progress after 5 minutes? Move on |
| 6 | Validate before report | /validate before spending 30 minutes writing |
| 7 | Impact first | Test the bugs with the worst consequences first |
Contributing
PRs welcome. Most valuable:
- New scanner modules or detection techniques
- Payload additions to
skills/security-arsenal/SKILL.md - Methodology improvements backed by paid reports
- Platform support (YesWeHack · Synack · HackenProof)
git checkout -b feature/your-contribution
git commit -m "feat: short description"
git push origin feature/your-contribution
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add shuvonsec/claude-bug-bounty