Three purpose-built tools for bug bounty reconnaissance and vulnerability discovery. Designed to be fast, async, and easy to integrate into your hunting workflow.
š” recon.sh ā Automated Recon Pipeline
Full reconnaissance pipeline in a single command.
./scripts/recon.sh target.com
What it does:
- Subdomain Enumeration ā crt.sh + DNS brute-force (150+ common subdomains)
- DNS Resolution ā Resolve all subdomains to IPs
- Port Scanning ā Top 100 ports via nmap
- URL Discovery ā robots.txt + sitemap.xml extraction
- Technology Detection ā Server headers, X-Powered-By
- Quick Vuln Checks ā .env, .git, phpinfo, admin panels, debug pages
Output:
recon_target.com_20240101/
āāā subdomains/
ā āāā crtsh.txt # crt.sh results
ā āāā bruteforce.txt # DNS brute-force
ā āāā all.txt # Merged + deduped
ā āāā resolved.txt # With IPs
āāā ports/
ā āāā open_ports.txt # Open ports per host
āāā urls/
ā āāā robots.txt # From robots.txt
ā āāā sitemap.txt # From sitemap.xml
ā āāā all.txt # All URLs
āāā tech/
ā āāā headers.txt # Server/X-Powered-By
āāā vulns/
āāā interesting_paths.txt # Exposed paths
š api-fuzzer.py ā REST API Security Fuzzer
Automated API security testing for common vulnerability classes.
python scripts/api-fuzzer.py -u https://api.target.com/v1
Modules:
| Module | What it tests |
|---|---|
| IDOR | Sequential IDs, UUID manipulation, path-based IDs |
| Auth Bypass | X-Forwarded-Host, X-Original-URL, header injection |
| Method Override | X-HTTP-Method-Override, X-HTTP-Method |
| Mass Assignment | Extra fields (role, is_admin, verified, price) |
| Rate Limiting | Missing 429 on auth endpoints |
| Error Messages | Verbose errors, stack traces, SQL errors |
Output:
š Results: 5 findings
š“ CRITICAL: 1
š HIGH: 2
š” MEDIUM: 2
Type Severity Title
----------------------------------------------------------------------
IDOR HIGH Potential IDOR in /api/users?id
AUTH_BYPASS CRITICAL Auth bypass via X-Forwarded-Host
RATE_LIMITING MEDIUM Missing rate limiting: /login
š“ subdomain-takeover.py ā Subdomain Takeover Checker
Check for dangling CNAME records vulnerable to takeover.
python scripts/subdomain-takeover.py -d target.com python scripts/subdomain-takeover.py -f subdomains.txt
Supported Services (15+):
| Service | CNAME Pattern | Bounty Range |
|---|---|---|
| GitHub Pages | *.github.io |
$50-$500 |
| Heroku | *.herokuapp.com |
$100-$500 |
| Shopify | *.myshopify.com |
$500-$2,000 |
| AWS S3 | *.s3.amazonaws.com |
$100-$500 |
| Azure | *.azurewebsites.net |
$200-$1,000 |
| CloudFront | *.cloudfront.net |
$100-$500 |
| Vercel | *.vercel.app |
$50-$200 |
| Netlify | *.netlify.com |
$50-$200 |
| Fly.io | *.fly.dev |
$100-$500 |
| Ghost | *.ghost.io |
$50-$200 |
| Tumblr | *.domains.tumblr.com |
$50-$200 |
| Pantheon | *.pantheonsite.io |
$100-$500 |
| Fastly | *.fastly.net |
$100-$500 |
| Surge.sh | *.surge.sh |
$50-$200 |
| Google Cloud | *.storage.googleapis.com |
$100-$500 |
git clone https://github.com/0xvenatio/security-toolkit.git
cd security-toolkit
pip install aiohttp
chmod +x scripts/recon.shrecon.sh:
curl,jq,nmap,dig(standard Linux tools)
api-fuzzer.py:
aiohttp(Python async HTTP)
subdomain-takeover.py:
aiohttp(Python async HTTP)
Automated security scanning on every push:
- ā Dependency vulnerability check (pip-audit, safety)
- ā Static analysis (Bandit, Semgrep)
- ā Secret detection (TruffleHog)
- ā Container scanning (Trivy)
- ā License compliance
For authorized security testing only. Always obtain permission before testing.
Built by @0xvenatio