bounty-hunter-toolkit 1.3.0

Bug bounty automation: vulnerability scanner, recon, BOLA, fix patterns for Python/Solidity/TS

Bounty Hunter Toolkit

Vulnerability scanner and fix patterns for Python, Solidity, and TypeScript. Zero dependencies.

What's New in 1.3.0

• Vulnerability scanner — scan_file() and scan_directory() with regex-based detection
• 28 vulnerability patterns — SQL injection, SSRF, path traversal, command injection, hardcoded secrets, weak hashes, integer overflow, unchecked calls, and more
• CWE mapping — every pattern maps to a MITRE CWE ID
• Severity levels — critical, high, medium, low
• Mass scanning — recursive directory scan with ignore dirs (node_modules, .git, pycache)
• CI integration — non-zero exit code when vulnerabilities found
• Bulk fix mode — --fix-all applies every matching pattern
• JSON/CSV output — pipe to jq, import to spreadsheet, or feed to CI tooling
• Dry run mode — preview changes before writing

Features

• Python Security Patterns (17): SQL injection, JWT none algo, XXE, SSTI, CSRF, open redirect, NoSQL injection, YAML RCE, pickle RCE, CRLF injection, path traversal, command injection, SSRF, hardcoded secrets, insecure deserialization, weak hashes
• Solidity Security Patterns (7): Reentrancy, zero-amount, batch ops, permit replay, indexed events, unchecked calls, integer overflow
• SDK Patterns (2): Session refresh, EIP-712 typed data

Quick Start

pip install bounty-hunter-toolkit

Scan a File

# Scan single file
python apply_fix.py --scan app.py

# Scan with JSON output for CI
python apply_fix.py --scan ./src --format json > findings.json

# CSV for spreadsheets
python apply_fix.py --scan ./src --format csv > findings.csv

Output:

Found 3 potential vulnerabilities:

  [!] CRITICAL sql_injection            app.py:42
           CWE-89 — Replace f-string SQL with parameterized queries
           match: execute(f"SELECT * F

  [*] HIGH     hardcoded_secrets        app.py:8
           CWE-798 — Move secrets to environment variables
           match: API_KEY = "sk-1234567

  [~] MEDIUM   weak_hash                app.py:56
           CWE-328 — Use hashlib.sha256 instead of md5/sha1
           match: hashlib.md5(password.

Summary:
  critical: 1
  high    : 1
  medium  : 1

Apply Fixes

# Apply a specific fix pattern
python apply_fix.py --fix sql_injection --file app.py

# Apply all matching fixes at once
python apply_fix.py --fix-all --file app.py

# Preview without writing
python apply_fix.py --fix-all --file app.py --dry-run

Scan a Project

# Scan entire project (auto-skips node_modules, .git, __pycache__, etc.)
python apply_fix.py --scan ./my-project

# Scan specific extensions only
python apply_fix.py --scan ./contracts --ext .sol
python apply_fix.py --scan ./backend --ext .py

List All Patterns

python apply_fix.py --list

28 patterns available:

  PYTHON:
    sql_injection                 CRITICAL  Replace f-string SQL with parameterized queries
    jwt_none                      HIGH      Force explicit JWT algorithms
    command_injection             CRITICAL  Use subprocess with shell=False and list args
    ...

CI/CD Integration

The scanner exits with code 1 when vulnerabilities are found, making it drop-in for CI:

# GitHub Actions
- name: Security scan
  run: |
    pip install bounty-hunter-toolkit
    python -m apply_fix --scan ./src --format json > findings.json
    # Fails build if vulnerabilities found

# Pre-commit hook
bounty-hunter-toolkit --scan . --format text || exit 1

Python API

from apply_fix import scan_file, scan_directory, apply_fix, format_findings

# Scan a file
findings = scan_file("app.py")
print(format_findings(findings))

# Scan a directory
findings = scan_directory("./src", extensions=[".py"])

# Apply a fix
success, message = apply_fix("sql_injection", "app.py")

# Get JSON output
import json
print(json.dumps(findings, indent=2))

Pattern Reference

Python Patterns

Pattern	Severity	CWE	Description
sql_injection	Critical	CWE-89	f-string in SQL execute()
jwt_none	High	CWE-347	algorithms=None in JWT decode
xxe	High	CWE-611	xml.etree without defusedxml
ssti	Critical	CWE-1336	f-string in render_template_string
csrf	Medium	CWE-352	Missing CSRF token validation
open_redirect	Medium	CWE-601	Unvalidated redirect URL
nosql_injection	High	CWE-943	Raw JSON in NoSQL query
yaml_rce	Critical	CWE-502	yaml.load without safe_load
pickle_rce	Critical	CWE-502	pickle.loads on untrusted data
crlf_injection	Medium	CWE-93	Unstripped CR/LF in headers
path_traversal	High	CWE-22	Unvalidated file path
command_injection	Critical	CWE-78	os.system or shell=True
ssrf	High	CWE-918	Unvalidated outbound URL
hardcoded_secrets	High	CWE-798	API keys in source code
insecure_deserialize	Critical	CWE-502	marshal.loads
weak_hash	Medium	CWE-328	md5/sha1 for passwords

Solidity Patterns

Pattern	Severity	CWE	Description
reentrancy	Critical	CWE-668	Missing nonReentrant modifier
zero_amount	Medium	CWE-664	Missing zero-amount check
batch_ops	Low	CWE-400	Unbounded batch array
permit_replay	High	CWE-345	Missing chainId in hash
indexed_events	Low	CWE-682	Unindexed address params
unchecked_call	High	CWE-252	Unchecked .call() return
integer_overflow	High	CWE-190	Solidity <0.8 arithmetic

Testing

python -m pytest tests/ -v

License

MIT