Bug bounty hunting system: recon pipeline (13 phases, 21 tools), H1 Hacktivity Intelligence System (1,200+ disclosed reports mined for patterns), 58 hunt skills (one per vuln class), sibling predictor (cross-program vulnerability forecasting), adversarial validation gate, and MCP server fleet. Give it a domain, get findings backed by real-world intelligence.
# 1. Install everything
curl -sL https://raw.githubusercontent.com/bswxyz/bbhunter/main/install.sh | bash
# 2. Start a hunt session
cd ~/.bugbounty
# 3. Pull fresh H1 intelligence (first time)
node scripts/pull-all-hacktivity.cjs targets/_shared/knowledge/all-reports/raw-recent.jsonl 50 30 recent
node scripts/mine-patterns-v2.cjs targets/_shared/knowledge/all-reports/raw-corpus.jsonl targets/_shared/knowledge/all-reports/
node scripts/generate-session-brief.cjs
# 4. Predict what bugs your target probably has
node scripts/sibling-predict.cjs target.com
# 5. Run recon + hunt
bbhunter recon target.com
bbhunter hunt target.com ┌─────────────────────────────┐
│ H1 HACKTIVITY INTELLIGENCE │
│ Daily cron: pull → mine → │
│ brief → inject at session │
│ start. 1,207 reports. │
└──────────────┬──────────────┘
│
▼
┌──────────┐ ┌──────────┐ ┌──────────────────────┐
│ RECON │───▶│ INTEL │───▶│ SIBLING PREDICTOR │
│ 13 phases│ │ MEMORY.md│ │ "Programs like this │
│ 21 tools │ │ injected │ │ had RCE, ATO, SSRF" │
└──────────┘ └──────────┘ └──────────┬───────────┘
│
▼
┌──────────────────────────┐
│ 58 HUNT SKILLS │
│ Loaded in priority order │
│ based on sibling intel │
└──────────┬───────────────┘
│
▼
┌──────────────────────────┐
│ ADVERSARIAL VALIDATION │
│ P8 → P9 → P10 gate │
└──────────────────────────┘
This is what makes v2 different. Before you send a single request, you know what bug classes similar programs paid for, which parameters are most exploitable, and what attack chains work.
| File | Contents |
|---|---|
all-reports/raw-corpus.jsonl |
1,207 disclosed H1 reports (all severities, merged + deduped) |
all-reports/patterns-v2.json |
Full intelligence: class distribution, top params, chains, tech mapping, sibling programs |
all-reports/parameters.json |
Ranked vulnerable parameters with real report examples |
all-reports/chains.json |
Attack chain patterns (e.g. LFI→RCE, IDOR→ATO) with examples |
all-reports/tech-stack.json |
Technology → vulnerability class mapping |
all-reports/PATTERNS-V2.md |
Human-readable hunting guide |
critical-reports/KB.md |
Refined critical-only intelligence (992 reports) |
# Pull disclosed reports from H1's anonymous GraphQL (no auth needed)
node scripts/pull-all-hacktivity.cjs <out.jsonl> <perPage> <maxPages> [all|recent|critical]
# Mine patterns from the corpus
node scripts/mine-patterns-v2.cjs <raw.jsonl> <outdir>
# Predict vulnerabilities for any target
node scripts/sibling-predict.cjs <program-or-type> [--top N] [--json]
# Generate session-start hunting brief
node scripts/generate-session-brief.cjs
# Wire KB intelligence into hunt skills
node scripts/enrich-skills.cjsBefore hunting ANY target, run this. It tells you what to look for based on real disclosed reports from similar programs:
# Exact program match
node scripts/sibling-predict.cjs snapchat
# By program type (for targets not in the corpus)
node scripts/sibling-predict.cjs "fintech / payments"
node scripts/sibling-predict.cjs "social media"
node scripts/sibling-predict.cjs "e-commerce / marketplace"
node scripts/sibling-predict.cjs "devtools / SaaS"
node scripts/sibling-predict.cjs "gaming"
node scripts/sibling-predict.cjs "crypto / web3"
node scripts/sibling-predict.cjs "enterprise SaaS"Output example for snapchat:
🎯 PREDICTED VULNERABILITY CLASSES:
1. RCE (16% confidence, 9 siblings have this)
2. LFI / Path Traversal (1%, 3 siblings)
3. HTTP Smuggling (1%, 2 siblings)
4. SSRF (1%, 2 siblings)
5. SQL Injection (1%, 2 siblings)
🧬 SIMILAR PROGRAMS:
shopify-scripts [99.8% similar] → Struct type confusion RCE ($18K)
Acronis [99.7% similar] → log4j RCE
Mozilla [98.1% similar] → GraphQL RCE ($12K)
| Schedule | What it does |
|---|---|
| Daily 8:07 AM | Pull recent 90-day disclosures → merge → re-mine → regenerate MEMORY.md |
| Weekly Sunday 9:23 AM | Deep pull all severities (60 pages) → full re-mine → new session brief |
Every Claude Code session starts with the Harness Protocol (from CLAUDE.md):
1. Start MCP servers → ~/.bugbounty/mcp-servers/start-all.sh start
2. Inject memory → reads targets/_shared/MEMORY.md (auto-generated hunting brief)
3. Predict siblings → node sibling-predict.cjs <target> (top 5 classes + sibling bugs)
4. Route models → DeepSeek (recon) → Codex (hunting) → Claude (validation)
5. Validate → P8/P9/P10 adversarial gate
6. Write everything → leads, gadgets, findings → targets/<program>/
Or just type /memory-inject — it does steps 2-3 automatically.
| # | Phase | Tools |
|---|---|---|
| 1 | Passive Subdomain Enum | subfinder assetfinder crt.sh amass |
| 2 | Active DNS Bruteforce | puredns gotator |
| 3 | Infrastructure Mapping | asnmap mapcidr dnsx |
| 4 | WAF Detection & Origin IP | wafw00f Shodan SecurityTrails |
| 5 | DNS Resolution & Live Hosts | dnsx httpx gowitness |
| 6 | Virtual Host Enumeration | ffuf |
| 7 | URL & Endpoint Discovery | waybackurls gau katana gospider |
| 8 | JavaScript Analysis | trufflehog regex secret extraction |
| 9 | Directory Fuzzing | ffuf |
| 10 | GitHub Intelligence | gh gitleaks |
| 11 | Port Scanning | naabu nmap |
| 12 | Nuclei Vulnerability Scan | nuclei |
| 13 | Subdomain Takeover | dnsx subzy s3scanner |
bbhunter recon target.com # Full pipeline (~20 min)
bbhunter recon target.com --fast # Quick sweep (~8 min)
bbhunter recon target.com --deep # Exhaustive + aggressive bruteEvery vuln class gets its own skill, each built from real disclosed reports:
Tier 1 — Critical Priority:
hunt-rce hunt-ato hunt-auth-bypass hunt-ssrf hunt-sqli hunt-ssti hunt-deserialization
Tier 2 — High Value:
hunt-idor hunt-business-logic hunt-xss hunt-race-condition hunt-file-upload hunt-privilege-escalation
Tier 3 — Test With Validated Impact:
hunt-oauth hunt-jwt-crypto hunt-saml hunt-graphql hunt-xxe hunt-lfi hunt-csrf hunt-open-redirect hunt-host-header hunt-session hunt-mfa-bypass hunt-forgot-password
Platform-Specific:
hunt-aspnet hunt-laravel hunt-nextjs hunt-nodejs hunt-springboot hunt-sharepoint hunt-k8s hunt-cloud-misconfig hunt-cicd
Specialized:
hunt-grpc hunt-websocket hunt-http-smuggling hunt-cache-poison hunt-nosqli hunt-ldap hunt-llm-ai hunt-llm-injection hunt-rag-vector hunt-dom hunt-html-injection hunt-source-leak hunt-api-misconfig hunt-shadow-api hunt-spa-api hunt-subdomain hunt-cors hunt-clickjacking hunt-captcha-bypass hunt-brute-force hunt-tls-network hunt-ntlm-info hunt-exceptional-conditions hunt-misc
Skills are enriched with real 2026 disclosed patterns from the H1 corpus. Regenerate with:
node scripts/enrich-skills.cjs~/.bugbounty/
├── bbhunter # Main CLI
├── scripts/ # Intelligence + automation scripts
│ ├── pull-all-hacktivity.cjs # Universal H1 corpus puller
│ ├── mine-patterns-v2.cjs # Enhanced pattern miner
│ ├── sibling-predict.cjs # Cross-program vuln predictor
│ ├── generate-session-brief.cjs # Session MEMORY.md generator
│ ├── enrich-skills.cjs # Wire KB into hunt skills
│ ├── distill-kb.cjs # Pattern distiller (legacy)
│ ├── refine-kb.cjs # KB refiner (legacy)
│ └── ... # GraphQL probes, JS miners, etc.
├── targets/
│ └── _shared/ # TRACKED IN GIT — shared intelligence
│ ├── MEMORY.md # Auto-generated session brief
│ └── knowledge/
│ ├── all-reports/ # v2 intelligence (all severities)
│ └── critical-reports/ # Legacy 992 critical KB
├── mcp-servers/ # 4 MCP servers
│ ├── h1-bugcrowd/ # H1 + Bugcrowd intel
│ ├── evidence-vault/ # Structured PoC storage
│ ├── scope-monitor/ # Scope enforcement
│ └── oob-server/ # OOB/SSRF callback listener
├── loop/ # Autonomous hunt loop
├── memory/ # Cross-session memory
├── metrics/ # Model performance tracking
└── otp/ # OTP interception (MFA bypass testing)
bbhunter install Install all dependencies
bbhunter recon <target> Run complete recon pipeline
bbhunter hunt <target> Start automated hunting
bbhunter report <target> Generate findings summary
bbhunter status System health check
bbhunter dashboard Open MCP server dashboard
bbhunter update Update all tools + nuclei templates
bbhunter help Full helptargets/<program>/
├── recon/<timestamp>/ # Recon output (see GUIDE.md for full tree)
├── notes/ # Observations, tech stack, behaviors
├── leads/ # Potential vulns (not confirmed)
├── gadgets/ # Reusable primitives (tokens, endpoints)
├── findings/ # Confirmed vulns with PoC
└── reports/ # Formatted reports ready to submit
New to BBHUNTER? The GUIDE.md runs through a complete engagement — every phase, every output file, how to triage results, and how to go from recon to a validated finding. Start there.
"PC or GTFO." — Proof of concept or it doesn't exist.
Never report a theoretical vulnerability. Never stop at "this looks like it might be vulnerable." Exploit it. Prove the impact. Then report it.
Data-driven hunting. The hunters who earn consistently are not smarter than you — they study what worked, apply it to new targets, and chain bugs relentlessly. The H1 intelligence system automates the "study what worked" part so you can focus on execution.
MIT — bswxyz
Built for authorized bug bounty hunters. Run responsibly. Stay in scope.