Web3 Bug Bounty AI Tools

✅ IDOR — changes IDs across accounts, tests all API routes
✅ SQLi — error-based and time-based blind
✅ Command injection — OS separators in all inputs
✅ XSS — reflected + stored (confirmed in real browser)
✅ SSRF — webhook/fetch URL inputs, OOB callbacks
✅ JWT attacks — alg:none, RS256→HS256 confusion, weak keys
✅ Auth bypass — session fixation, forgot-password flaws
✅ Privilege escalation — viewer→admin, cross-tenant
✅ OAuth misconfigs — state parameter, redirect_uri

❌ Race conditions (sequential, not concurrent)
❌ Business logic (needs domain expertise)
❌ Smart contract bugs — use files 01-07 for these
❌ Novel techniques not in prompt templates

git clone https://github.com/KeygraphHQ/shannon
cd shannon && npm install
cp .env.example .env  # Add: ANTHROPIC_API_KEY=sk-ant-...
npm run build

# Direct mode (simple):
node dist/index.js --config configs/my-target.yaml

# Docker (includes nmap, subfinder, whatweb):
docker run --env-file .env \
  -v ./configs:/app/configs \
  keygraph/shannon:latest \
  --config configs/my-target.yaml

# configs/target.yaml
target:
  name: "DeFi App Frontend"
  url: "https://app.DEFI.com"
  source_path: "/path/to/frontend/clone"  # white-box = much better
  additional_context: |
    DeFi app. Users connect MetaMask wallets.
    Focus on: IDOR in /api/portfolio?address=0x...,
    GraphQL introspection, JWT handling, SSRF via webhooks.
    DO NOT interact with smart contracts.

authentication:
  login_type: form  # form | sso | api | basic
  login_url: "https://app.DEFI.com/login"
  credentials:
    username: "attacker@test.com"
    password: "testpassword"
  login_flow:
    - "Fill in username field with $username"
    - "Fill in password field with $password"
    - "Click the login button"
  success_condition:
    type: url
    value: "/dashboard"

test_accounts:
  - username: "attacker@test.com"
    password: "testpassword"
    role: "viewer"
  - username: "victim@test.com"
    password: "victimpassword"
    role: "admin"

scope:
  include: ["https://app.DEFI.com/*"]
  exclude: ["https://app.DEFI.com/admin/destroy-all"]

YOUR PLAN:
1. Setup config + 2 test accounts (15 min)
2. Run Shannon (90 min) → do MANUAL business logic testing while it runs
3. Review Shannon findings (30 min) → verify each PoC manually
4. Manual hunting for what Shannon misses: race conditions, business logic, contract layer (60 min)
5. Write reports adapting Shannon's PoC to Immunefi/H1 format (30 min)

Shannon + manual = 4 hours → coverage that takes 2 days manually.

Port scan → 3306/tcp open
  → Hypothesis: MySQL running (confidence 0.8)
  → Validated: banner confirms MySQL 5.7
  → Vulnerability: empty root password
  → Exploit: mysql -h target -u root -p

git clone https://github.com/SanMuzZzZz/LuaN1aoAgent && cd LuaN1aoAgent
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
# Edit .env: set LLM_API_KEY + LLM_API_BASE_URL

# Build RAG knowledge base (one-time, ~5 min):
mkdir -p knowledge_base
git clone https://github.com/swisskyrepo/PayloadsAllTheThings knowledge_base/PayloadsAllTheThings
cd rag && python -m rag_kdprepare && cd ..

# Run:
python agent.py \
  --goal "Comprehensive web security testing on http://target.com" \
  --task-name "hunt_01" \
  --web  # enables Web UI at localhost:8088

LLM_PLANNER_MODEL=claude-sonnet-4-6
LLM_EXECUTOR_MODEL=claude-sonnet-4-6
LLM_REFLECTOR_MODEL=claude-sonnet-4-6

SCENARIO_MODE=general          # or: ctf
EXECUTOR_MAX_STEPS=12
EXECUTOR_FAILURE_THRESHOLD=3
HUMAN_IN_THE_LOOP=true         # pause before high-risk actions
RAG_TOP_K=5

python agent.py \
  --goal "Audit Ern protocol smart contracts for:
    1. Missing access control on distributeRewards() and harvest()
    2. Accounting desync between totalDeposited and aToken balance
    3. Any role never granted (permanent lock bugs)
    4. Reentrancy in harvest→distributeRewards sequence
  Target: github.com/[ern-repo]" \
  --task-name "ern_audit"

# HITL injection during run:
# "Check if harvest() can be called before any deposit — divide by zero?"

python3.12 -m venv cai_env && source cai_env/bin/activate
pip install cai-framework

cat > .env << 'EOF'
ANTHROPIC_API_KEY="your-key-here"
CAI_MODEL="claude-sonnet-4-6"
CAI_STREAM=false
PROMPT_TOOLKIT_NO_CPR=1
EOF

cai

# Step 1: Recon
CAI_AGENT_TYPE=bug_bounter CAI_DEBUG=1 cai
# "Target: target.com — enumerate all endpoints, check Shodan, find exposed services"

# Step 2: Hunt specific class
# "Focus on /api/v2/ endpoints. Look for IDOR in user ID params.
#  Test authenticated vs unauthenticated. Document each finding."

# Step 3: Validate before submitting
CAI_AGENT_TYPE=retester cai
# "Validate this finding: [paste finding]. Confirm exploitable."

# Step 4: Generate report
CAI_AGENT_TYPE=reporter CAI_REPORT=pentesting cai
# "Generate bug bounty report for: [paste validated findings]"

# Tell CAI to use cast/foundry:
"Use cast and foundry to analyze this contract:
 0x9f76037494092aceac5b23e21c20b1970a866ef5

 Check:
 1. What roles exist? cast call addr 'getRoleMember(bytes32,uint256)' ROLE_HASH 0
 2. Who has DISTRIBUTOR_ROLE? cast logs with RoleGranted topic
 3. Can distributeRewards() be called without DISTRIBUTOR_ROLE?
 4. Any MEV opportunity in harvest→distribute flow?"

CAI>/mcp load http://localhost:9876/sse burp
CAI>/mcp add burp bug_bounter
# Now has: send_http_request, proxy history, intruder, repeater, +16 more