Skip to content

BountyForge v3.0.0 — Zero-Day Hunting Engine AI skill

Latest
Latest

Choose a tag to compare

View all tags
@Jeffreyxdev Jeffreyxdev released this 06 Aug 04:31
· 11 commits to main since this release
v3.0.0
b20ba7e

BountyForge v3 is a major jump: the skill goes from checklist auditing to capability-first zero-day hunting, and ships a full autonomous tooling suite plus the AI Pentesting Tool at bountyforge.xyz.

New in v3.0.0

Zero-Day Hunting Methodology

  • references/attack-vectors/zerodays.md — the v3 mindset. Stop hunting bug classes; hunt capabilities (primitives you control). Map how capabilities chain across trust boundaries — the parameter that becomes a header that reaches an internal service that trusts all headers.
  • references/attack-vectors/spel-injection-vectors.md — SpEL injection WAF bypass → RCE playbook (Spring Boot Whitelabel error page, ${7*7} → 49 → T(java.lang.Runtime) RCE).

Specialist Agents

  • rogue-agent.md — the last-resort agent that goes where nobody else looks: dev workflow exploitation (CI/CD secret injection, dependabot hijack, git hook poisoning), internal tooling, misconfigs-as-bugs.
  • waf-bypass-agent.md — WAF/CDN fingerprinting + bypass techniques to deliver payloads when other agents confirm a vuln but are blocked.

Autonomous Tooling Suite (19 local tools)

The v2.1.0 orchestration (hunt.py + recon_engine.sh) is now a full agent infrastructure:

Tool What it does
trust_map.py Directed trust graph across target nodes; fires chain signals across boundaries
refutation.py Spawns an adversarial model to kill your findings through the 4-gate evaluation
capability_registry.py Structured catalog of every discovered primitive + chain compatibility matching
program_fit.py Program scope/severity gate — filters noise before report generation
ledger.py Evidence verifier — you can't claim what you didn't test
agent_bus.py Cross-agent signal passing for autonomous chain building
adversary_emulation.py Maps actions to MITRE ATT&CK, OWASP Top 10, OWASP LLM, CAPEC
kill_chain.py Builds full attack chains from confirmed Low+Medium+Low bugs
exploit_gen.py Weaponized PoCs → curl, Python, Burp, Metasploit, Foundry, Nuclei
formal_verify.py Certora CVL / Medusa / Echidna / Foundry harness generation
fleet.py Parallel multi-target hunting with a shared triage queue
chain_of_custody.py BLAKE3-hashed, tamper-proof evidence audit trail
crypto_vault.py AES-256-GCM artifact store + age-encrypted report bundles
opsec.py UA rotation, Tor SOCKS5, TLS fingerprint (JA3/JA4) randomization
patch_gap.py CVE disclosure → PoC auto-fetch and retarget
threat_intel.py Hacktivity/CVE/ransomware/darknet monitoring to prioritize targets
retest_scheduler.py Auto-retest on scope changes, dependency updates, new CVEs
infra_deploy.py Self-hosted interactsh/OOB callback infra with auto-teardown
state.py JSONL session state engine (sessions, journals, endpoints, findings)

AI Pentesting Tool — bountyforge.xyz

The same engine is now available as isolated cloud pentesting sandboxes:

  • Firecracker microVM per session — your AI key, your box, your report
  • Full recon → hunt → triage → H1-ready report pipeline, no setup
  • No rate limits — run clean hunts without burning your own infra

AI slop gets you rate-limited. BountyForge gets you paid. → bountyforge.xyz

Changed

  • VERSION bumped 2.0.1 → 3.0.0
  • 28 files changed, ~12,000 lines added
  • SKILL.md restructured with the v3 tool tables and new agents integrated into the pipeline

Full Changelog: v2.0.0...v3.0.0

Assets 2
Loading