Bug Bounty Lab101

What it is

bugbounty-lab101 (GitHub: DevCop95) is a shell-based HackerOne bug bounty workspace. The entry point is bugbounty/bugbounty-hunter.sh, which drives a per-program workflow: create a program file, document scope, run a full recon→report pipeline, and complete an H1-template report. The 400+ tool arsenal and local VM lab are positioned as support, not the starting point.

How it works

The workflow is command-driven and scope-gated. Every active-scanning command reads programs/*.md and refuses to run until scope is documented — scope must print Scope OK before full will touch a target. Setup and run sequence, verbatim:

cd bugbounty-lab101
chmod +x bugbounty/*.sh auto-scanner/*.sh
# If the repository was cloned without submodules:
git submodule update --init --recursive

cd bugbounty
./bugbounty-hunter.sh new program-name
# Edit ../programs/program-name.md with the EXACT scope from the H1 policy
./bugbounty-hunter.sh scope target.com     # must say "Scope OK" before proceeding
./bugbounty-hunter.sh full target.com      # recon -> vuln -> brute -> secrets -> api -> report
./bugbounty-hunter.sh report target.com

An optional passive Shodan CTL integration uses the pinned vendor/shodan_reconsx submodule (when recons101x isn't installed); its hostnames are scope-filtered before any HTTP probing.

What to do

The T3MP3ST "offensive engine" is a separate, .gitignored repo you clone and wire in yourself:

git clone https://github.com/DevCop95/T3MP3ST t3mp3st
cd t3mp3st && npm install && cd ..
cp t3mp3st/.env.example t3mp3st/.env
# Edit t3mp3st/.env with your LLM provider key(s)
./start-server.sh
# War Room → http://127.0.0.1:3333/ui/

It also runs without API keys by connecting a local coding agent (Claude Code, Codex, Hermes) via the War Room Settings, then describing targets in plain English. Before submitting, read docs/hackerone-workflow.md for dedup and post-submission steps.

Caveats

• The scope gate is enforced only by bugbounty-hunter.sh's active-scanning commands. Anything you drive through T3MP3ST's War Room or the 400+ tool arsenal directly is not subject to that check — the boundary you're relying on is one script.
• T3MP3ST is a distinct repo from the same unvetted author that runs npm install and is designed to let an LLM agent autonomously "hunt zero-days" against targets you describe in natural language. Connecting your Claude Code/Codex agent hands broad, unsupervised execution to that framework; the natural-language target step sits outside the file-based scope enforcement entirely.
• Both repos are single-author (DevCop95) with no version, release, or provenance data on the page — treat as unaudited before pointing it at any live program.