Share 
## https://sploitus.com/exploit?id=A4E196E4-5FE6-52A5-8F8A-109FC31869B8
# AutoScan โ€” Legendary Bug Bounty Automation Framework

```
  โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–„      โ–ˆโ–ˆโ–ˆ      โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–„     โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ    โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–„โ–„โ–„โ–„
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–€โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–„ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–€โ–€โ–€โ–ˆโ–ˆโ–„
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ    โ–€โ–ˆโ–ˆโ–ˆโ–€โ–€โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ    โ–ˆโ–€  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–€    โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ   โ–€ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ        โ–ˆโ–ˆโ–ˆ         โ–„โ–ˆโ–ˆโ–ˆโ–„โ–„โ–„โ–„โ–ˆโ–ˆโ–€ โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ
โ–€โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–€โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ        โ–€โ–€โ–ˆโ–ˆโ–ˆโ–€โ–€โ–€โ–€โ–€   โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ          โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–„  โ–€โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ     โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ    โ–„โ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ
  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–€  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–€     โ–ˆโ–ˆโ–ˆโ–€     โ–€โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–€   โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–€  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–€   โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆ  โ–€โ–ˆ   โ–ˆโ–€
```

> **โšก A single Python script that runs a full-scope bug bounty recon pipeline โ€” from zero to final report โ€” on any target domain.**

---

## Overview

AutoScan automates every reconnaissance phase a professional bug bounty hunter performs. Run one command, get a structured workspace with subdomain lists, status-code buckets, redirect chains, technology fingerprints, CVE hits, HTTP method findings, cookie dumps, directory brute-force results, discovered parameters, JS secret leaks, and a merged final report โ€” all organized and ready for manual exploitation.

| | |
|---|---|
| **Author** | Anas Magane |
| **YouTube** | [Anas Education](https://www.youtube.com/@AnasEducation) |
| **LinkedIn** | [anas-magane](https://ma.linkedin.com/in/anas-magane-3aa287262) |
| **GitHub** | [Anas-Magane](https://github.com/Anas-Magane) |
| **Language** | Python 3.10+ |
| **License** | MIT |

---

## Pipeline (10 Steps)

| Step | Name | Tools |
|------|------|-------|
| 0 | Workspace Setup + Requirements Check | โ€” |
| 1 | Subdomain Enumeration | subfinder, assetfinder, SecurityTrails API, httpx |
| 1b | Redirect Chain Follower | curl |
| 2 | robots.txt Discovery | curl |
| 3 | Technology Fingerprinting | whatweb |
| 4 | Nuclei CVE Scan | nuclei |
| 5 | HTTP Methods Audit (OPTIONS / TRACE) | curl |
| 6 | Cookie & Storage Dump | curl, playwright |
| 7 | Directory Bruteforce (parallel ร—10) | ffuf, gobuster |
| 8 | Parameter Discovery (parallel ร—7) | arjun |
| 9 | JS File Secrets Scanner | curl + regex engine |
| 10 | Final Report Generation (`all_in_one.md`) | โ€” |

---

## Requirements

### System Tools
```bash
# Go tools (install via go install)
subfinder   assetfinder   httpx   nuclei   ffuf

# Package manager tools
sudo apt-get install -y gobuster whatweb jq curl

# Python tools
pip3 install arjun playwright --break-system-packages
python3 -m playwright install chromium
```

### Wordlists (for Step 7)
```bash
sudo apt-get install -y seclists dirb dirbuster
```

AutoScan auto-detects available tools at runtime. Missing tools are reported and their steps are gracefully skipped โ€” the scan continues with what's available.

---

## Installation

```bash
git clone https://github.com/Anas-Magane/AutoBugBounty.git
cd AutoBugBounty
chmod +x autoscan.py
```

No pip requirements file needed โ€” the script uses Python standard library only; external dependencies are the recon tools themselves.

---

## Usage

### Basic scan
```bash
python3 autoscan.py -u target.com
```

### With custom speed (1=slow/stealthy โ€ฆ 5=fast/aggressive)
```bash
python3 autoscan.py -u target.com -s 2
```

### With custom headers (e.g. authenticated session)
```bash
python3 autoscan.py -u target.com -h "Cookie: session=abc123" -h "Authorization: Bearer TOKEN"
```

### Through a proxy (Burp Suite)
```bash
python3 autoscan.py -u target.com --proxy http://127.0.0.1:8080
```

### Set your own SecurityTrails API key
```bash
python3 autoscan.py --set-api-key YOUR_ST_KEY
```

### Full example
```bash
python3 autoscan.py -u example.com -s 3 -h "Cookie: auth=xyz" --proxy http://127.0.0.1:8080
```

---

## Speed Levels

| Level | Sleep Between Requests | Use Case |
|-------|----------------------|----------|
| 1 | 3.0 s | Very stealthy, WAF bypass |
| 2 | 1.5 s | Stealthy |
| **3** | **0.7 s** | **Default โ€” balanced** |
| 4 | 0.3 s | Fast |
| 5 | 0.0 s | Max speed (aggressive) |

---

## Output Structure

Every scan creates a timestamped workspace:

```
BugBounty__/
โ”œโ”€โ”€ subdomains/
โ”‚   โ”œโ”€โ”€ subfinder.txt          # Raw subfinder output
โ”‚   โ”œโ”€โ”€ assetfinder.txt        # Raw assetfinder output
โ”‚   โ”œโ”€โ”€ securitytrails.txt     # Raw SecurityTrails output
โ”‚   โ”œโ”€โ”€ all_subs.txt           # Merged + deduplicated
โ”‚   โ”œโ”€โ”€ -full-subs.txt # Fully-qualified subdomains
โ”‚   โ”œโ”€โ”€ -live-subs.txt # Confirmed live (httpx)
โ”‚   โ”œโ”€โ”€ 200.txt / 301.txt / 403.txt ...  # Per-status-code buckets
โ”‚   โ””โ”€โ”€ redirects.md           # Full redirect chains
โ”œโ”€โ”€ robots/
โ”‚   โ”œโ”€โ”€ robots.md              # Aggregated report
โ”‚   โ””โ”€โ”€ .txt             # Per-host robots.txt
โ”œโ”€โ”€ technologies/
โ”‚   โ””โ”€โ”€ technology.md          # whatweb fingerprints
โ”œโ”€โ”€ nuclei/
โ”‚   โ””โ”€โ”€ nuclei-cves.txt        # CVE scan results
โ”œโ”€โ”€ http_methods/
โ”‚   โ””โ”€โ”€ http_methods.md        # OPTIONS / TRACE / method results
โ”œโ”€โ”€ cookies/
โ”‚   โ”œโ”€โ”€ cookies.md             # Aggregated report
โ”‚   โ”œโ”€โ”€ _cookies.txt     # HTTP header cookies
โ”‚   โ””โ”€โ”€ _browser.txt     # Playwright browser storage
โ”œโ”€โ”€ bruteforce/
โ”‚   โ”œโ”€โ”€ _ffuf_small.json
โ”‚   โ”œโ”€โ”€ _ffuf_big.json
โ”‚   โ””โ”€โ”€ _gobuster_*.txt
โ”œโ”€โ”€ parameters/
โ”‚   โ”œโ”€โ”€ parameters.md          # Aggregated report
โ”‚   โ””โ”€โ”€ _params.json     # Per-URL arjun output
โ”œโ”€โ”€ js_secrets/
โ”‚   โ””โ”€โ”€ js_secrets.md          # Leaked keys / tokens / passwords
โ””โ”€โ”€ all_in_one.md              # Final merged report (start here)
```

---

## Configuration

Config is stored in `~/.autoscan/config.ini`:

```ini
[securitytrails]
api_key = YOUR_KEY_HERE

[general]
speed = 3
```

---

## After the Scan โ€” Manual Checklist

The generated `all_in_one.md` includes a checklist, but the key things to investigate manually:

- [ ] Use **Wappalyzer** to identify exact tech versions
- [ ] Test `403`/`401` subdomains for auth bypass
- [ ] Review `robots.txt` disallow paths in browser
- [ ] Rotate/revoke any secrets found in JS files immediately
- [ ] Test **TRACE-enabled** hosts for XST (Cross-Site Tracing)
- [ ] Fuzz discovered parameters for SQLi / XSS / SSRF / IDOR
- [ ] Exploit Nuclei CVE findings
- [ ] Inspect cookies for missing `HttpOnly` / `Secure` / `SameSite` flags

---

## Legal Disclaimer

**Use only against targets you have explicit written permission to test.**
Unauthorized scanning is illegal. This tool is built for authorized bug bounty programs, CTF competitions, and security research only.

---

## License

MIT ยฉ 2025 Anas Magane