mastermind-bug-bounty

Four-phase autonomous bug bounty orchestration. Phase 0 maps external assets with deterministic Python helpers, Phase 1 lets AI prioritize attack surfaces, Phase 2 gives AI autonomous attack control, and Phase 3 produces verifier-only reports.

Four-phase autonomous bug bounty workflow. Python handles deterministic collection and verifier support; AI owns prioritization, attack reasoning, and autonomous direction changes.

Report generation agent. Convert verifier-confirmed findings into a fixed evidence-based report without adding speculative impact.

Rank reconnaissance-derived attack surfaces and design evidence-driven tests without active exploitation.

Test ranked attack surfaces autonomously, preserve evidence, and turn new access into additional attack-chain hypotheses.

A compact routing skill for choosing vulnerability hypotheses; detailed payloads live in references, not here.

API exploration agent. Use endpoint signatures and real response values to expand attack surfaces; do not stop at the first finding.

Exploitation and impact-validation agent. Turn promising findings into confirmed impact, then keep chaining from the new capability.

AI/LLM security reasoning agent. Explore AI features as connected systems of prompts, tools, memory, retrieval, and permissions.

Treat AI systems as chains of prompt, retrieval, memory, tools, and permissions.

Explore API behavior using real parameters and values before generic fuzzing.

Reason about authorization barriers and whether blocked endpoints can lead to usable access.

Analyze cache key confusion as a path to stored impact.

Interpret encryption, signing, encoding, and key material as leverage for later attack-chain expansion.

Connect response values to later request parameters and keep expanding the attack graph after each finding.

Map observed technologies to plausible CVE paths, then require safe verification before promotion.

Treat GraphQL schemas and resolvers as expandable attack graphs.

Consider request smuggling only when architecture hints make it relevant, and connect confirmation to downstream impact.

Extract client-side attack surface from JS and sourcemaps without dictating the order of investigation.

Reason about JWT trust boundaries and whether token control can become privilege escalation.

Analyze OAuth/OIDC/SSO flows as identity-chain attack surfaces.

Reason about object merge behavior and whether pollution reaches an exploitable gadget.

Identify business actions where concurrent execution can multiply value or bypass limits.

Search public code and metadata for credentials, identifiers, internal routes, and business context that can feed later testing.

Explore WebSocket state, authentication, subscriptions, and replay as chained attack surfaces.

Access-control bypass agent. Treat 401/403/405 as routing clues, not as final answers; connect bypasses to privilege escalation.

Crypto and token reasoning agent. Interpret keys, tokens, signatures, encrypted fields, and their downstream leverage.

Asset reconnaissance agent. Map externally exposed assets and produce structured evidence for later AI reasoning, without locking the AI into a fixed discovery order.

Collect external context without touching the target aggressively.