🎯 FindBounty

The All-in-One Terminal Toolkit for Bug Bounty Recon, Discovery, Fingerprinting & Vulnerability Scanning

Türkçe Dokümantasyon  ·  Install  ·  Quickstart  ·  Modules  ·  Comparison  ·  Roadmap

FindBounty is a single, terminal-native CLI for the recon-to-report bug bounty workflow: subdomain enumeration, takeover detection, passive URL harvesting, technology/WAF fingerprinting, content fuzzing, JS secret extraction, CORS/open-redirect checks, a Nuclei-style template engine, and OWASP ZAP active scanning — all in one pip install, with zero required external binaries. When industry-standard tools like subfinder, httpx, and nuclei are on your PATH, pass --boost and FindBounty folds their output in on top of its own.

This is v0.1.0 — an early, working release. It's a fresh rebuild (not a fork) with a from-scratch native scanning engine; the Roadmap below is honest about what's still ahead.

---

Why FindBounty

Most recon setups are a pile of separately-installed Go binaries glued together with shell scripts. FindBounty takes the opposite approach:

• Works out of the box. pip install and you have real subdomain enumeration, fingerprinting, secret scanning, and a vulnerability template engine — no Go toolchain, no go install chain of five tools before your first scan.
• Terminal-first, on purpose. No web dashboard, no desktop GUI to keep in sync — one CLI, one source of truth, scriptable in CI and over SSH.
• Safe by default. Rate limiting, scope enforcement, robots.txt respect, and destructive/auth/brute-force testing are all off unless you explicitly turn them on (see Scope & Safety).
• Extends what you already have. --boost shells out to subfinder/httpx/nuclei/etc. if they're installed, merging their results with FindBounty's own — you're not locked out of the ProjectDiscovery ecosystem, just not dependent on it.

Screenshots

findbounty doctor	findbounty quick -t example.com
findbounty scope-lint --scope scope.yaml

(These are real captured output — generated with Rich's SVG export, not mockups.)

Installation

Requires Python 3.11+.

git clone https://github.com/tugrakaymakcioglu/FindBounty.git
cd FindBounty

# Linux / macOS / WSL
./scripts/install.sh

# Windows (PowerShell)
.\scripts\install.ps1

Or install directly with pip/pipx:

pipx install .          # recommended: isolated environment, findbounty on PATH
# or
pip install -e .

Verify everything's wired up:

findbounty doctor

Want FindBounty to also use subfinder/httpx/nuclei/etc. when present? Install with --boost (installer) or just install those tools yourself — findbounty doctor reports which ones it can see, findbounty scan --boost uses whichever are installed.

Quickstart

# One-time workspace + scope file for a target
findbounty init -t example.com

# Fast pass against a single host: tech, SSL, CORS, open-redirect
findbounty quick -t example.com

# Full recon + scan pipeline
findbounty scan -t example.com

# Restrict to an authorized scope, and fold in external tools if installed
findbounty scan -t example.com --scope ~/.findbounty/workspaces/example.com/scope.yaml --boost

# Continuous attack-surface monitoring - only reports what changed
findbounty monitor -d example.com --interval-minutes 60

# Interrupted? Resume the same run-id - already-completed modules are skipped
findbounty scan -t example.com -m all --resume 20260813_020618

# Throttle every rate-limited module (fuzzing, subdomain enum, templates) to 2 req/s
findbounty scan -t example.com --rate-limit 2

Every scan run writes results.json, report.json, report.md, and an interactive report.html (searchable, filterable by severity) to ./reports/<run-id>/, and persists findings to a local SQLite database at ~/.findbounty/findbounty.db. Progress is checkpointed after every module, so a scan killed partway through can pick up where it left off with --resume <run-id> instead of starting over.

Modules

Module	What it does
subdomain	Subdomain enumeration via CT logs (crt.sh), HackerTarget, urlscan.io, DNS brute-force, and (with an API key) VirusTotal/SecurityTrails/Censys
takeover	Subdomain takeover detection — dangling CNAME + response fingerprinting against 19 providers
ports	Async TCP port scan with banner-based service detection
urls	Passive URL harvesting from the Wayback Machine and Common Crawl (no external binary)
fuzz	Content/directory discovery, bundled + custom wordlists
tech	Wappalyzer-style technology fingerprinting
waf	WAF detection and identification
js	JavaScript analysis — endpoint and secret extraction from loaded scripts
templates	Nuclei-style YAML vulnerability template engine (built-in checks)
secrets	Regex-based credential/secret detection
cors	CORS misconfiguration detection (reflected origin, null origin, wildcard+credentials)
redirect	Open redirect detection across common redirect parameter names
ssl	SSL/TLS configuration and certificate analysis
screenshot	Page screenshots via Playwright (optional visual extra)

Run findbounty modules to see this from the CLI, or pick a subset with -m subdomain,takeover,tech.

Profiles

--profile controls request budgets, concurrency, and how aggressive checks are allowed to be. All three keep destructive tests, auth testing, and brute-force off:

Profile	Concurrency	Req/hour	Use case
stealth	2	100	Low-and-slow, minimal footprint
balanced (default)	10	1,000	Sensible default for most targets
aggressive	50	5,000	Fast, comprehensive — only on targets that can take it

Scope & Safety

FindBounty ships two independent safety layers:

1. ScopeValidator — enforced during every scan: same-origin restriction, robots.txt respect, and hard rate/URL-count limits.
2. ScopeGuard (--scope scope.yaml) — the program scope: an explicit allow/deny list of domains, paths, and testing rules (no destructive tests, no brute force, no auth testing, no cloud testing — all opt-in per scope file). findbounty init stamps out a starter file; findbounty scope-lint validates one before you scan with it.

This is a tool for authorized security testing only. Every scan prints a safety notice. Get explicit permission before targeting anything you don't own or have written authorization to test.

Boost mode

FindBounty's Python modules never require external tools. --boost adds a second, optional layer on top:

findbounty scan -t example.com --boost

If subfinder, httpx, or nuclei are on PATH, their results are merged into FindBounty's own subdomain list and findings. Nothing is installed automatically — findbounty doctor only ever reports what's missing and prints the install command, it never runs one for you.

Notifications

Telegram, Discord, and Slack are supported via webhooks, off by default:

findbounty scan -t example.com --notify telegram,discord
findbounty notify-test --channel slack

Configure via ~/.findbounty/config.yaml or environment variables (FINDBOUNTY_TELEGRAM_TOKEN, FINDBOUNTY_DISCORD_WEBHOOK, ...) so credentials never need to live in a committed file.

Command reference

Command	Purpose
findbounty scan -t <target>	Full comprehensive scan (add --resume <run-id> to continue an interrupted one, --rate-limit <n> to override the profile's req/s)
findbounty quick -t <target>	Fast single-host pass
findbounty monitor -d <domain>	Continuous delta monitoring
findbounty init -t <target>	Create a workspace + scope.yaml
findbounty scope-lint --scope <file>	Validate a scope file
findbounty workspaces	List existing workspaces
findbounty doctor	Check core deps + optional external tools
findbounty modules	List available scan modules
findbounty notify-test	Test configured notification channels
findbounty version	Print version

Architecture

findbounty/
├── recon/          subdomain, ports, passive URL harvesting, takeover
├── discovery/       fuzzing, JS analysis, robots/sitemap parsing
├── fingerprint/     technology + WAF detection
├── scanner/         passive checks, CORS, open redirect, ZAP pipeline
├── secrets/         credential/secret regex scanner
├── templates/       Nuclei-style YAML template loader + executor
├── audit/           dependency + SSL/TLS auditing
├── safety/          same-origin scope validator + program ScopeGuard
├── reporting/       JSON/Markdown/HTML report generation
├── storage/         SQLite persistence, evidence masking
├── visual/          optional screenshot capture + gallery
├── data/            bundled profiles, wordlists, default config
├── doctor.py        core + external tool health checks
├── boost.py         optional subfinder/httpx/nuclei integration
├── notify.py        Telegram/Discord/Slack dispatch
├── monitor.py       continuous delta scanning
├── workspace.py     per-target workspace management
└── cli.py           the findbounty CLI (Typer + Rich)

An optional docker-compose.yml runs OWASP ZAP for active-scan checks - FindBounty works fully without it; ZAP only adds a deeper active-scan pass.

Roadmap

v0.1.0 is a working foundation, not a finished product. Next up:

• Expand the built-in vulnerability template library beyond the initial set
• Parallel multi-host scanning (currently scan targets one host + its subdomains)
• PDF report export
• Plugin system for community-contributed checks
• Publish to PyPI (pip install findbounty without cloning)

Found a bug or want a feature? Open an issue.

Contributing

Issues and PRs are welcome. Before submitting:

pip install -e ".[dev]"
ruff check findbounty
pytest

License

MIT — see LICENSE.

---

_{Built for authorized security research. Don't be a jerk with it.}