Deno Roy

Posted on Nov 7

Building Your Own Hermes AI Hacking Agent: A Complete Setup Guide

#ai #programming #security #api

Why Most Guides Get This Wrong

Most "AI hacking agent" tutorials throw you into a wall of commands. You copy-paste half of it, miss a critical step, and end up with a very expensive chatbot that occasionally runs curl. The problem isn't the tools it's the sequence. This guide follows the actual order things need to happen, from infrastructure to automation.

The goal here is to build a Hermes AI Agent for ethical hacking, reconnaissance, and bug bounty automation, then give it specialized security skills one milestone at a time.

A quick note before we start: this guide follows a widely shared architecture and workflow, but it doesn't independently verify every installation command, provider, or feature. Always check the current official documentation before executing anything.

Phase 1: Infrastructure

Choosing a VPS

You need a Linux VPS that can run Hermes and your security tools. A solid starting configuration:

Component	Recommended
OS	Ubuntu 24.04 LTS
CPU	2 vCPU
RAM	8 GB
Storage	100 GB SSD
Access	SSH
Architecture	x86_64

Any compatible provider works. The important part is having a real Linux box with enough resources not which company's logo is on the invoice.

Purchasing and Configuring the Server

Open your VPS provider
Select a plan
Choose Ubuntu 24.04
Select your server region
Set a strong root password
Complete deployment
Copy your VPS public IP address

Connecting via SSH

Open PowerShell, Windows Terminal, or a Linux terminal:

ssh root@YOUR_VPS_IP

Enter your password, then update the system and install the basics:

apt update && apt upgrade -y
apt install -y curl wget git unzip nano tmux

Checkpoint: You should now have access to your Ubuntu VPS.

Phase 2: Installing Hermes Agent

Installation

Visit the official Hermes Agent documentation and follow its current Ubuntu installation instructions. Once installed, launch it:

hermes

Complete the initial setup wizard.

Configuring Your AI Model

You'll need an API provider account, an API key, a model identifier, and provider configuration. Model choices typically fall into these categories:

Model Category	Intended Use
Fast/cheap model	Reconnaissance and routine tasks
Strong reasoning model	Vulnerability analysis
Strong coding model	Script generation
Independent validation model	Reviewing findings

Two things worth emphasizing. First, keep API keys in environment variables or the agent's secure credential configuration — never paste them into public skills or GitHub repositories. Second, don't assume free models are suitable for security testing. Evaluate reliability first.

Phase 3: Connecting Telegram

Creating the Bot

Open Telegram and search for @BotFather
Send /newbot
Enter your bot's display name
Enter a unique username ending in bot
Copy the generated Telegram Bot Token

Never share this token. Anyone who gets it can control your bot.

Getting Your Telegram User ID

Search for @userinfobot on Telegram
Start the bot
Copy your numerical Telegram user ID

Wiring It All Together

Return to your VPS and run:

hermes

Open the gateway/channel configuration through the setup wizard:

Select Telegram
Choose manual configuration
Enter your Telegram Bot Token
Enter your Telegram user ID as the authorized user
Save the configuration
Restart the gateway using the documented service instructions

Test by sending: "Hello, who are you?"

Checkpoint: Your Hermes agent should now respond through Telegram.

Phase 4: Accessing the Hermes Dashboard

On your local computer, set up an SSH tunnel using the general format:

ssh -L LOCAL_PORT:127.0.0.1:REMOTE_PORT root@YOUR_VPS_IP

Use the actual dashboard port configured by Hermes. Keep this terminal open, then visit the corresponding localhost address in your browser — for example:

http://localhost:1920

Never expose the dashboard directly to the public internet without proper authentication and network restrictions.

Phase 5: Building Cybersecurity Skills

This is the phase that matters most. A skill is a collection of instructions and procedures that tells Hermes how to perform a particular task. Without skills, you have a general-purpose chatbot. With them, you have a security tool.

The Starting Skill Set

Skill	Purpose
`recon`	Asset discovery
`xss-hunter`	XSS testing
`idor-hunter`	Access control testing
`web-scan`	Coordinates other security skills
`validator`	Independent finding verification
`report-generator`	Generates vulnerability reports

Each skill should have its own instructions, workflow, constraints, and output format.

Building the Recon Skill

In Hermes, open the Skills section, create a new skill named recon, and build its instructions around:

Accept an authorized target
Verify the target is in scope
Discover subdomains using permitted sources
Identify live hosts
Collect HTTP metadata
Identify technologies and services
Compare results with previous reconnaissance data
Produce a structured report

Example output format:

{
  "target": "example.com",
  "scope_verified": true,
  "subdomains": [],
  "live_hosts": [],
  "technologies": [],
  "new_assets": [],
  "timestamp": ""
}

Only operate on assets explicitly authorized by the program or client.

Building the XSS Skill

Create a skill named xss-hunter with this workflow:

Input URL / Authorized Target
  → Inspect HTTP Response and Content Type
  → Identify Parameters and Inputs
  → Test Reflection in Authorized Environment
  → Analyze Context and Encoding
  → Validate Potential XSS
  → Generate Evidence and Report

Key instructions to include:

Check response content type
Identify GET and POST parameters
Distinguish reflected input from executable HTML
Analyze HTML, attribute, and JavaScript contexts
Avoid aggressive payload spraying
Use harmless proof-of-concept tests
Never claim a vulnerability without evidence

Building the IDOR Skill

Create idor-hunter with this workflow:

Identify object references
Understand the application's authorization model
Use test accounts you control
Compare access between authorized test identities
Check whether server-side authorization is enforced
Record evidence without accessing other people's private data
Generate a report

Building the Master Web Scan Skill

Create web-scan — the orchestrator skill. Its job is to decide which specialized skill should run:

Observation	Skill to Invoke
ID, user ID, account ID	IDOR
Reflected user input	XSS
Redirect parameter	Open redirect
File/path parameter	Path traversal
URL-fetching functionality	SSRF

The master skill should never automatically run every test against every target. It should first verify scope, inspect the application, and select relevant tests.

Phase 6: Teaching Hermes Through Research

Instead of asking an AI to invent an entire methodology, feed it quality technical resources. Sources worth studying:

HackerOne — public vulnerability reports
PortSwigger Web Security Academy — free labs and research
OWASP — security documentation
HackTricks — technical security knowledge base

In Hermes:

Open Chat
Provide relevant research URLs
Ask Hermes to extract the methodology
Ask it to distinguish verified techniques from assumptions
Ask it to identify prerequisites and limitations
Use Learn Skill to generate the skill
Review the generated instructions
Test it against intentionally vulnerable labs

Example prompt:

Study the provided security research resources.

Extract:
- Vulnerability identification methodology
- Testing prerequisites
- Technical conditions
- Detection techniques
- Validation methodology
- False-positive scenarios
- Reporting requirements

Do not blindly trust the sources.

Identify conflicting claims and unsupported techniques.
Create a structured skill based on verified findings.

The skill must operate only on authorized targets
and must include safe testing constraints.

Phase 7: Independent Validation

Create a validator skill ideally backed by a different, stronger AI model. The validation process:

Receive a potential finding
Inspect the original request and response
Check whether the evidence supports the claim
Reproduce it in an authorized environment
Check alternative explanations
Identify false positives
Assign a confidence level
Require human approval before reporting

Using a second AI model does not guarantee correctness. Independent evidence and manual verification matter far more than model agreement.

For every validated finding, generate:

Vulnerability description
Affected endpoint
Reproduction steps
Request and response evidence
Impact
Safe proof of concept
Remediation recommendations

Use JSON and Markdown as primary report formats. Avoid generating exploit files that automatically attack real users or external systems.

Phase 8: Automating Reconnaissance

Open Hermes Cron Jobs and create a new scheduled job:

Setting	Value
Name	Daily Recon Monitor
Frequency	Daily
Time	12:00 AM
Skill	Recon
Notification	Telegram
Memory	Enabled

The conceptual workflow:

Daily scheduled trigger
  → Load authorized scope
  → Discover new assets
  → Compare with historical asset list
  → New asset detected?
      → Yes: Notify through Telegram
      → No: Update monitoring log

Example automation instruction:

Every day, execute the recon skill for my
authorized bug bounty targets.

Compare discovered assets with the previous
reconnaissance database.

If new assets are discovered:
1. Verify they are within scope.
2. Record their discovery time.
3. Identify basic HTTP metadata.
4. Notify me through Telegram.
5. Do not automatically perform intrusive tests.

Generate a daily summary.

Ensure Hermes has permission to send messages to your Telegram account. Test the notification manually before enabling the scheduled job.

The Final Architecture

Here's how all the components fit together:

                  YOU
                   |
             TELEGRAM BOT
                   |
              HERMES AGENT
                   |
          MAIN ORCHESTRATOR
                   |
        +----------+----------+
        |          |          |
      RECON      WEB SCAN   VALIDATOR
                   |
          +--------+--------+
          |        |        |
         XSS     IDOR     SSRF
          |        |        |
          +--------+--------+
                   |
             EVIDENCE
                   |
             HUMAN REVIEW
                   |
             REPORT ENGINE
                   |
           JSON / MD / POC
                   |
                YOU

Implementation Checklist

[ ] Provision Ubuntu VPS
[ ] Connect through SSH
[ ] Install Hermes Agent
[ ] Configure AI model and API
[ ] Create Telegram bot
[ ] Connect Telegram to Hermes
[ ] Verify Telegram communication
[ ] Access Hermes dashboard securely
[ ] Create Recon skill
[ ] Create XSS skill
[ ] Create IDOR skill
[ ] Create Web Scan orchestrator
[ ] Collect quality security research
[ ] Generate skills using Learn Skill
[ ] Create independent Validator skill
[ ] Implement evidence-based reporting
[ ] Configure daily reconnaissance cron job
[ ] Test notifications
[ ] Test everything on authorized labs

Don't Build Everything at Once

Split your first implementation into four milestones:

Milestone	Deliverable
1	Hermes + VPS + Telegram
2	Recon + XSS + IDOR skills
3	Validator + reporting engine
4	Cron jobs + monitoring dashboard

The sensible approach is to get a reliable agent working first, then gradually give it specialized cybersecurity capabilities. Otherwise, you'll end up with a very expensive chatbot that occasionally runs curl.

Final Thoughts

The real power of an AI hacking agent isn't raw automation it's the structure you give it. Skills encode methodology. The validator enforces skepticism. The orchestrator prevents blind spraying. And human review keeps you legally and ethically grounded.

Build slowly. Test on labs. Verify everything. And always only operate on targets you're explicitly authorized to test.

DEV Community