Skip to content

Home

Jump to bottom
shuvonsec edited this page Mar 27, 2026 · 2 revisions

claude-bug-bounty

This is a tool built to run bug bounty hunting from the terminal using Claude Code. It handles recon, scans for about 20 vulnerability classes, has an autonomous hunting mode, and puts together a proper report at the end.

The idea came from getting tired of jumping between five different tools during a hunt. This wraps all of it into one workflow so you can focus on the actual finding instead of the setup.

What it does

  • Subdomain enumeration, URL crawling, and live host detection
  • Scans for SQLi, XSS, SSRF, IDOR, SSTI, open redirects, file upload bypass, CORS issues, and more
  • Checks auth flows for MFA/2FA bypass, SAML/SSO weaknesses, and session handling problems
  • Autonomous hunting mode where an LLM reasons through recon output and decides what to probe next
  • Generates a clean HTML report (Burp-style) that you can actually submit to a bug bounty program

Getting started

git clone https://github.com/shuvonsec/claude-bug-bounty
cd claude-bug-bounty
python3 hunt.py --target example.com --quick

For a full autonomous hunt with a 2-hour time budget:

python3 hunt.py --target example.com --autonomous --time 2

Supported target formats

python3 hunt.py --target example.com        # domain
python3 hunt.py --target 192.168.1.100      # single IP
python3 hunt.py --target 10.0.0.0/24        # CIDR range

LLM backends

By default it uses Ollama locally so you do not need any API keys. If you want to use a cloud model instead:

export BRAIN_PROVIDER=claude
export ANTHROPIC_API_KEY=your-key-here
python3 hunt.py --target example.com

Supported providers: Ollama (local, default), Claude, OpenAI, Grok. It auto-detects in that order and falls back if the primary is unavailable.

Scripts overview

Script What it does
hunt.py Main entry point, orchestrates the full hunt
recon_engine.sh Subdomain enum, URL discovery, live host check
vuln_scanner.sh Runs all vuln checks (20+ classes)
brain.py LLM reasoning layer for triage and next-step decisions
agent.py Autonomous ReAct loop that drives the hunt end-to-end
report_generator.py Builds the final HTML and Markdown report

Watching a live hunt

The agent writes an append-only event log you can tail in real time:

tail -f recon/example.com/sessions/<id>/agent_trace.jsonl

You can also inject guidance mid-run without stopping the agent:

echo "focus on /api/v2/ endpoints" > agent_bump.txt

Resuming a session

If a hunt gets interrupted it saves full state to disk. Resume it with:

python3 agent.py --target example.com --resume SESSION_ID

Contributing

PRs are welcome. If you add a new vuln check or improve an existing one, include a brief description of what it tests and how to verify it. Check open issues and PRs before starting so you are not doubling up on something already in progress.

Clone this wiki locally