Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
Install / Use
npx skills add awarexone/Agentic-Bug-HunterInstalls into whichever agent you are using.
CLAUDE.md
Claude Code project instructions
Quality Score
Category
SecuritySupported Platforms
Skill content
View source on GitHub💜 Open for Sponsorship
BugHunter is open for sponsorship. Your support funds new features and keeps the free standalone mode running for everyone. Sponsors get a logo and link right here in the README, plus a credit in every release.
Want to sponsor? Reach out at AwareXone.com or email shuvonsec@gmail.com.
What Is This?
A professional bug bounty hunting toolkit that works with or without a Claude subscription. Give it a target — it handles recon, tests for vulnerabilities, validates findings through a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
It remembers everything. Patterns found on one target inform the next. Sessions pick up where they left off.
Works as a Claude Code plugin or as a fully standalone CLI (bughunter) powered by free AI providers.
Standalone Mode — No Subscription Required
You no longer need Claude Code, Claude Pro, or any paid AI subscription.
Install once, use the bughunter command from any terminal on your machine:
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone
Rerun the same command after pulling updates. The installer detects and
refreshes the active managed bughunter command, including older installations
under /usr/local/bin or ~/.local/bin, while preserving your saved provider
configuration in ~/.bughunter/config.json.
To uninstall the standalone command while keeping its configuration:
./uninstall.sh --agent standalone
Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller
also supports claude, opencode, pi, codex, agents, and all targets.
bughunter help # show every command
bughunter setup # choose your AI provider (Ollama is free + offline)
bughunter recon target.com # map the attack surface
bughunter hunt target.com # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report # write a submission-ready report
bughunter chat # interactive AI hunting shell
bughunter providers # list all available AI providers
bughunter models # list models and show the selected one
bughunter status # check which provider is active
bughunter h target.com # short alias for hunt
bughunter r target.com # short alias for recon
bughunter v "finding" # short alias for validate
Free AI Providers (auto-detected, free-first priority)
| Provider | Cost | Privacy | Speed | Get Started |
|:---|:---|:---|:---|:---|
| Ollama | 100% free · runs locally | Full — stays on your machine | Fast | ollama pull qwen2.5:14b |
| Groq | Free tier available | Cloud | Very fast | console.groq.com → get API key |
| DeepSeek | Very cheap (v4-flash / v4-pro) | Cloud | Fast | platform.deepseek.com |
| Claude API | Paid | Cloud | Fast | console.anthropic.com |
| OpenAI | Paid | Cloud | Fast | platform.openai.com |
| Grok (xAI) | Paid | Cloud | Fast | console.x.ai → grok-4.5 |
| OpenRouter | Subscription / pay-as-you-go | Cloud | Fast | openrouter.ai/keys → get API key |
| OrcaRouter | Subscription / pay-as-you-go | Cloud | Fast | orcarouter.ai → get API key |
BugHunter auto-detects providers in this order: Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Claude → OpenAI
Switch providers or choose an installed Ollama model anytime: bughunter setup.
The setup can also be fully non-interactive:
bughunter setup --provider ollama --model qwen2.5:14b
For a one-off override, put the option before the command:
bughunter --provider ollama --model qwen3:14b hunt target.com
Zero-cost fully offline setup
# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b # ~9 GB, one-time download
# 2. Install BugHunter
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
# 3. Hunt
bughunter setup # choose Ollama, then choose one of its installed models
bughunter recon target.com
Groq setup (free cloud, fastest option)
export GROQ_API_KEY="your-key-here" # free at console.groq.com
./install.sh --agent standalone
bughunter setup # choose Groq
bughunter hunt target.com
Quick Start
Option A — standalone (no subscription, works for everyone)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
bughunter setup # pick a free AI provider
bughunter recon target.com
bughunter hunt target.com
bughunter validate "my finding"
bughunter report
Option B — Claude Code plugin (requires Claude Code)
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh # subfinder · httpx · nuclei · katana · ffuf
chmod +x install.sh && ./install.sh # skills + commands → ~/.claude/
claude
/recon target.com # map the attack surface
/hunt target.com # test for vulnerabilities
/validate # run the 7-Question Gate
/report # write the submission
Option C — let Claude install it (Claude Code only)
Open your terminal, run claude, then paste:
Install the Claude Bug Bounty toolkit from https://github.com/shuvonsec/claude-bug-bounty
into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh.
Verify /recon /hunt /validate /report are available.
Commands
Core Workflow
| Command | What It Does |
|:---|:---|
| /recon target.com | Subdomain enum · live host probing · URL crawl · nuclei sweep |
| /hunt target.com | Tests IDOR · auth bypass · SSRF · XSS · SQLi · logic flaws and more |
| /validate | 7-Question Gate — kills weak findings before you waste time reporting |
| /report | Generates an H1 · Bugcrowd · Intigriti · Immunefi submission in 60s |
| /autopilot target.com | Full loop, autonomous — scope → recon → hunt → validate → report |
Recon & Enumeration
| Command | What It Does |
|:---|:---|
| /surface target.com | Ranked attack surface from recon data + memory |
| /scope-aggregate <program> | All in-scope assets across H1 · Bugcrowd · Intigriti · YWH · Immunefi |
| /cloud-recon --keyword <name> | Public S3 · Azure · GCP buckets + CloudFlare-bypass origin IPs |
| /param-discover <url> | Hidden HTTP parameters via Arjun · x8 |
| /secrets-hunt --js-bundle <dir> | Leaked credentials in source, JS bundles, or a GitHub org |
| /takeover --recon <dir> | Subdomain takeover candidates via dnsReaper · subjack |
| /scan-cves <host> | Focused nuclei high/critical sweep + optional log4j-scan |
| /bypass-403 <url> | Header · method · encoding tricks against 403/401 |
| /portscan <host> | Open ports + non-web services (Redis · Docker API · DBs · RDP) via naabu/smap |
| /screenshot -l urls.txt | Screenshot live hosts into an HTML gallery — triage + PoC evidence |
Scanners (Web + LLM)
| Command | What It Does |
|:---|:---|
| /cors <url> | CORS misconfig — origin reflection · null · credentialed |
| /crlf <url> | CRLF / response-splitting + host-header injection |
| /nosqli <url> | NoSQL injection (operator bypass · $where timing) |
| /jwt-scan <token> | Offline JWT toolkit — alg:none · RS256→HS256 · secret crack |
| /oob <target> | Out-of-band listener (interactsh) for blind SSRF/XXE/SQLi |
| /sast <path> | Semgrep security packs over fetched JS/source → ranked sinks |
| /domxss <url> | Confirms DOM XSS in headless Chromium — reports only when the payload executes |
| /llm-redteam <endpoint> | LLM red-team corpus — prompt injection · jailbreak · exfil |
Smart Contract (Web3)
| Command | What It Does |
|:---|:---|
| /web3-audit <contract.sol> | 10-class smart contract audit with Foundry PoC template |
| /token-scan <contract> | Rug pull scanner — mint authority · LP lock · honeypot · bonding curve |
Session & Utility
| Command | What It Does |
|:---|:---|
| /pickup target.com | Resume from last session — untested endpoints first |
| /intel target.com | CVEs + disclosed reports relevant to this target |
| /chain | Bug A found → finds bugs B and C that chain with it |
| /scope <asset> | Checks if a domain or URL is in scope before you test it |
| /triage | Quick 2-minute go/no-go check |
| /remember | Logs the current finding or technique to hunt memory |
| /memory-gc | Inspect or rotate hunt-memory JSONL files (10 MB cap, 3 backups) |
| /arsenal [tool] | Lists installed external tools or prints an install hint |
What It Finds
<details> <summary><b>26 Web2 Vulnerability Classes</b></summary> <br>| Vulnerability | Typical Payout | |:---|:---| | IDOR / BOLA | $500 – $5K | | Auth Bypass | $1K – $10K | | XSS (Stored / Reflected / DOM) | $500 – $5K | | SSRF | $1
Truncated for display — read the full file on GitHub.
Related Skills
caveman
105.7k🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
claude-mem
93.9kPersistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
Understand-Anything
82.9kGraphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about. Works with Claude Code, Codex, Cursor, Copilot, Gemini CLI, and more.
Agent-Reach
81.9kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
