BugHunter

AI 驱动的漏洞赏金猎取 —— 从侦察到报告，全在你的终端里。
免费设置 · 快速开始 · 命令 · 它能发现什么 · 安装 · 常见问题

BUGHUNTER — 漏洞赏金自动化流水线

由 AwareXone.com 提供支持 — _{您对抗诈骗与欺诈的 AI 代理}

💜 开放赞助

BugHunter 现已开放赞助。 您的支持将用于资助新功能开发，并让免费的独立模式持续为所有人服务。赞助商可以在 README 中展示徽标和链接，并在每次发布中获得致谢。

想赞助？ 请通过 AwareXone.com 联系，或发送邮件至 [email protected]。

这是什么？

一款专业的漏洞赏金猎取工具包，无论是否订阅 Claude 均可使用。给它一个目标——它会处理侦察、测试漏洞、通过严格的门禁验证发现，并为 HackerOne、Bugcrowd、Intigriti 和 Immunefi 撰写可直接提交的报告。

它会记住一切。 在一个目标上发现的模式会为下一个目标提供参考。会话可以从上次中断的地方继续。

既可作为 Claude Code 插件使用，也可作为完全独立的 CLI（bughunter）使用，由免费 AI 提供商驱动。

独立模式 — 无需订阅

你不再需要 Claude Code、Claude Pro 或任何付费 AI 订阅。

只需安装一次，即可在机器上的任何终端中使用 bughunter 命令：```bash git clone https://github.com/shuvonsec/claude-bug-bounty.git cd claude-bug-bounty ./install.sh --agent standalone

拉取更新后重新运行相同命令。安装程序会检测并刷新当前托管的 `bughunter` 命令，包括位于 `/usr/local/bin` 或 `~/.local/bin` 下的旧安装，同时保留你保存在 `~/.bughunter/config.json` 中的提供程序配置。

要卸载独立命令并保留其配置：```bash
./uninstall.sh --agent standalone

使用 --purge-config 还可删除 ~/.bughunter/config.json。卸载程序还支持 claude、opencode、pi、codex、agents 和 all 目标。``` bughunter help # show every command bughunter setup # choose your AI provider (Ollama is free + offline) bughunter recon target.com # map the attack surface bughunter hunt target.com # hunt for vulnerabilities bughunter validate "finding" # 7-Question Gate on your finding bughunter report # write a submission-ready report bughunter chat # interactive AI hunting shell bughunter providers # list all available AI providers bughunter models # list models and show the selected one bughunter status # check which provider is active bughunter h target.com # short alias for hunt bughunter r target.com # short alias for recon bughunter v "finding" # short alias for validate

### 免费 AI 提供商（自动检测，优先免费）

| 提供商 | 费用 | 隐私 | 速度 | 快速开始 |
|:---|:---|:---|:---|:---|
| **Ollama** | 100% 免费 · 本地运行 | 完全隐私 — 数据保留在本地 | 快 | `ollama pull qwen2.5:14b` |
| **Groq** | 提供免费套餐 | 云端 | 非常快 | [console.groq.com](https://console.groq.com) → 获取 API 密钥 |
| **DeepSeek** | 非常便宜（v4-flash / v4-pro） | 云端 | 快 | [platform.deepseek.com](https://platform.deepseek.com) |
| Claude API | 付费 | 云端 | 快 | [console.anthropic.com](https://console.anthropic.com) |
| OpenAI | 付费 | 云端 | 快 | [platform.openai.com](https://platform.openai.com) |
| **Grok (xAI)** | 付费 | 云端 | 快 | [console.x.ai](https://console.x.ai) → `grok-4.5` |
| **OpenRouter** | 订阅 / 按量付费 | 云端 | 快 | [openrouter.ai/keys](https://openrouter.ai/keys) → 获取 API 密钥 |
| **OrcaRouter** | 订阅 / 按量付费 | 云端 | 快 | [orcarouter.ai](https://www.orcarouter.ai) → 获取 API 密钥 |

BugHunter 按以下顺序自动检测提供商：**Ollama → Groq → DeepSeek → … → OrcaRouter → OpenRouter → Claude → OpenAI**

可随时切换提供商或选择已安装的 Ollama 模型：`bughunter setup`。
设置过程也可以完全非交互式：```bash
bughunter setup --provider ollama --model qwen2.5:14b

对于一次性覆盖，请将选项放在命令之前：```bash bughunter --provider ollama --model qwen3:14b hunt target.com

### 零成本完全离线设置```bash
# 1. Install Ollama (runs AI locally, no internet needed after download)
curl -fsSL https://ollama.ai/install.sh | sh
ollama pull qwen2.5:14b          # ~9 GB, one-time download

# 2. Install BugHunter
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone   # creates system-wide 'bughunter' command

# 3. Hunt
bughunter setup       # choose Ollama, then choose one of its installed models
bughunter recon target.com

Groq 设置（免费云端，最快选项）```bash

export GROQ_API_KEY="your-key-here" # free at console.groq.com ./install.sh --agent standalone bughunter setup # choose Groq bughunter hunt target.com

---

## 快速开始

**选项 A — 独立版（无需订阅，适用于所有人）**```bash
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone   # creates system-wide 'bughunter' command
bughunter setup                   # pick a free AI provider
bughunter recon target.com
bughunter hunt  target.com
bughunter validate "my finding"
bughunter report

选项 B — Claude Code 插件 (需要 Claude Code)```bash git clone https://github.com/shuvonsec/claude-bug-bounty.git cd claude-bug-bounty chmod +x install_tools.sh && ./install_tools.sh # subfinder · httpx · nuclei · katana · ffuf chmod +x install.sh && ./install.sh # skills + commands → ~/.claude/

I received no source text to translate. The input chunk appears to be empty. Please provide the Markdown content for chunk 19/41 so I can translate it into Chinese.```bash
claude
/recon target.com        # map the attack surface
/hunt target.com         # test for vulnerabilities
/validate                # run the 7-Question Gate
/report                  # write the submission

选项 C — 让 Claude 安装它 (仅限 Claude Code)

打开你的终端，运行 claude，然后粘贴：```text Install the Claude Bug Bounty toolkit from https://github.com/shuvonsec/claude-bug-bounty into ~/tools/. Clone the repo, run ./install_tools.sh then ./install.sh. Verify /recon /hunt /validate /report are available.

---

## 命令

### 核心工作流

| 命令 | 功能 |
|:---|:---|
| `/recon target.com` | 子域名枚举 · 存活主机探测 · URL 爬取 · nuclei 扫描 |
| `/hunt target.com` | 测试 IDOR · 认证绕过 · SSRF · XSS · SQLi · 逻辑缺陷等 |
| `/validate` | 七问门禁 — 在浪费时间编写报告前淘汰薄弱发现 |
| `/report` | 在 60 秒内生成 H1 · Bugcrowd · Intigriti · Immunefi 提交报告 |
| `/autopilot target.com` | 自主全流程 — 范围界定 → 侦察 → 狩猎 → 验证 → 报告 |

### 侦察与枚举

| 命令 | 功能 |
|:---|:---|
| `/surface target.com` | 基于侦察数据 + 记忆的排序攻击面 |
| `/scope-aggregate <program>` | 聚合 H1 · Bugcrowd · Intigriti · YWH · Immunefi 上的全部范围内资产 |
| `/cloud-recon --keyword <name>` | 公共 S3 · Azure · GCP 存储桶 + 绕过 CloudFlare 的源站 IP |
| `/param-discover <url>` | 通过 Arjun · x8 发现隐藏的 HTTP 参数 |
| `/secrets-hunt --js-bundle <dir>` | 在源码、JS 包或 GitHub 组织中查找泄露的凭据 |
| `/takeover --recon <dir>` | 通过 dnsReaper · subjack 检测子域名接管候选 |
| `/scan-cves <host>` | 针对性的 nuclei 高危/严重级扫描 + 可选的 log4j-scan |
| `/bypass-403 <url>` | 针对 403/401 的请求头 · 方法 · 编码绕过技巧 |
| `/portscan <host>` | 通过 naabu/smap 查找开放端口 + 非 Web 服务（Redis · Docker API · 数据库 · RDP） |
| `/screenshot -l urls.txt` | 将存活主机截图为 HTML 图库 — 用于分类 + PoC 证据 |

### 扫描器（Web + LLM）

| 命令 | 功能 |
|:---|:---|
| `/cors <url>` | CORS 错误配置 — 来源反射 · null · 携带凭据 |
| `/crlf <url>` | CRLF / 响应拆分 + 主机头注入 |
| `/nosqli <url>` | NoSQL 注入（运算符绕过 · `$where` 时间盲注） |
| `/jwt-scan <token>` | 离线 JWT 工具包 — alg:none · RS256→HS256 · 密钥破解 |
| `/oob <target>` | 带外监听器（interactsh），用于盲 SSRF/XXE/SQLi |
| `/sast <path>` | 对获取的 JS/源码运行 Semgrep 安全规则包 → 排序危险函数 |
| `/domxss <url>` | 在无头 Chromium 中确认 DOM XSS — 仅在 payload 实际执行时报告 |
| `/llm-redteam <endpoint>` | LLM 红队语料 — 提示注入 · 越狱 · 数据外泄 |

### 智能合约（Web3）

| 命令 | 功能 |
|:---|:---|
| `/web3-audit <contract.sol>` | 10 类智能合约审计，附带 Foundry PoC 模板 |
| `/token-scan <contract>` | Rug pull 扫描器 — 铸币权限 · LP 锁定 · 蜜罐 · 联合曲线 |

### 会话与工具

| 命令 | 功能 |
|:---|:---|
| `/pickup target.com` | 从上次会话恢复 — 优先处理未测试端点 |
| `/intel target.com` | 与该目标相关的 CVE + 已披露报告 |
| `/chain` | 发现 Bug A → 找出可与之构成攻击链的 Bug B 和 C |
| `/scope <asset>` | 在测试前检查域名或 URL 是否在范围内 |
| `/triage` | 快速 2 分钟通过/不通过检查 |
| `/remember` | 将当前发现或技巧记录到狩猎记忆 |
| `/memory-gc` | 检查或轮换狩猎记忆 JSONL 文件（上限 10 MB，3 个备份） |
| `/arsenal [tool]` | 列出已安装的外部工具或输出安装提示 |

---

## 能发现什么

<details>
<summary><b>26 类 Web2 漏洞</b></summary>
<br>

| 漏洞 | 典型赏金 |
|:---|:---|
| IDOR / BOLA | $500 – $5K |
| 认证绕过 | $1K – $10K |
| XSS（存储型 / 反射型 / DOM 型） | $500 – $5K |
| SSRF | $1K – $15K |
| 业务逻辑 | $500 – $10K |
| 竞争条件 | $500 – $5K |
| SQL 注入 | $1K – $15K |
| OAuth / OIDC | $500 – $5K |
| 文件上传 → RCE | $500 – $10K |
| GraphQL 认证绕过 | $1K – $10K |
| LLM / 提示注入 | $500 – $10K |
| API 错误配置（批量赋值 · JWT · CORS） | $500 – $5K |
| 账户接管 | $1K – $20K |
| SSTI | $2K – $10K |
| 子域名接管 | $200 – $5K |
| 云 / 基础设施暴露 | $500 – $20K |
| HTTP 请求走私 | $5K – $30K |
| 缓存投毒 | $1K – $10K |
| MFA / 2FA 绕过 | $1K – $10K |
| SAML / SSO 攻击 | $2K – $20K |
| 错误信息泄露 / 调试端点 | $200 – $5K |
| CSS 注入 | $500 – $5K |
| LFI → RCE | $1K – $15K |
| 不安全反序列化 | $5K – $30K |
| 依赖混淆 / 供应链 | $1K – $20K |
| Padding Oracle / 加密误用 | $2K – $20K |

</details>

<details>
<summary><b>10 类 Web3 / 智能合约漏洞</b></summary>
<br>

| 漏洞 | 典型赏金 |
|:---|:---|
| 账务失步 | $50K – $2M |
| 访问控制 | $50K – $2M |
| 不完整代码路径 | $50K – $2M |
| Off-By-One | $10K – $100K |
| 预言机操纵 | $100K – $2M |
| ERC4626 份额膨胀 | $50K – $500K |
| 重入 | $10K – $500K |
| 闪电贷攻击 | $100K – $2M |
| 签名重放 | $10K – $200K |
| 代理 / 升级 | $50K – $2M |

</details>

---

## AI 代理

九位专家，各司其职：

| Agent | 职责 |
|:---|:---|
| `recon-agent` | 子域名枚举 · 存活主机发现 · URL 爬取 |
| `report-writer` | 以影响力为先的漏洞报告 — 能获得赏金，而非被标记为 N/A |
| `validator` | 运行七问门禁 — 淘汰薄弱发现 |
| `web3-auditor` | 覆盖 10 类漏洞的智能合约审计 |
| `chain-builder` | 发现 Bug A → 找出可与之构成攻击链的 Bug B 和 C |
| `autopilot` | 带安全检查点的完整狩猎循环 |
| `recon-ranker` | 按最高价值目标优先对攻击面排序 |
| `token-auditor` | Meme 币 / 代币 Rug pull 与安全扫描 |
| `credential-hunter` | 字典生成 → OSINT → 泄露检查 → 喷洒（喷洒前硬性停止） |

---

## 工作原理

<div align="center">```
   You ─▶ /recon ─▶ /hunt ─▶ /validate ─▶ /report
              │                  │
              ▼                  ▼
        Hunt Memory       7-Question Gate
   (persists across    (kills weak findings
       sessions)         before you submit)

流水线中的每个工具都以是否安装为门槛——缺失的工具会被跳过，而不会报错。认证头只需设置一次，便会自动传递给 httpx · katana · ffuf · nuclei · dalfox。

项目结构

点击展开完整目录树

``` claude-bug-bounty/ │ ├── skills/ # AI knowledge bases — loaded as /skill-name │ ├── bug-bounty/ # Master workflow — all vuln classes, LLM testing, chains │ ├── bb-methodology/ # Hunting mindset · 5-phase workflow · session discipline │ ├── web2-recon/ # Subdomain enum · live host discovery · URL crawl │ ├── web2-vuln-classes/ # 26 bug classes with bypass tables │ ├── security-arsenal/ # Payloads · bypass tables · gf patterns │ ├── triage-validation/ # 7-Question Gate · 4 gates · never-submit list │ ├── report-writing/ # Templates for H1 · Bugcrowd · Intigriti · Immunefi │ ├── web3-audit/ # Smart contract bugs · Foundry PoC · 10 bug classes │ ├── meme-coin-audit/ # Rug pull detection · LP attacks · bonding curve │ ├── credential-attack/ # Password spray methodology · legal guardrails │ └── client-reverse/ # Request-signing / anti-bot token reversal │ ├── commands/ # 26 slash commands (/recon /hunt /validate /report …) ├── agents/ # 9 specialized AI agents (recon, validator, reporter …) │ ├── tools/ # Python + shell scanner pipeline (~35 tools) │ ├── hunt.py # Master orchestrator │ ├── recon_engine.sh # Subdomain + URL discovery │ ├── vuln_scanner.sh # XSS · SQLi · SSRF · SSTI probe pipeline │ ├── validate.py # 4-gate finding validator with identity checks │ └── … # 30+ more scanners — see tools/README.md │ ├── memory/ # Cross-session hunt memory (pattern DB · audit log) ├── rules/ # Always-active hunting + reporting rules ├── tests/ # Regression test suite (pytest) ├── web3/ # 13-chapter smart contract audit guide ├── mcp/ # MCP integrations — Burp Suite · Caido · HackerOne API ├── wordlists/ # Curated wordlists + SecLists / PayloadsAllTheThings refs ├── scripts/ # Dork runner · full hunt pipeline ├── hooks/ # Claude Code hook configuration ├── site/ # bughunter.fun landing page ├── demo/ # Local vulnerable target for tutorial recordings │ ├── docs/ # Extended documentation │ ├── advanced-techniques.md # Exploitation techniques + chaining strategies │ ├── auth-sessions.md # Auth header management guide │ ├── payloads.md # Payload reference for common vuln classes │ ├── smart-contract-audit.md# Smart contract audit deep-dive │ ├── TUTORIAL.md # A→Z video tutorial walkthrough │ └── TODOS.md # Open improvement items │ ├── .github/ # GitHub community health files │ ├── CONTRIBUTING.md # How to contribute │ ├── CODE_OF_CONDUCT.md # Community standards │ ├── SECURITY.md # Vulnerability reporting policy │ ├── PULL_REQUEST_TEMPLATE.md │ └── ISSUE_TEMPLATE/ # Bug report · Feature request · False positive │ ├── engine.py # Standalone CLI — 'bughunter' command, no subscription needed ├── brain.py # Multi-provider LLM layer (Ollama · Groq · DeepSeek · Claude · OpenAI) ├── agent.py # LangGraph-style ReAct hunting agent ├── install.sh # Install skills + commands → ~/.claude/ (or standalone mode) ├── install_tools.sh # Install subfinder · httpx · nuclei · katana · ffuf … ├── uninstall.sh # Remove skills + commands from ~/.claude/ ├── uninstall_tools.sh # Remove external scanning tools ├── serve.py # Launch local demo target (python3 serve.py) ├── config.example.json # Auth session config template ├── requirements.txt # Python dependencies ├── CLAUDE.md # Claude Code plugin manifest (auto-loaded) ├── AGENTS.md # Multi-harness plugin guide (OpenCode · Codex · Pi) ├── SKILL.md # Master skill shortcut (auto-loaded by agent harnesses) ├── OPENCODE.md # OpenCode-specific installation guide ├── CHANGELOG.md # Version history ├── FAQ.md # Frequently asked questions └── TERMS.md # Terms of use + authorized testing only ```

安装

先决条件：```bash

macOS

brew install go python3 jq

Linux (Ubuntu/Debian)

sudo apt install golang python3 jq

**扫描工具** (安装 subfinder · httpx · nuclei · katana · ffuf · gau · dnsx · nmap · dalfox 等):```bash
chmod +x install_tools.sh && ./install_tools.sh

独立 bughunter 命令（无需订阅，无需 Claude Code 即可使用）：```bash ./install.sh --agent standalone bughunter setup # choose Ollama (free) · Groq (free tier) · DeepSeek (cheap) · Claude · OpenAI

**AI 技能 + 命令** 集成到 Claude Code：```bash
chmod +x install.sh && ./install.sh

其他智能体框架：```bash ./install.sh --agent opencode # OpenCode ./install.sh --agent pi # Pi Agent ./install.sh --agent codex # Codex ./install.sh --agent all # every supported target

**可选：Chaos API 密钥** （更好的子域名覆盖）```bash
export CHAOS_API_KEY="your-key"
echo 'export CHAOS_API_KEY="your-key"' >> ~/.zshrc

规则

每次会话都执行七条规则，没有例外：

贡献

欢迎提交PR。最有价值的内容：

新的扫描器模块或检测技术
向 skills/security-arsenal/SKILL.md 添加Payload
有付费报告支持的方法论改进
平台支持 (YesWeHack · Synack · HackenProof)```bash git checkout -b feature/your-contribution git commit -m "feat: short description" git push origin feature/your-contribution

---

## 使用方

<p align="center"><i>在其工作流程中使用 BugHunter 的团队和研究人员。</i></p>

<table align="center">
  <tr>
    <td align="center" width="200">
      <a href="https://awarexone.com">
        <img src="https://assets.kitploit.com/production/public/readmes/51067/29e21784cbe8b37142a688801ddd02d4084136effa303a59c67cdd8621e4ac2a/b44baafd696ad5280f1c515671c279895b049b007d04ef2400f00b7eaef441fc-display-v1.webp" alt="AwareXone" width="72"/>
        <br/><b>AwareXone</b>
      </a>
      <br/><sub>AI 智能体对抗诈骗与欺诈</sub>
    </td>
    <td align="center" width="200">
      <a href="ADOPTERS.md">
        <img src="https://img.shields.io/badge/+-Add_your_team-7F55FF?style=for-the-badge" alt="添加你的团队"/>
      </a>
      <br/><sub>提交一行 PR</sub>
    </td>
  </tr>
</table>

<p align="center">
  在你的团队、项目或工作流程中使用 BugHunter？<b><a href="ADOPTERS.md">添加自己</a></b> — 向 <code>ADOPTERS.md</code> 提交一个快速 PR，或打开一个 <a href="https://github.com/shuvonsec/claude-bug-bounty/issues">issue</a>。仅收录真实且可验证的条目。
</p>

---

## Star 历史

<p align="center">
  <a href="https://star-history.dera.page/#shuvonsec/claude-bug-bounty&type=date&legend=top-left">
    <picture>
      <source media="(prefers-color-scheme: dark)" srcset="https://star-history.dera.page/svg?repos=shuvonsec/claude-bug-bounty&type=date&theme=dark&legend=top-left" />
      <source media="(prefers-color-scheme: light)" srcset="https://star-history.dera.page/svg?repos=shuvonsec/claude-bug-bounty&type=date&legend=top-left" />
      <img alt="Star 历史图表" src="https://star-history.dera.page/svg?repos=shuvonsec/claude-bug-bounty&amp;type=date&amp;legend=top-left" width="560" />
    </picture>
  </a>
</p>

---

## 支持

如果 BugHunter 有助于你的漏洞挖掘，你可以为更多此类挖掘提供动力：

<p align="center">
  <a href="https://www.buymeacoffee.com/shuvonsec">
    <img src="https://assets.kitploit.com/production/public/readmes/51067/322a7c99f1dd15a03b3c1b00b0d18ddd87443d80b823d3467a240721ae02357e/37540ef5b455c7e9fd2e680a883fa3eaa5ac7dfe7ea38853db90363dee628a84-display-v1.webp" alt="Buy Me A Coffee" height="50"/>
  </a>
</p>

---

## 致谢

感谢所有为 BugHunter 做出贡献的人。点击任意头像即可打开他们的 GitHub 个人主页。

<p align="center">
  <a href="https://github.com/shuvonsec"><img src="https://assets.kitploit.com/production/public/readmes/51067/3c71ec4e8d747afbf17f2422c15a990e89b1e4c711129890ae2c2ddc0cf33b11/c28f708717c97d5e9032426d44661d39e54cbb0ea831351e3da7862fa89b0266-display-v1.webp" width="48" height="48" alt="shuvonsec" title="shuvonsec"/></a>&nbsp;
  <a href="https://github.com/shuv0n"><img src="https://assets.kitploit.com/production/public/readmes/51067/d1087f300aa2f159be8a3f20f1da3b0d498d1a3b086006f00bba2e96bcafa1ca/3e4e701d8d7199dbc4aa5bfd0872da422c3630a3682e81bd4f00fb4b3eff796a-display-v1.webp" width="48" height="48" alt="shuv0n" title="shuv0n"/></a>&nbsp;
  <a href="https://github.com/letztek"><img src="https://assets.kitploit.com/production/public/readmes/51067/8236747fa6130ad14ab79ca13ad7e1f727530cf03388d5ff69f6522d1202855b/850834b0bcf7305c85e3e2eef40eae2829896eb40992635126a5b518430569e3-display-v1.webp" width="48" height="48" alt="letztek" title="letztek"/></a>&nbsp;
  <a href="https://github.com/bertolikimberly"><img src="https://assets.kitploit.com/production/public/readmes/51067/03de9cce0dd4aa48faa6d9c325d8b68533d34370322e235b459eb7cf8985aba7/610e73a3dd0ebcd37db0f1d16bb7ebf6cc7810df13cbebe65d77871ec3115621-display-v1.webp" width="48" height="48" alt="bertolikimberly" title="bertolikimberly"/></a>&nbsp;
  <a href="https://github.com/venkatas"><img src="https://assets.kitploit.com/production/public/readmes/51067/b8248121001fa656e73d22b66e556f5416729e73c034c3df7e6fd6d178f69c64/2adc3afc7934f533642edb4278fcd3d4ad503b268bc0bd5a5d5cee7828190544-display-v1.webp" width="48" height="48" alt="venkatas" title="venkatas"/></a>&nbsp;
  <a href="https://github.com/adityaax"><img src="https://assets.kitploit.com/production/public/readmes/51067/61029b5a332921d3cf18ee1f45ed1f427923e6e6afe082118104fa9f2ffde0c0/de5f88e6b6618bb8d52d8728c2dad1a3e20822f2d382e341792edf29758d2956-display-v1.webp" width="48" height="48" alt="adityaax" title="adityaax"/></a>&nbsp;
  <a href="https://github.com/BeargleIndustries"><img src="https://assets.kitploit.com/production/public/readmes/51067/2b982731b11d958663f6cd0e2f70004401d97951366a574498718441f4314048/0cee9f5a6efcd85c280bd743ededb88faa88ed95b04ecb8966c302f7aa3065ec-display-v1.webp" width="48" height="48" alt="BeargleIndustries" title="BeargleIndustries"/></a>&nbsp;
  <a href="https://github.com/ultra-supara"><img src="https://assets.kitploit.com/production/public/readmes/51067/c6d39ef6033dbeac0f1ed6bdbca50a78aa2f7b6cf92ef3270fda4163eb45e7c6/caae781831ae9859baa23bdbc1048e2ea737179d71af9e6f126644d53a111129-display-v1.webp" width="48" height="48" alt="ultra-supara" title="ultra-supara"/></a>&nbsp;
  <a href="https://github.com/AurisDSP"><img src="https://assets.kitploit.com/production/public/readmes/51067/faa96c27e7d0493d309fee7b94e79aed51b991d83f17a44f605d22e2657691f0/50c186ab21c94f2b974570ebf01f896c770a361ab066e25338625993193d5604-display-v1.webp" width="48" height="48" alt="AurisDSP" title="AurisDSP"/></a>&nbsp;
  <a href="https://github.com/Edneam"><img src="https://assets.kitploit.com/production/public/readmes/51067/e1a7a36a04544478fa1984f793aa3cea48f8a51bb090ce74a28e13334aafa6ab/bb9611fa7eeb5ebb5e58ae2a2cd4103c7bdf917f9191babf517d83f1eb5a6852-display-v1.webp" width="48" height="48" alt="Edneam" title="Edneam"/></a>&nbsp;
  <a href="https://github.com/depapp"><img src="https://assets.kitploit.com/production/public/readmes/51067/3156944f4894fdd30b89baf215623103e46a7481c2858849d76016d17169c5ba/d8b617a44887e6737983e20cff14f61af07d18706bf0e3752ffeae54f5a7cc8b-display-v1.webp" width="48" height="48" alt="depapp" title="depapp"/></a>&nbsp;
  <a href="https://github.com/Realgagenichols"><img src="https://assets.kitploit.com/production/public/readmes/51067/422e70caa8cce448ca55f0a63c0d7620f721b53821309c0291242ad0e4ff2043/9ce2cb2bd457ba0b88efca09db59c1264da78e7b854bb96352514aac13183d90-display-v1.webp" width="48" height="48" alt="Realgagenichols" title="Realgagenichols"/></a>&nbsp;
  <a href="https://github.com/thuvh"><img src="https://assets.kitploit.com/production/public/readmes/51067/1dc37fcd3ddadd6b175572a34e2c86c44aedbc97fba2d79a1809a65aa4dce155/5a8b7a48be2c5e81eff7134f4d3f42b6e3ef9d4da35f88e87e99d129aa874859-display-v1.webp" width="48" height="48" alt="thuvh" title="thuvh"/></a>&nbsp;
  <a href="https://github.com/onlybugs05"><img src="https://assets.kitploit.com/production/public/readmes/51067/f529bc0c7273b2e98e26352bb1a174c515dee670826bdf519240b63774f05b33/a89875927c1da3655d8c5880c93d1b13c30af04928b7a8335c4bb57e7a2f858d-display-v1.webp" width="48" height="48" alt="onlybugs05" title="onlybugs05"/></a>&nbsp;
  <a href="https://github.com/savioruz"><img src="https://assets.kitploit.com/production/public/readmes/51067/362ee5f394d18365f33beae9d4e24b1f54a3bb299ceaa69aad6476c7912add35/fadecab17667be841099372f346c2892398fc55069a8d6c9e7c1031745fa92e9-display-v1.webp" width="48" height="48" alt="savioruz" title="savioruz"/></a>&nbsp;
  <a href="https://github.com/Paebak"><img src="https://assets.kitploit.com/production/public/readmes/51067/0f26c58b1801e41175d39ad5df2ed02574c2bbff6e72a0999f278a962aaf9a2e/56ab94c06cf38bfc7c83550efc5b06597a135c4855b2f3122a79e9c493ef5310-display-v1.webp" width="48" height="48" alt="Paebak" title="Paebak"/></a>&nbsp;
  <a href="https://github.com/nurazhardotcom"><img src="https://assets.kitploit.com/production/public/readmes/51067/3af62ef52780b5fac95a8b00db8fb562b8d03bf151a4a34c51dd4df37d47b4ab/e29f4b8a62da7772a4fbf0d385cc827efa746d74ec6cdc4f854c217e3d3b539d-display-v1.webp" width="48" height="48" alt="nurazhardotcom" title="nurazhardotcom"/></a>&nbsp;
  <a href="https://github.com/SeekAndExploit"><img src="https://assets.kitploit.com/production/public/readmes/51067/943bffd56ab7cd823f6226ba45e1b2d8bfb24e2c705cf7285cd30c12d54b4d29/50579361c6456568868e787108a75c019b117b43e79ad16bfb43546876ffb1f1-display-v1.webp" width="48" height="48" alt="SeekAndExploit" title="SeekAndExploit"/></a>&nbsp;
  <a href="https://github.com/Shawanga"><img src="https://assets.kitploit.com/production/public/readmes/51067/2f168dbf41d11829183809a1ada43bd407eb789ca322351b72544e9d8d689490/161721c856e5630413a4d7dabf33e2aadec45ff7a97f101952bbeeef8fff1b11-display-v1.webp" width="48" height="48" alt="Shawanga" title="Shawanga"/></a>&nbsp;
  <a href="https://github.com/zeze-zeze"><img src="https://assets.kitploit.com/production/public/readmes/51067/6712b474717b9a0d31df50db07c0679323d745992e6905ef146ba93f059f1a0e/ea68d492a788a174c59ee241475e4ec6ba168ef8671359c2af6dc0db53d2aa7f-display-v1.webp" width="48" height="48" alt="zeze-zeze" title="zeze-zeze"/></a>&nbsp;
  <a href="https://github.com/grave0x"><img src="https://assets.kitploit.com/production/public/readmes/51067/b177d7f1eb1e5f5f4ea6b0f01927068568d92feeb450c3588da3eb4ee444be3f/997770039b73abeb34cfa1bf34430cdd81e54b96626c1d856317711f6e55a15f-display-v1.webp" width="48" height="48" alt="grave0x" title="grave0x"/></a>&nbsp;
  <a href="https://github.com/kevinaimonster"><img src="https://assets.kitploit.com/production/public/readmes/51067/eebb78e8387a8f45d69ee11489aa55bcefe42e934c61b6200470d4b3f8b8bc03/4dbb85af058868212ac2306d2ecd5f376ae81eb8faed80e96d9144193aea57c8-display-v1.webp" width="48" height="48" alt="kevinaimonster" title="kevinaimonster"/></a>
</p>

---

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/51067/d32053d974d60dcec5ad625a665f0d22dbbddbc152b6d1184ad7b3774f0839e0/85e958d2288223e9020199c1ab154ead84e0e2170b64e9c21ce4ea15d6830014-display-v1.webp" alt="BugHunter" width="48"/><br>
  <a href="https://github.com/shuvonsec">GitHub</a>
  ·
  <a href="https://x.com/shuvonsec">Twitter</a>
  ·
  <a href="mailto:[email protected]">[email protected]</a><br>
  <b>由漏洞猎人打造，为漏洞猎人而生。</b><br>
  <sub>MIT 许可证 · 仅限授权的安全测试。请始终在经批准的漏洞赏金项目范围内进行测试。</sub>
</p>

<p align="center">
  <a href="https://awarexone.com">
    <img src="https://assets.kitploit.com/production/public/readmes/51067/29e21784cbe8b37142a688801ddd02d4084136effa303a59c67cdd8621e4ac2a/b44baafd696ad5280f1c515671c279895b049b007d04ef2400f00b7eaef441fc-display-v1.webp" alt="AwareXone" width="56"/>
  </a>
  <br/>
  <sub>由 <a href="https://awarexone.com"><b>AwareXone.com</b></a> 提供支持 · 你抵御诈骗与欺诈的 AI 智能体</sub>
</p>

1	先阅读完整范围	只测试程序授权的内容
2	只报告真实漏洞	“攻击者现在就能做到吗？” — 如果不能，停止
3	剔除弱发现	30秒的检查能节省数小时的无效报告
4	绝不超出范围	一个错误请求就可能让你被封禁
5	5分钟规则	5分钟后没有进展？继续前进
6	报告前先验证	在花30分钟撰写报告前，先执行 `/validate`
7	影响优先	先测试后果最严重的漏洞

bug-hunter

最受欢迎