Awarexone

Awarexone/Agentic-Bug-Hunter

Command

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Wraps learn.py + hunt memory context. Usage: /intel target.com.

Awarexone/Agentic-Bug-Hunter

Command

JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f].

Awarexone/Agentic-Bug-Hunter

Command

LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url --field message [--category jailbreak].

Awarexone/Agentic-Bug-Hunter

Command

Inspect or rotate hunt-memory JSONL files (audit.jsonl, patterns.jsonl, journal.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

Awarexone/Agentic-Bug-Hunter

Command

NoSQL injection scanner (MongoDB/Mongoose/operator-injection DBs) — auth bypass via $ne/$gt operators, bracket-syntax query injection, $where time-based blind. Usage: /nosqli --login --user-field email --pass-field password.

Awarexone/Agentic-Bug-Hunter

Command

Out-of-band orchestrator — confirm BLIND SSRF/XXE/SQLi/RCE/Log4Shell by correlating interactsh callbacks to the payload that fired them. Usage: /oob --payloads [--class ssrf,sqli] | /oob --listen | /oob --correlate inter.jsonl --payloads-file p.json.

Awarexone/Agentic-Bug-Hunter

Command

Gather employee names + email patterns for password spray prep. Pipeline theHarvester (search engines + CT logs) -> derive names from email local-parts -> username-anarchy expansion. LinkedIn search is opt-in via --with-linkedin. Output -> recon/ /osint/. Usage /osint-employees [--with-linkedin]…

Awarexone/Agentic-Bug-Hunter

Command

Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover | /param-discover -l.

Awarexone/Agentic-Bug-Hunter

Command

Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com.

Awarexone/Agentic-Bug-Hunter

Command

Scan a host for open ports and flag the NON-HTTP services the HTTP-only recon pipeline can't see (SSH, databases, Redis, Docker API, RDP). Usage: /portscan [--top 1000] [-p 22,6379] | /portscan -l hosts.txt.

Awarexone/Agentic-Bug-Hunter

Command

Run the full recon pipeline by invoking tools/reconengine.sh — subdomain enum (subfinder + amass + crt.sh + wayback), httpx live host probing with tech detection, nmap port scan, gau URL collection, JS analysis, ffuf directory fuzzing, parameter discovery, config exposure check, CI/CD workflow scan. Outputs to recon/…

Awarexone/Agentic-Bug-Hunter

Command

Log current finding or successful pattern to hunt memory. Auto-fills from /validate output if available. Usage: /remember.

Awarexone/Agentic-Bug-Hunter

Command

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report.

Awarexone/Agentic-Bug-Hunter

Command

Run Semgrep security rulesets over fetched JS/source and map results into the toolkit's severity + confidence model. Usage: /sast [--config p/xss,p/jwt] [--json].

Awarexone/Agentic-Bug-Hunter

Command

Run a focused nuclei CVE sweep against a host or recon directory, optionally filtered by year. Runs log4j-scan in parallel when installed for legacy enterprise stacks. Usage: /scan-cves [--year 2024] | /scan-cves --recon.

Awarexone/Agentic-Bug-Hunter

Command

Pull every in-scope asset for a bug bounty program across HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi in one shot. Uses bbscope when authenticated, otherwise the public bounty-targets-data dump. Output is one host per line, ready to feed into /recon. Usage: /scope-aggregate [--platform…

Awarexone/Agentic-Bug-Hunter

Command

Check if a target asset is in scope for the program before hunting or submitting. Reads program scope page, checks asset against in-scope and out-of-scope lists, verifies the asset is owned by the target organization. Usage: /scope.

Awarexone/Agentic-Bug-Hunter

Command

Screenshot a list of live hosts for fast visual triage and reusable PoC evidence. Builds a self-contained HTML gallery. Usage: /screenshot -l urls.txt -o shots/ | /screenshot -u https://admin.target.com -o shots/.

Awarexone/Agentic-Bug-Hunter

Command

Hunt leaked credentials in a filesystem path, git history, JS bundles from a recon run, or an entire GitHub org. Wraps trufflehog (verifies live keys against issuer APIs), noseyparker (fast on huge histories), and gitleaks (default rule pack). Falls back to a regex grep if no scanner is installed. Usage: /secrets-hunt…

Awarexone/Agentic-Bug-Hunter

Command

Password spray with hard guards — typed-hostname confirmation, lockout warning, audit log. Modes: http-form (custom login page), oauth (password grant), o365 + okta (via TREVORspray). Default delay 30min/round + 60s jitter. Usage /spray --mode --users --passes.

Awarexone/Agentic-Bug-Hunter

Command

Show ranked attack surface for a target based on recon output + hunt memory. Invokes recon-ranker agent. Usage: /surface target.com.

Awarexone/Agentic-Bug-Hunter

Command

Scan subdomains for takeover candidates (dangling CNAMEs to GitHub Pages, S3, Heroku, Shopify, etc.). Wraps dnsReaper (best signal) and subjack (fast Go fallback). With no scanner installed, runs a built-in fingerprint grep over a curated set of providers. Usage: /takeover | /takeover --recon.

Awarexone/Agentic-Bug-Hunter

Command

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Runs automated tokenscanner.py + manual 8-class audit. Usage: /token-scan [--chain solana].

Awarexone/Agentic-Bug-Hunter

Command

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage.