ULNIT

Posted on Jul 8

From Zero to Bug Bounty Hero: Automating Recon with Python & Raspberry Pi

#raspberrypi #automation #python #tutorial

Why I Built a Bug Bounty Automation Kit

Bug bounty hunting is a numbers game. The more ground you cover, the higher your chances of finding that elusive critical vulnerability. But manually running reconnaissance tools is tedious, error-prone, and frankly, a waste of time.

That's why I built a Bug Bounty Automation Kit that turns a humble Raspberry Pi into a 24/7 reconnaissance powerhouse.

The Problem with Manual Recon

If you've ever done bug bounty hunting, you know the drill:

Enumerate subdomains with subfinder or amass
Probe for live hosts with httpx
Scan for open ports with nmap
Fuzz for hidden endpoints with ffuf
Screenshot everything with gowitness
Correlate, analyze, repeat

Doing this manually for even a single target takes hours. Doing it for hundreds? Impossible without automation.

My Raspberry Pi Setup

I run everything on a Raspberry Pi 4 (8GB) with an external SSD. Here's my stack:

OS: Raspberry Pi OS Lite (64-bit)
Container runtime: Docker & Docker Compose
Task scheduler: Cron + a custom Python orchestrator
Storage: 1TB SSD for logs, screenshots, and wordlists
Networking: VPN for safe scanning, split-tunnel for monitoring

The Pi lives in my closet, quietly humming away, running scheduled scans against my bug bounty target list every night.

The Automation Pipeline

My Python orchestrator does the heavy lifting. Here's a simplified version of the pipeline:

import subprocess
import json
from datetime import datetime

class ReconPipeline:
    def __init__(self, target):
        self.target = target
        self.timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
        self.output_dir = f"recon/{target}/{self.timestamp}"

    def run_subdomain_enum(self):
        """Find subdomains with subfinder"""
        subprocess.run([
            "subfinder", "-d", self.target,
            "-o", f"{self.output_dir}/subdomains.txt"
        ])

    def probe_live_hosts(self):
        """Check which subdomains are alive"""
        subprocess.run([
            "httpx", "-l", f"{self.output_dir}/subdomains.txt",
            "-o", f"{self.output_dir}/live_hosts.txt"
        ])

    def scan_ports(self):
        """Run nmap on live hosts"""
        subprocess.run([
            "nmap", "-iL", f"{self.output_dir}/live_hosts.txt",
            "-p-", "-oN", f"{self.output_dir}/nmap.txt"
        ])

    def run(self):
        """Execute full pipeline"""
        self.run_subdomain_enum()
        self.probe_live_hosts()
        self.scan_ports()
        # ... more steps

This runs on a cron schedule, and results are pushed to a private Discord webhook for review.

Key Lessons Learned

1. Rate Limiting is Critical

Early on, I got rate-limited hard by target WAFs. Now I use ratelimit decorators and random delays between requests. Respect the target!

2. Deduplication Saves Hours

Running the same scan daily means lots of duplicate data. I hash findings and store them in SQLite, only alerting on new discoveries.

3. Notification Fatigue is Real

I started with email alerts for every finding. Now I only get notified on new high/critical findings. Everything else goes into a daily digest.

4. The Pi is Surprisingly Capable

Don't underestimate the Raspberry Pi 4. With 8GB RAM and an SSD, it handles concurrent scans against 50+ targets without breaking a sweat.

Taking It Further

If you're serious about bug bounty automation, I've packaged my entire setup into a ready-to-use kit. It includes:

Pre-configured Docker containers for all major recon tools
The Python orchestrator with SQLite deduplication
Discord/Slack notification templates
Cron templates for daily/weekly scanning
A curated wordlist collection
Documentation and troubleshooting guides

You can grab it here: Bug Bounty Automation Kit on LemonSqueezy

What's Next?

I'm currently working on:

AI-powered triage: Using LLMs to classify findings and prioritize the most promising targets
Distributed scanning: Coordinating multiple Pis for larger scope
Integration with bug bounty platforms: Auto-submitting low-hanging fruit (with proper scope checks)

Conclusion

Automation isn't about replacing the hunter—it's about amplifying them. By offloading repetitive recon to a Raspberry Pi, you free up mental bandwidth for the creative, high-value work: finding logic flaws, chaining vulnerabilities, and writing great reports.

Start small. Automate one tool. Then another. Before you know it, you'll have a recon pipeline that works while you sleep.

Happy hunting! 🐛🔍

This article is part of my series on practical security automation. Follow for more tips on Raspberry Pi hacking, Python scripting, and bug bounty workflows.

DEV Community