# ⚡ BugBounty-CLI — 多合一 Bug Bounty 工具包
## 💡 什么是 BugBounty-CLI？
一款统一的命令行工具包，可自动化整个 Bug Bounty 工作流：
```
Recon → Discovery → Vulnerability Scanning → Exploitation → Reporting
```
30+ 集成工具。统一界面。零配置。
## 🚀 快速开始
```
git clone https://github.com/javokhir-sec/BugBounty-CLI.git
cd BugBounty-CLI
chmod +x bugbounty.sh install.sh
./install.sh
```
## 📋 命令
### 完整工作流
```
# 完整自动化扫描 (recon → vuln → report)
./bugbounty.sh scan target.com
# 快速扫描 (top ports + nuclei + xss)
./bugbounty.sh quick target.com
```
### 侦察
```
# 完整 recon
./bugbounty.sh recon target.com
# 仅子域名
./bugbounty.sh subs target.com
# URL 发现
./bugbounty.sh urls target.com
# JS 分析
./bugbounty.sh js target.com
# Port 扫描
./bugbounty.sh ports target.com
```
### 漏洞扫描
```
# Nuclei 扫描 (所有 templates)
./bugbounty.sh nuclei targets.txt
# XSS 扫描
./bugbounty.sh xss urls.txt
# SQLi 扫描
./bugbounty.sh sqli urls.txt
# SSRF 扫描
./bugbounty.sh ssrf urls.txt
# Open redirect 扫描
./bugbounty.sh redirect urls.txt
# 包含所有检查的完整扫描
./bugbounty.sh vulnscan targets.txt
```
### Fuzzing
```
# Directory fuzzing
./bugbounty.sh fuzz-dirs target.com
# Parameter fuzzing
./bugbounty.sh fuzz-params urls.txt
# Virtual host fuzzing
./bugbounty.sh vhost target.com
# Custom wordlist fuzzing
./bugbounty.sh fuzz target.com wordlist.txt
```
### 漏洞利用辅助
```
# 生成 XSS payloads
./bugbounty.sh payloads xss
# 生成 SQLi payloads
./bugbounty.sh payloads sqli --db mysql
# HTTP request smuggler
./bugbounty.sh smuggler target.com
# JWT analyzer
./bugbounty.sh jwt token.txt
```
### 报告
```
# 从 findings 生成报告
./bugbounty.sh report findings/
# 生成 PoC HTML
./bugbounty.sh poc --type xss --target target.com --payload ""
```
## 🛠️ 内置工具
| 分类 | 工具 |
|----------|-------|
| 🔍 侦察 | subfinder, amass, assetfinder, httpx, naabu, dnsx |
| 📡 URL | gau, waybackurls, katana, hakrawler, gospider |
| 💉 注入 | sqlmap, XSStrike, dalfox, commix |
| 🛡️ 扫描 | nuclei, ffuf, dirsearch, feroxbuster |
| 📊 分析 | whatweb, wappalyzer, jq, anew, unfurl, qsreplace |
| 📝 报告 | 自定义模板，HTML 报告生成器 |
## ⚙️ 配置
```
# 编辑 config
vim config.sh
# 设置你的 settings
export DISCORD_WEBHOOK="https://..." # Get notifications
export NOTIFY="on" # Enable notifications
export THREADS=50 # Concurrent threads
export TIMEOUT=10 # Request timeout
```
## 📊 示例输出
```
⚡ BugBounty-CLI v1.0 — Starting scan on target.com
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[1/6] 🔍 Subdomain Enumeration...
├─ subfinder: 47 found
├─ amass: 32 found
└─ Total unique: 53
[2/6] 📡 Live Host Discovery...
└─ 23 hosts alive
[3/6] 🌐 URL Discovery...
├─ gau: 1,247 URLs
├─ waybackurls: 893 URLs
└─ Total unique: 1,847
[4/6] 💉 Vulnerability Scanning...
├─ nuclei: 2 critical, 1 high, 3 medium
├─ XSS: 1 reflected found
└─ SQLi: testing...
[5/6] 📂 Directory Fuzzing...
└─ 5 interesting directories found
[6/6] 📝 Generating Report...
└─ Report saved: reports/target.com-2026-07-02.html
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Scan complete! Duration: 8m 42s
📊 Findings: 2 Critical, 1 High, 3 Medium, 0 Low
📝 Report: reports/target.com-2026-07-02.html
```
## 🔧 包含的自定义脚本
```
./scripts/
├── live-check.sh # Check live hosts with screenshots
├── js-extractor.sh # Extract JS files and secrets
├── param-hunter.sh # Discover hidden parameters
├── 403-bypass.sh # Try 12+ bypass techniques
├── idor-tester.sh # Test for IDOR vulnerabilities
├── jwt-analyzer.sh # Analyze JWT tokens
├── quick-xss.sh # Rapid XSS testing
└── notify.sh # Discord/Telegram/Slack notifications
```
## 🎯 专家提示
```
# 从文件扫描多个 targets
cat targets.txt | while read t; do ./bugbounty.sh scan $t; done
# 持续监控模式
./bugbounty.sh monitor targets.txt --interval 24h
# 通过管道传递到通知
./bugbounty.sh scan target.com | ./scripts/notify.sh
# 结合 custom wordlists
./bugbounty.sh fuzz target.com ./my-custom-list.txt
```
## 📦 安装
```
# Automatic (推荐)
./install.sh
# Manual
# 安装所需 tools: subfinder, amass, assetfinder, httpx, nuclei,
# ffuf, sqlmap, gau, waybackurls, katana, dalfox, naabu, dnsx
```
## ⚠️ 免责声明
仅供**授权安全测试**使用。在测试前务必获取相关许可。
## 📜 许可证
MIT © [Javokhir Tursunboyev](https://github.com/javokhir-sec)
⭐ 如果此工具包对您的工作流有帮助，请点个 Star！