Bug bounty programs pay out real money, but most hunters burn out in the first month — not because they lack skill, but because 80% of the work is tedious reconnaissance. Enumerate subdomains, probe for live hosts, fingerprint technologies, screenshot everything, triage the noise. By the time a human brain should be doing the interesting work, it's already exhausted.
I spent a year scripting that grind away piece by piece, then packaged everything into a single bundle: the Bug Bounty Automation Kit — $15, one-time, no subscription. This post is a hands-on tutorial of how the kit's pipeline actually works, so you can follow along whether you grab the kit or build your own version.
The architecture: four stages, one queue
The kit is built as four independent stages connected by a simple file-based queue (one directory per stage, JSONL files as work items). This is deliberately boring. Boring survives 24/7 runs on a Raspberry Pi; clever microservice meshes do not.
[1. ENUM] --> [2. PROBE] --> [3. FINGERPRINT] --> [4. TRIAGE]
subdomains live hosts tech stack ranked targets
Each stage is a Python script you can run standalone, which makes debugging painless: python probe.py --in queue/enum --out queue/probe.
Stage 1: Enumeration
The enum stage chains multiple passive sources — certificate transparency logs, DNS brute lists, and archive snapshots — then deduplicates. The key trick is delta tracking: the kit keeps a SQLite history of every subdomain ever seen, so on repeat runs you only process what's new. For programs you hunt continuously, this turns a 40-minute full enum into a 30-second delta check.
Stage 2: Probing
Not every subdomain is alive. The probe stage does fast async HTTP checks with sane timeouts and retries, then records status codes, redirects, and TLS info. The important design decision here: never throw data away. A 403 today might be a 200 after a deploy next Tuesday. Everything goes into the history DB so you can diff across time.
Stage 3: Fingerprinting
This stage identifies what's running behind each live host — web servers, frameworks, JS libraries, admin panels. The kit ships with a curated rule set, but the real value is the interestingness scoring: a forgotten Grafana instance on a staging subdomain scores far higher than yet another Cloudflare-fronted marketing page. You want your attention directed at the weird stuff.
Stage 4: AI-assisted triage
This is where the kit earns its keep. A local LLM pass (works with any OpenAI-compatible endpoint, including local models via Ollama) reads the fingerprint output and writes a short, ranked brief per target:
- What the asset is and who likely owns it
- Why it's interesting (old versions, debug endpoints, exposed admin UIs)
- Suggested first checks
The prompt templates are included in the kit and are the result of months of iteration — they're tuned to suppress hallucinated "findings" and only reason about the data in front of them.
Running it on a Raspberry Pi
The whole pipeline runs comfortably on a Raspberry Pi 4. My setup: a systemd timer kicks off a delta run every 6 hours, results land in the queue, and a Telegram bot pings me when anything crosses the interestingness threshold. Total cost: one Pi, a few watts, zero cloud bills. I wrote more about this exact setup in my AI automation notes if you want the deeper details.
Three rules that keep it sustainable:
- Respect rate limits. The kit ships with configurable per-domain throttles. Getting IP-banned from a program because your script went feral is a self-inflicted wound.
- Stay in scope. The enum stage accepts an explicit allowlist of in-scope domains and refuses to touch anything else.
- Human judgment stays in the loop. Automation finds targets; you find vulnerabilities. Anyone selling "automatic CVEs" is selling snake oil.
What's in the kit
The $15 kit includes all four stage scripts, the SQLite schema, the LLM triage prompts, systemd units for 24/7 operation, and a setup guide that takes you from fresh Raspberry Pi image to first automated run in about an hour. It's plain Python with minimal dependencies — you can read every line, modify it, and make it yours. Grab it here: Bug Bounty Automation Kit on LemonSqueezy.
The honest disclaimer
No toolkit turns you into a bounty hunter. What it does is remove the 80% of the work that was never the point, so the hours you actually spend hunting go toward thinking like an attacker instead of babysitting terminal windows. That trade — $15 to reclaim your evenings — is the whole pitch.
Happy hunting, and hunt responsibly: authorized scope only, always.
Top comments (0)