🔱 ReconMind — AI-Powered Bug Bounty Agent

⭐ If this tool helps you find bugs — star this repo and subscribe to Encrypticle if you haven't already! Every star helps the community discover this tool.

🧠 What is ReconMind?

ReconMind is an AI-powered bug bounty agent that thinks and hunts like a senior penetration tester. Instead of just running tools, it uses an LLM brain (Claude / Llama / Groq) to make decisions at every step — selecting targets, chaining findings, filtering false positives, and generating platform-ready reports.

Target Domain
     │
     ▼
┌──────────────────────────────────────────────────────┐
│                 RECONMIND PIPELINE                    │
│                                                      │
│  RECON → ENUM → SCAN → FUZZ → ANALYZE → REPORT      │
│                                                      │
│  🧠 AI Brain decides what to test next at each step  │
└──────────────────────────────────────────────────────┘
     │
     ▼
HackerOne / Bugcrowd / Intigriti Ready Reports

🎯 What makes it different?

• Domain-only by default — no noisy subdomain scan unless you want it (--subdomain)
• Full OWASP Top 10 coverage with --thorough flag
• AI decides what to scan next — not just blindly running tools
• Attack chain identification — combines low findings into critical impact
• False positive filtering — AI validates each finding before reporting
• 100% Free to use — works with Ollama (local), Groq (free API), or Anthropic (paid)
• Platform-ready reports — HackerOne, Bugcrowd, Intigriti format

⚡ Quick Start

# 1. Clone the repo
git clone https://github.com/encrypticle/reconmind.git
cd reconmind
2. Install everything (tools + dependencies)
chmod +x setup.sh
./setup.sh
3. Start Ollama (free local LLM — no API key needed)
ollama serve &
ollama pull llama3.1:8b
4. Hunt!
python3 reconmind.py --target example.com

📋 Requirements

System Requirements

| Requirement | Minimum | Recommended | |-------------|---------|-------------| | OS | Ubuntu 22.04 / Parrot OS | Kali Linux | | Python | 3.9 | 3.11+ | | RAM | 4GB | 8GB+ (16GB for local Ollama) | | Disk | 10GB | 20GB | | Go | 1.21+ | Latest |

Python Dependencies

pyyaml>=6.0
rich>=13.7
click>=8.1
httpx>=0.27
aiohttp>=3.9
aiofiles>=23.2
anthropic>=0.40.0
ollama>=0.3.0
groq>=0.11.0
beautifulsoup4>=4.12
tldextract>=5.1
dnspython>=2.6
jinja2>=3.1
tenacity>=8.2

Install all:

pip3 install -r requirements.txt --break-system-packages

External Security Tools

| Tool | Purpose | Install | |------|---------|---------| | subfinder | Subdomain enumeration | go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest | | httpx | HTTP probing + tech detect | go install github.com/projectdiscovery/httpx/cmd/httpx@latest | | nuclei | Vulnerability scanning | go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest | | naabu | Port scanning | go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest | | katana | Web crawling | go install github.com/projectdiscovery/katana/cmd/katana@latest | | ffuf | Directory fuzzing | go install github.com/ffuf/ffuf/v2@latest | | dalfox | XSS detection | go install github.com/hahwul/dalfox/v2@latest | | gau | Historical URLs | go install github.com/lc/gau/v2/cmd/gau@latest | | waybackurls | Wayback Machine URLs | go install github.com/tomnomnom/waybackurls@latest | | gf | Grep patterns | go install github.com/tomnomnom/gf@latest | | amass | Deep subdomain enum | sudo apt install amass | | sqlmap | SQL injection | sudo apt install sqlmap | | nikto | Web server scanner | sudo apt install nikto | | whatweb | Technology fingerprint | sudo apt install whatweb |

💡 Just run ./setup.sh — it installs everything automatically.

🔧 Installation (Step by Step)

Step 1 — Clone & Install

git clone https://github.com/encrypticle/reconmind.git
cd reconmind
chmod +x setup.sh
./setup.sh

Step 2 — Configure LLM

cp configs/config.example.yaml configs/config.yaml
nano configs/config.yaml

Step 3 — Get Your API Keys

🆓 Groq (Free — Best for beginners)

• Go to console.groq.com
• Sign up → API Keys → Create API Key
• Copy the key starting with gsk_...
• Add to configs/config.yaml:

llm:
  default: groq
  groq:
    enabled: true
    apikey: "gskyourkeyhere"

🖥️ Ollama (Free — No internet, runs locally)

# Install
curl -fsSL https://ollama.ai/install.sh | sh
Start the service
ollama serve &
Pull a model (choose based on your RAM)
ollama pull llama3.1:8b      # Needs 8GB RAM  — good balance
ollama pull llama3.1:70b     # Needs 32GB RAM — better quality
ollama pull mistral-nemo     # Needs 4GB RAM  — lightweight

Add to config:

llm:   default: ollama   ollama:     enabled: true     base_url: "http://localhost:11434"     model: "llama3.1:8b"

💎 Anthropic Claude (Paid — Highest quality)

• Go to console.anthropic.com
• Add billing → minimum $5 credits
• API Keys → Create Key
• Add to config:

llm:
  default: anthropic
  anthropic:
    enabled: true
    apikey: "sk-ant-yourkey_here"

💡 Pro tip: Use Groq for daily hunting (free), switch to Anthropic for final reports on high-severity findings.

Step 4 — Verify Everything is Ready

python3 reconmind.py --check-tools

🚀 Usage

Basic Commands

# Scan a domain (domain-only — fast, clean)
python3 reconmind.py --target example.com
With subdomain enumeration
python3 reconmind.py --target example.com --subdomain
Deep OWASP Top 10 testing
python3 reconmind.py --target example.com --thorough
Full nuclear hunt
python3 reconmind.py --target example.com --subdomain --thorough
Specify LLM backend
python3 reconmind.py --target example.com --llm groq
python3 reconmind.py --target example.com --llm anthropic
python3 reconmind.py --target example.com --llm ollama
Custom project name (organizes output folder)
python3 reconmind.py --target example.com --project h1huntjan2025
Specific phases only
python3 reconmind.py --target example.com --phases recon,scan,report
Multiple targets from file
python3 reconmind.py --targets targets.txt
Resume interrupted scan
python3 reconmind.py --target example.com --resume

Hunting Profiles

python3 reconmind.py --target example.com --profile quick        # Fast: recon+scan+report
python3 reconmind.py --target example.com --profile deep         # Everything + validate
python3 reconmind.py --target api.example.com --profile api      # API-focused hunt
python3 reconmind.py --target example.com --profile cloud        # Cloud misconfigs
python3 reconmind.py --target example.com --profile mobile_api   # Mobile backend

All Flags Reference

| Flag | Short | Default | Description | |------|-------|---------|-------------| | --target | -t | — | Target domain | | --targets | -T | — | File with list of targets | | --project | -P | domain name | Project name for output folder | | --subdomain | | off | Enable subdomain enumeration | | --thorough | | off | Deep OWASP Top 10 testing | | --llm | -l | config default | ollama / anthropic / groq | | --profile | | default | Hunting profile | | --phases | -p | all | Specific phases to run | | --scope | -s | standard | narrow / standard / wide | | --resume | -r | off | Resume from checkpoint | | --output | -o | ./output | Custom output directory | | --check-tools | | — | Show installed tools status |

🔍 OWASP Top 10 Coverage (--thorough)

| # | Category | What ReconMind Tests | |---|----------|---------------------| | A01 | Broken Access Control | IDOR detection, HTTP method tampering, forced browsing, 403 bypass via headers | | A02 | Cryptographic Failures | HTTP without TLS, sensitive data in URLs, missing HSTS | | A03 | Injection | SQLi (error/blind/time-based/boolean), XSS (reflected/DOM), SSTI, LFI, Command Injection, XXE, XPath | | A04 | Insecure Design | AI-driven business logic analysis, rate limiting gaps, race conditions | | A05 | Security Misconfiguration | .env, .git, debug endpoints, Actuator, Swagger, phpinfo, directory listing | | A06 | Outdated Components | Technology fingerprinting + nuclei CVE matching | | A07 | Auth Failures | Insecure cookies (Secure/HttpOnly/SameSite), session management | | A08 | Integrity Failures | Missing SRI on external scripts, deserialization indicators | | A09 | Logging Exposure | Exposed log files, stack traces, verbose error messages | | A10 | SSRF | URL parameter probing, AWS/GCP metadata endpoints, internal host access | | ➕ | Response Manipulation | JSON boolean flip, 403 bypass, header injection |

📁 Output Structure

./output/
└── your_project/
    └── 20250429_143022/
        ├── recon/
        │   ├── subdomains.txt       ← All discovered subdomains
        │   ├── urls.txt             ← Historical URLs
        │   ├── js_files.txt         ← JavaScript files
        │   └── params.txt           ← Parameterized URLs
        ├── enum/
        │   ├── live_hosts.txt       ← Confirmed live hosts
        │   ├── httpx_results.json   ← Tech stack, status codes
        │   └── ports.json           ← Open ports per host
        ├── scan/
        │   ├── nuclei_results.json  ← Raw nuclei findings
        │   ├── all_vulnerabilities.json
        │   └── attack_chains.json   ← AI-identified chains
        ├── fuzz/
        │   └── fuzz_results.json    ← XSS, SQLi, LFI results
        ├── analyze/
        │   └── final_analysis.json  ← AI analysis + prioritization
        └── report/
            ├── EXECUTIVE_SUMMARY.md     ← 👈 Start here
            ├── vuln1xss.md            ← HackerOne-ready report
            ├── vuln2sqli.md
            └── chain1ssrf_rce.md      ← Attack chain report

🧠 LLM Backend Comparison

| Backend | Cost | Speed | Quality | Best For | |---------|------|-------|---------|----------| | Ollama | 🆓 Free | 🐢 Slow (CPU) | ⭐⭐⭐ | Offline use, testing | | Groq | 🆓 Free | ⚡ Fast | ⭐⭐⭐⭐ | Daily hunting | | Anthropic | 💰 ~$0.01/hunt | 🚀 Fast | ⭐⭐⭐⭐⭐ | Final reports, critical analysis |

🧪 Test on Intentionally Vulnerable Sites

Practice legally before hunting real programs:

# Acunetix test site (SQLi, XSS, LFI and more)
python3 reconmind.py --target testphp.vulnweb.com --thorough
OWASP WebGoat (run locally)
python3 reconmind.py --target localhost:8080 --thorough
HackTheBox / TryHackMe targets (use VPN)
python3 reconmind.py --target 10.10.x.x --thorough

⚠️ Legal Disclaimer

This tool is for authorized security testing only. Always ensure you have explicit written permission before testing any target. The author is not responsible for any misuse or damage caused by this tool.

Only hunt on programs where you are authorized — HackerOne, Bugcrowd, Intigriti, or private programs you have permission for.

👨‍💻 About the Creator

🤝 Connect & Follow

⭐ Support This Project

This tool is free and open source. If it helped you:

• ⭐ Star this repo — helps others in the community discover it
• 📺 Subscribe to Encrypticle — free cybersecurity content in Hinglish
• 🐛 Share your findings — join our Discord and show what you found
• 🔄 Share this repo — help more Indian hunters get access to proper tools

🤝 Contributing

PRs are welcome! If you find a bug or want to add a feature:

• Fork the repo
• Create a branch: git checkout -b feature/your-feature
• Commit: git commit -m 'Add your feature'
• Push: git push origin feature/your-feature
• Open a Pull Request

📄 License

MIT License — free to use, modify, and distribute with attribution.