🤖 OffSecMentor - AI-Powered Security Learning Assistant

OffSec Community AI Challenge 2025 Submission
An intelligent Discord bot that combines Google Gemini AI, Groq AI, and PayloadsAllTheThings to create an interactive cybersecurity learning platform.

🎯 What It Does

OffSecMentor is a Discord bot that helps cybersecurity learners, pentesters, and bug bounty hunters by:

📚 Instant Payload Access - Fetches real-world payloads from PayloadsAllTheThings (50+ vulnerability categories)
🎓 AI Study Plans - Generates personalized learning roadmaps for any security topic
🧠 Interactive Quizzes - Tests knowledge with MCQ-style security quizzes
📋 Quick Cheatsheets - Provides copy-paste ready payload references
🗺️ Pentest Methodologies - Step-by-step guides for web/network/API pentesting
💬 Context-Aware Chat - Remembers conversation history for natural follow-ups
⚡ Dual AI Fallback - Uses Gemini (primary) + Groq (backup) for 99.9% uptime

🏆 Why This Helps the OffSec Community

Problem It Solves:

Scattered Resources - Security payloads are spread across multiple repos/sites
Learning Curve - Beginners don't know where to start or what to learn next
No Interactive Practice - Most resources are static documentation
Context Switching - Constantly switching between Discord, browser, notes

How OffSecMentor Helps:

✅ All-in-One - Payloads, learning plans, quizzes in Discord (where community already is)
✅ AI-Powered - Smart responses tailored to your question, not generic docs
✅ Interactive - Quizzes, chat memory, and real-time payload generation
✅- Always Available - Dual AI ensures bot never goes down due to rate limits

🚀 Features

1. 📚 Payload Library (50+ Topics)

!payload SQL Injection
!payload XSS
!cheatsheet SSRF

Fetches from PayloadsAllTheThings in real-time (no local download)
AI-enhanced explanations with actual working payloads
Color-coded rich embeds for visual clarity

2. 🎓 AI Study Planner

!studyplan web hacking 7
!studyplan bug bounty 14

Generates day-by-day learning roadmaps
Includes resources, tools, and practice tasks
Customizable duration (1-30 days)

3. 🧠 Interactive Security Quizzes

!quiz SQL Injection
!quiz OWASP Top 10

5 MCQ questions per topic
React with emoji to answer (🅰️ 🅱️ ©️ 🇩)
Instant feedback with explanations

4. 📋 Quick Reference Cheatsheets

!cheatsheet XSS
!cheatsheet Command Injection

Compact, copy-paste ready payloads
No fluff, just code blocks
Perfect for quick reference during CTFs

5. 🗺️ Pentest Methodology Guides

!methodology web
!methodology network

Step-by-step pentest workflows
Recon → Scanning → Exploitation → Post-Exploitation
Includes tools and techniques for each phase

6. 🎯 CTF Challenge Solver

!ctf "Found admin login, tried SQL injection but WAF blocking"
!ctf "File upload allows .php but executes as text"

AI analyzes your CTF challenge
Identifies vulnerability type automatically
Fetches relevant payloads from PayloadsAllTheThings
Provides step-by-step solving strategy
Recommends tools and bypass techniques

7. 💬 Context-Aware Conversations

User: What is SQL injection?
Bot: [explains SQL injection]
User: Show me bypass techniques
Bot: [knows you're asking about SQL injection bypasses]

Remembers last 10 messages per channel
30-minute memory timeout
Natural follow-up questions

8. 🌐 Live CVE/Exploit Database

!cve CVE-2021-44228
!cve_search apache log4j
!latest_cves 5
!exploit log4j
!poc CVE-2021-44228

Real-time CVE data from NVD (National Vulnerability Database)
Color-coded severity embeds (🔴 Critical, 🟠 High, 🟡 Medium, 🟢 Low)
CVSS score with visual bar indicator
Exploit/PoC search via GitHub
Affected products, CWE, references
Smart rate limiting with 24hr cache
50 requests/30s with API key

9. 🕵️ Reconnaissance Tools

!whois google.com
!dnslookup google.com
!techstack google.com
!recon google.com

WHOIS: Domain ownership, registrar, dates, name servers
DNS Lookup: A, AAAA, MX, NS, TXT, CNAME, SOA records
Tech Stack: Server, CDN, CMS, frontend/backend, security headers, SSL info
Full Recon: All three combined with 3 rich embeds
No API keys needed — all free and direct

🤖 How AI is Used

Dual AI Architecture

User Query
    ↓
🟢 Try Gemini 2.0 Flash (Primary)
    ↓ Success → Response
    ↓ Rate Limit/Error
🟡 Fallback to Groq Llama 3.3 70B
    ↓
✅ Response Delivered

AI Enhancements:

Payload Summarization - Converts raw markdown into structured, readable responses
Study Plan Generation - Creates personalized learning roadmaps based on topic
Quiz Creation - Generates contextual MCQ questions with explanations
Methodology Synthesis - Transforms documentation into actionable step-by-step guides
Context Understanding - Uses chat memory for follow-up questions

Why Dual AI?

Gemini - Best quality, but has rate limits (1500 req/day free tier)
Groq - Super fast, generous limits (14,400 req/day), good quality
Result - Bot never goes down, always responds

📦 Installation & Setup

Prerequisites

Python 3.8+
Discord Bot Token (Get here)
Google Gemini API Key (Get here)
Groq API Key (Get here)
GitHub Token (Optional, for higher rate limits - Get here)

Quick Start

Clone the repository

git clone <your-repo-url>
cd bot

Install dependencies

pip install -r requirements.txt

Configure environment variables Create a .env file:

DISCORD_TOKEN=your_discord_bot_token
GEMINI_API_KEY=your_gemini_api_key
GROQ_API_KEY=your_groq_api_key
GITHUB_TOKEN=your_github_token  # Optional

Run the bot

python bot.py

Invite bot to your Discord server Use the OAuth2 URL from Discord Developer Portal with these permissions:

Send Messages
Embed Links
Add Reactions
Read Message History

📖 Command Reference

Command	Description	Example
`!payload <topic>`	Get payloads for a vulnerability	`!payload SQL Injection`
`!topics`	List all 50+ available topics	`!topics`
`!cheatsheet <topic>`	Quick payload reference	`!cheatsheet XSS`
`!cve <CVE-ID>`	Get detailed CVE information	`!cve CVE-2021-44228`
`!cve_search <keyword>`	Search CVEs by keyword	`!cve_search apache log4j`
`!latest_cves [count]`	Get latest published CVEs	`!latest_cves 5`
`!exploit <keyword>`	Search exploits/PoCs	`!exploit log4j`
`!poc <CVE-ID>`	Find PoC exploits for CVE	`!poc CVE-2021-44228`
`!whois <domain>`	WHOIS domain lookup	`!whois google.com`
`!dnslookup <domain>`	DNS records lookup	`!dnslookup google.com`
`!techstack <domain>`	Technology detection	`!techstack google.com`
`!recon <domain>`	Full recon (WHOIS+DNS+Tech)	`!recon google.com`
`!studyplan <topic> [days]`	Generate AI study plan	`!studyplan web hacking 7`
`!quiz <topic>`	Interactive security quiz	`!quiz OWASP Top 10`
`!methodology [type]`	Pentest methodology guide	`!methodology web`
`!ctf <challenge>`	CTF challenge solver	`!ctf Found admin panel, can't login`
`!ask <question>`	Ask anything (auto-includes payloads)	`!ask How does SSRF work?`
`@Bot <message>`	Chat with context memory	`@OffSecMentor explain XSS`
`!aihelp`	Show all commands	`!aihelp`

🎨 Screenshots

Rich Embedded Responses

Color-coded embeds with icons, source links, and AI model attribution

Study Plan Generation

Personalized day-by-day learning roadmap

Interactive Quiz

MCQ questions with emoji reactions

🏗️ Technical Architecture

┌─────────────────────────────────────────────────────────┐
│                    Discord User                         │
└────────────────────┬────────────────────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────────────────────┐
│              Discord Bot (bot.py)                       │
│  ┌─────────────────────────────────────────────────┐   │
│  │  Command Handler + Chat Memory + Embeds        │   │
│  └──────────┬──────────────────────┬─────────────┘   │
└─────────────┼──────────────────────┼──────────────────┘
              │                      │
              ▼                      ▼
┌─────────────────────┐   ┌──────────────────────────┐
│ cheatsheet_module.py│   │   Dual AI Engine         │
│  ┌───────────────┐  │   │  ┌────────────────────┐  │
│  │ Unified Repos │  │   │  │ Gemini (Primary)   │  │
│  │ + Fallback    │  │   │  │ Groq (Fallback)    │  │
│  │ Search        │  │   │  └────────────────────┘  │
│  └───────────────┘  │   └──────────────────────────┘
└─────────────────────┘

Key Components:

bot.py - Main Discord bot logic, commands, embeds, chat memory
cheatsheet_module.py - Unified multi-repo payload fetcher (PayloadsAllTheThings + others)
fallback_search.py - Fallback engine using Google Dork scraping + GitHub Search API
Dual AI - Gemini + Groq with automatic fallback
Chat Memory - Per-channel conversation context (10 messages, 30min timeout)

🔒 Security & Privacy

✅ No Data Storage - Bot doesn't store user messages permanently
✅ Read-Only GitHub Access - Only fetches public PayloadsAllTheThings content
✅ API Key Security - All keys in .env (never committed to Git)
✅ Educational Purpose - All payloads are for authorized security testing only

🤝 Contributing

This bot was created for the OffSec Community AI Challenge 2025. Contributions welcome!

Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit changes (git commit -m 'Add amazing feature')
Push to branch (git push origin feature/amazing-feature)
Open a Pull Request

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

PayloadsAllTheThings - Comprehensive payload repository
Google Gemini - Primary AI model
Groq - Fast AI inference (fallback)
OffSec Community - For hosting this amazing challenge

📞 Contact & Demo

GitHub
Discord
OffSec Account

🏆 OffSec AI Challenge 2025

Submission for: Build with AI - MCPs for the Community
Category: Discord Helper Bot + AI Study Planner
Impact: Helps OffSec learners access payloads, create study plans, and practice interactively - all within Discord
AI Usage: Dual AI (Gemini + Groq) for payload summarization, study plan generation, quiz creation, and context-aware chat

Built with ❤️ for the OffSec Community

Making security learning accessible, interactive, and AI-powered

"# Discord_Bot"

Name		Name	Last commit message	Last commit date
Latest commit History 1 Commit
.env		.env
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
_cmds.txt		_cmds.txt
_cmds2.txt		_cmds2.txt
_cmds3.txt		_cmds3.txt
ai_enhancer.py		ai_enhancer.py
all_cmds.csv		all_cmds.csv
book_knowledge.py		book_knowledge.py
bot.py		bot.py
cheatsheet_module.py		cheatsheet_module.py
config.py		config.py
ctf_labs.py		ctf_labs.py
cve_integration.py		cve_integration.py
fallback_search.py		fallback_search.py
package.json		package.json
privesc_helper.py		privesc_helper.py
recon_tools.py		recon_tools.py
reproduce_ssti.py		reproduce_ssti.py
requirements.txt		requirements.txt
system_prompt.txt		system_prompt.txt
test_ctf.py		test_ctf.py
tools_resources.py		tools_resources.py
topics_cache.json		topics_cache.json
verify_ctf.py		verify_ctf.py
verify_token.py		verify_token.py

License

anand87794/Discord_Bot

Folders and files

Latest commit

History

Repository files navigation

🤖 OffSecMentor - AI-Powered Security Learning Assistant

🎯 What It Does

🏆 Why This Helps the OffSec Community

Problem It Solves:

How OffSecMentor Helps:

🚀 Features

1. 📚 Payload Library (50+ Topics)

2. 🎓 AI Study Planner

3. 🧠 Interactive Security Quizzes

4. 📋 Quick Reference Cheatsheets

5. 🗺️ Pentest Methodology Guides

6. 🎯 CTF Challenge Solver

7. 💬 Context-Aware Conversations

8. 🌐 Live CVE/Exploit Database

9. 🕵️ Reconnaissance Tools

🤖 How AI is Used

Dual AI Architecture

AI Enhancements:

Why Dual AI?

📦 Installation & Setup

Prerequisites

Quick Start

📖 Command Reference

🎨 Screenshots

Rich Embedded Responses

Study Plan Generation

Interactive Quiz

🏗️ Technical Architecture

Key Components:

🔒 Security & Privacy

🤝 Contributing

📜 License

🙏 Acknowledgments

📞 Contact & Demo

🏆 OffSec AI Challenge 2025

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages