AI-powered bug bounty hunting toolkit that works with or without subscription.
Command
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal.
Command
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo].
Command
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> -ranked.txt. Usage /breach-check [--min-count N] [--max-count N] [--with-counts].
Command
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 | /bypass-403 -l.
Command
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain.
Command
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloudenum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage: /cloud-recon --keyword | /cloud-recon…
Command
Scan an endpoint for CORS misconfiguration — arbitrary-origin reflection, null-origin trust, credential exposure, suffix/prefix regex bypass, scheme downgrade. Usage: /cors [--cookie "session=..."] | /cors -l urls.txt.
Command
Test for CRLF / HTTP response-splitting and host-header injection — Set-Cookie injection, cache poisoning, reset-poisoning. Usage: /crlf [--host-header] | /crlf -l urls.txt.
Command
Confirm DOM XSS in a real headless browser — injects canary payloads into params + URL fragment and only reports when the browser actually executes them. Usage: /domxss " " [--params q,name] [--shot out.png].
Command
Active vulnerability hunt against a target by invoking tools/hunt.py (which calls vulnscanner.sh against recon/ /). Auto-runs recon first if no recon dir exists. Usage: /hunt target.com.
Command
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Wraps learn.py + hunt memory context. Usage: /intel target.com.
Command
JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static claim analysis. Usage: /jwt-scan [--analyze|--alg-none|--confuse --public-key pub.pem|--crack --wordlist f].
Command
LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url --field message [--category jailbreak].
Command
Inspect or rotate hunt-memory JSONL files (audit.jsonl, patterns.jsonl, journal.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
Command
NoSQL injection scanner (MongoDB/Mongoose/operator-injection DBs) — auth bypass via $ne/$gt operators, bracket-syntax query injection, $where time-based blind. Usage: /nosqli --login --user-field email --pass-field password.
Command
Out-of-band orchestrator — confirm BLIND SSRF/XXE/SQLi/RCE/Log4Shell by correlating interactsh callbacks to the payload that fired them. Usage: /oob --payloads [--class ssrf,sqli] | /oob --listen | /oob --correlate inter.jsonl --payloads-file p.json.
Command
Gather employee names + email patterns for password spray prep. Pipeline theHarvester (search engines + CT logs) -> derive names from email local-parts -> username-anarchy expansion. LinkedIn search is opt-in via --with-linkedin. Output -> recon/ /osint/. Usage /osint-employees [--with-linkedin]…
Command
Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover | /param-discover -l.
Command
Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com.
Command
Scan a host for open ports and flag the NON-HTTP services the HTTP-only recon pipeline can't see (SSH, databases, Redis, Docker API, RDP). Usage: /portscan [--top 1000] [-p 22,6379] | /portscan -l hosts.txt.
Command
Run the full recon pipeline by invoking tools/reconengine.sh — subdomain enum (subfinder + amass + crt.sh + wayback), httpx live host probing with tech detection, nmap port scan, gau URL collection, JS analysis, ffuf directory fuzzing, parameter discovery, config exposure check, CI/CD workflow scan. Outputs to recon/…
Command
Log current finding or successful pattern to hunt memory. Auto-fills from /validate output if available. Usage: /remember.
Command
Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report.
Command
Run Semgrep security rulesets over fetched JS/source and map results into the toolkit's severity + confidence model. Usage: /sast [--config p/xss,p/jwt] [--json].