1 line
63 KiB
JSON
1 line
63 KiB
JSON
{"repo": "btr4k/bugbounty-agent", "files": {"config.yaml": {"b25b64ac6467e86a8b25a1a44557a4640ad6cfcf": {"t": 1785745200.6771472, "n": 4812, "h": "08e42a33f86b1e25", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\n#\n# Active scanners run SEQUENTIALLY (nuclei → dalfox), never in parallel. Running\n# several heavy scanners at once on a modest host exhausts memory and the OOM\n# killer terminates them mid-scan. One scanner at a time finishes reliably.\nscanning:\n enabled: true\n threads: 40 # Balanced default for reliable scans on modest servers\n timeout: 1200 # 20-minute budget for the nuclei high-value scan (runs alone)\n # Requests/sec ceiling. At 50 a full scan of ~1300 templates × dozens of hosts\n # could not finish inside the budget (≈57 min of requests). 150 is Nuclei's own\n # default and completes the scan with margin. Lower it for strict programs.\n rate_limit: 150\n tools:\n nuclei:\n enabled: true\n severity: [] # Empty runs actionable severities: critical, high, medium, low\n # High-signal profile. \"misconfig\" (≈800 templates) was dropped: it nearly\n # doubled request volume without producing confirmed findings here. Add it\n # back if your host and the program's rate limits allow a longer scan.\n tags: [\"exposure\", \"takeover\", \"default-login\"]\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 75 # Parameterized URLs to fuzz for reflected XSS\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "bad05863b51bea22ca612fd10fa2588e7059e51a": {"t": 1785748579.658009, "n": 4812, "h": "08e42a33f86b1e25", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\n#\n# Active scanners run SEQUENTIALLY (nuclei → dalfox), never in parallel. Running\n# several heavy scanners at once on a modest host exhausts memory and the OOM\n# killer terminates them mid-scan. One scanner at a time finishes reliably.\nscanning:\n enabled: true\n threads: 40 # Balanced default for reliable scans on modest servers\n timeout: 1200 # 20-minute budget for the nuclei high-value scan (runs alone)\n # Requests/sec ceiling. At 50 a full scan of ~1300 templates × dozens of hosts\n # could not finish inside the budget (≈57 min of requests). 150 is Nuclei's own\n # default and completes the scan with margin. Lower it for strict programs.\n rate_limit: 150\n tools:\n nuclei:\n enabled: true\n severity: [] # Empty runs actionable severities: critical, high, medium, low\n # High-signal profile. \"misconfig\" (≈800 templates) was dropped: it nearly\n # doubled request volume without producing confirmed findings here. Add it\n # back if your host and the program's rate limits allow a longer scan.\n tags: [\"exposure\", \"takeover\", \"default-login\"]\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 75 # Parameterized URLs to fuzz for reflected XSS\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "50ae59b7a87199dc974a3d1dfc63b3e7ef9c66be": {"t": 1785748580.7584336, "n": 5095, "h": "46f485ad1b209075", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 40 # Balanced default for reliable scans on modest servers\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # Empty runs actionable severities: critical, high, medium, low\n tags: [\"exposure\", \"misconfig\", \"takeover\", \"default-login\"] # High-signal default profile\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "75aa7cb5a117cd4a2c2a5864086b4fc3bd0aee5f": {"t": 1785748581.8288908, "n": 4998, "h": "f3732ae3b54f189a", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 40 # Balanced default for reliable scans on modest servers\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # Empty runs actionable severities: critical, high, medium, low\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "72391219d44962305c54cc3acf8087c2cb28c73f": {"t": 1785748582.9020936, "n": 5001, "h": "d2a23fcd9d614232", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 40 # Balanced default for reliable scans on modest servers\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 50 # Per-tool ceiling; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "602d8ee4148fdf98d37603a3df7da8086f4509b4": {"t": 1785748585.0039482, "n": 4984, "h": "6a1be5cc01dd948a", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n timeout: 300 # Per-request HTTP timeout (seconds). Raise for slow providers/large JS batches\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 100 # requests per second; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "0d87d52a9211ef11b1474ce0da97726a60d5e212": {"t": 1785748586.0964358, "n": 4868, "h": "4d5df6581de33af9", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Optional authenticated testing. Use only accounts and sessions you own.\n# Values are expanded from environment variables and redacted from AI prompts\n# and reports. Avoid placing literal credentials in this file.\nauthentication:\n # Required when headers or cookies are configured. Credentials are injected\n # only when every target in a tool invocation matches this allowlist.\n allowed_hosts: []\n # Example:\n # - \"app.example.com\"\n # - \"*.api.example.com\"\n headers: {}\n # Example:\n # Authorization: \"Bearer ${TARGET_TOKEN}\"\n cookies: {}\n # Example:\n # session: \"${TARGET_SESSION}\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 100 # requests per second; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "40c6b6a0f17cb90474d6a29d027c4e1c8db363a7": {"t": 1785748587.1757324, "n": 4264, "h": "8b4c2def2e615b21", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n assetfinder: true\n wayback: true\n katana: true # JS file extraction crawler\n cert_transparency: true\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 100 # requests per second; lower this to match program rules\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"\" # Empty uses Nuclei's installed templates\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: false # Open ports alone are reconnaissance, not confirmed vulnerabilities\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: false # Discovery-only; enable manually when needed\n sqli:\n enabled: true # Uses focused Nuclei SQLi templates and parameter filtering\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n# AI Analysis\nanalysis:\n min_confidence: 0.85 # Findings below this require manual confirmation and are not reported\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n include_poc: true\n severity_filter: [] # Optional actionable severities: critical, high, medium, low\n output_dir: \"./reports\"\n"}, "ae7e4472b35fd48887c5cba7ad804a154354f441": {"t": 1785748588.5480673, "n": 4856, "h": "b7f4636728b815b8", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"auto\" # auto = detect from .env (claude/deepseek/openai/openrouter)\n api_key: \"\" # Leave empty — key is read from .env automatically\n model: \"\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n amass: false # Slower but comprehensive\n assetfinder: true\n github_dorking: true\n wayback: true\n katana: true # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 250 # requests per second (faster scanning)\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"/root/nuclei-templates\" # ALL templates for maximum coverage\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: true\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: true # Also fuzz virtual hosts via Host header — finds hidden internal apps\n sqli:\n enabled: true # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n sqlmap:\n enabled: true # Uses nuclei sqli templates internally (NOT blind sqlmap)\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n cors:\n enabled: true # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n enabled: true\n min_confidence: 0.7\n auto_validate: true\n false_positive_filter: true\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n format: \"markdown\"\n language: \"ar\" # Arabic reports\n include_poc: true\n severity_filter: [] # No filter - include ALL severities (critical, high, medium, low, info)\n output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n enabled: false\n slack_webhook: \"\"\n discord_webhook: \"\"\n\n# Logging\nlogging:\n level: \"info\" # debug, info, warn, error\n file: \"./logs/agent.log\"\n max_size_mb: 100\n"}, "3f611357d566a2993518503fbca9e09289ab9a32": {"t": 1785748589.6094909, "n": 4813, "h": "9445ea1629bff72d", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"deepseek\" # Choose your AI provider\n api_key: \"${DEEPSEEK_API_KEY}\" # API key (or use env vars below)\n model: \"deepseek-chat\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n amass: false # Slower but comprehensive\n assetfinder: true\n github_dorking: true\n wayback: true\n katana: true # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 250 # requests per second (faster scanning)\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"/root/nuclei-templates\" # ALL templates for maximum coverage\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: true\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n # Wordlist search order (first found wins):\n # 1. This value (if set)\n # 2. /usr/share/seclists/Discovery/Web-Content/common.txt\n # 3. /usr/share/wordlists/dirb/common.txt\n # 4. /opt/SecLists/Discovery/Web-Content/common.txt\n # 5. Built-in ~130 high-value paths (fallback — limited coverage)\n # Recommended: apt install seclists OR set full path below\n wordlist_path: \"\"\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: true # Also fuzz virtual hosts via Host header — finds hidden internal apps\n sqli:\n enabled: true # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n sqlmap:\n enabled: true # Uses nuclei sqli templates internally (NOT blind sqlmap)\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n cors:\n enabled: true # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n enabled: true\n min_confidence: 0.7\n auto_validate: true\n false_positive_filter: true\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n format: \"markdown\"\n language: \"ar\" # Arabic reports\n include_poc: true\n severity_filter: [] # No filter - include ALL severities (critical, high, medium, low, info)\n output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n enabled: false\n slack_webhook: \"\"\n discord_webhook: \"\"\n\n# Logging\nlogging:\n level: \"info\" # debug, info, warn, error\n file: \"./logs/agent.log\"\n max_size_mb: 100\n"}, "670da535366057a5e27666335a03e5d83a09e546": {"t": 1785748590.6443946, "n": 4475, "h": "0bf7ea5d4b9b4db5", "c": "# Bug Bounty AI Agent Configuration\n\n# ═══════════════════════════════════════════════════════\n# AI Provider Configuration\n# Supported: claude | deepseek | openai | openrouter | custom\n# ═══════════════════════════════════════════════════════\nai:\n provider: \"deepseek\" # Choose your AI provider\n api_key: \"${DEEPSEEK_API_KEY}\" # API key (or use env vars below)\n model: \"deepseek-chat\" # Leave empty for provider default\n max_tokens: 2000\n base_url: \"\" # Only needed for openrouter/custom\n\n# Provider presets (just change 'provider' and 'api_key'):\n# ┌─────────────┬──────────────────────────┬────────────────────────────┬──────────────┐\n# │ Provider │ Model (default) │ Env Variable │ Cost/1M tok │\n# ├─────────────┼──────────────────────────┼────────────────────────────┼──────────────┤\n# │ claude │ claude-sonnet-4-20250514 │ ANTHROPIC_API_KEY │ $3/$15 │\n# │ deepseek │ deepseek-chat │ DEEPSEEK_API_KEY │ $0.28/$0.42 │\n# │ openai │ gpt-4o-mini │ OPENAI_API_KEY │ $0.15/$0.60 │\n# │ openrouter │ deepseek/deepseek-chat │ OPENROUTER_API_KEY │ varies │\n# │ custom │ (must specify) │ AI_API_KEY │ varies │\n# └─────────────┴──────────────────────────┴────────────────────────────┴──────────────┘\n\n# Legacy Claude config (backward compatibility - used if ai.api_key is empty)\nclaude:\n api_key: \"${ANTHROPIC_API_KEY}\"\n model: \"claude-sonnet-4-20250514\"\n max_tokens: 2000\n\n# C99.nl API Intelligence\nc99:\n api_key: \"${C99_API_KEY}\"\n enabled: true\n\n# Target Configuration\ntarget:\n domains: []\n excluded_subdomains: []\n scope: \"in-scope-only\"\n\n# Reconnaissance Settings\nrecon:\n enabled: true\n timeout: 300 # seconds\n max_subdomains: 1000\n max_wayback_urls: 10000 # prevent OOM for large domains\n tools:\n subfinder: true\n amass: false # Slower but comprehensive\n assetfinder: true\n github_dorking: true\n wayback: true\n katana: true # JS file extraction crawler\n\n# Scanning Settings\nscanning:\n enabled: true\n threads: 75 # Increased for better performance\n timeout: 1200 # 20 minutes for high-priority templates\n rate_limit: 250 # requests per second (faster scanning)\n tools:\n nuclei:\n enabled: true\n severity: [] # No filter - run all templates, findings keep their real severity\n templates_path: \"/root/nuclei-templates\" # ALL templates for maximum coverage\n httpx:\n enabled: true\n follow_redirects: true\n status_code: true\n nmap:\n enabled: true\n ports: \"21,22,25,53,80,110,143,443,445,993,995,3000,3306,5432,6379,8000,8080,8443,8888,9090,9200,27017\"\n fast_scan: true\n dalfox:\n enabled: true\n blind_url: \"\" # Optional: blind XSS callback URL (e.g. https://your-burp-collaborator)\n max_urls: 100 # Increased for better XSS coverage\n ffuf:\n enabled: true\n wordlist_path: \"\" # Auto-detects SecLists/dirb/dirbuster, or specify full path\n max_targets: 20 # Top N hosts to path-bruteforce (scored by importance)\n vhost_fuzzing: true # Also fuzz virtual hosts via Host header — finds hidden internal apps\n sqli:\n enabled: true # SQLi via nuclei templates + gf-style param filtering (replaces sqlmap)\n # NOTE: sqlmap config kept for backward compatibility — set enabled:true above to activate\n sqlmap:\n enabled: true # Uses nuclei sqli templates internally (NOT blind sqlmap)\n max_urls: 50 # Max gf-filtered param URLs to test\n arjun:\n enabled: true # Hidden parameter discovery — feeds discovered params into dalfox\n max_targets: 15 # Top N hosts to discover hidden params on\n cors:\n enabled: true # CORS misconfiguration detection (fast, no external tools needed)\n\n# AI Analysis\nanalysis:\n enabled: true\n min_confidence: 0.7\n auto_validate: true\n false_positive_filter: true\n js_analysis: true # AI-powered JS file analysis\n\n# Reporting\nreporting:\n format: \"markdown\"\n language: \"ar\" # Arabic reports\n include_poc: true\n severity_filter: [] # No filter - include ALL severities (critical, high, medium, low, info)\n output_dir: \"./reports\"\n\n# Notifications\nnotifications:\n enabled: false\n slack_webhook: \"\"\n discord_webhook: \"\"\n\n# Logging\nlogging:\n level: \"info\" # debug, info, warn, error\n file: \"./logs/agent.log\"\n max_size_mb: 100\n"}}}} |