Bug Bounty Recon Scanner Production-ready attack surface mapper for bug bounty hunters, red teams, and DevSecOps. Discovers exposed admin panels, missing security headers, sensitive files, and HTTPS issues across domains. Built in with robust error handling, SSL bypass, and dataset export. ## 🎯 What It Does The Bug Bounty Recon Scanner crawls your target domains and automatically flags high-impact vulnerabilities: - Exposed Admin Panels (/admin, /wp-admin, /login, /dashboard) - no auth required - Missing Security Headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options) - Sensitive File Exposure (.env, config.json, backup.sql, .git/HEAD) - HTTPS Issues (expired certs, HTTP fallback, weak configs) - Page Analysis (admin detection, sensitive content regex, form detection) Perfect for: HackerOne, Bugcrowd, Intigriti hunters needing fast recon on new invites. ## 🚀 Key Features | Feature | Status | Bounty Impact | | :-- | :-- | :-- | | 22+ Admin Paths | ✅ Live | A1:2025 Broken Access Control | | 6 Security Headers | ✅ Scored 0-30 | A5:2025 Security Misconfiguration | | Risk Scoring | ✅ 0-100 per URL | Prioritization | | SSL Bypass | ✅ ignoreHTTPSErrors | Expired cert scanning | | Error Resilience | ✅ Network failures → dataset | 100% completion | | Dataset Views | ✅ High-risk filtering | Apify Console | ## ⚙️ Technical Specs ✅ PlaywrightCrawler (Crawlee 3.15.3) ✅ maxConcurrency: 2 (stable) ✅ maxRequestRetries: 1 (fast fail) ✅ 45 req/min rate limit ✅ 25s navigation timeout ✅ 2GB RAM / 1 CPU (production) ✅ Python analyzer (pandas) ## 🎪 Quick Start ### Apify Console (Recommended) 1. Deployed Actor 2. Input → Run → View Dataset ## 📋 Input Configuration | Parameter | Type | Description | Default | | :-- | :-- | :-- | :-- | | startUrls | array[{url:string}] | Required [{"url": "https://target.com"}] | [] | | adminPaths | array[string] | ["/admin", "/.env", "/config"] | 22 paths | | maxDepth | integer | Link crawling (0=disable) | 2 | | maxRequests | integer | Total limit | 500 | | checkXSS | boolean | Form reflection test | true | | proxyConfiguration | object | Apify Proxy (RESIDENTIAL) | {} | Example Input: json { "startUrls": [ {"url": "https://example.com"}, {"url": "https://google-gruyere.appspot.com"} ], "maxRequests": 100, "adminPaths": ["/admin", "/.env", "/config", "/login"] } ## 📊 Sample Output json { "url": "https://im.com/admin", "status": 200, "type": "page", "isHttps": true, "riskScore": 30, "riskTags": ["sensitive_leak", "missing_headers"], "headerFindings": { "strict-transport-security": {"status": "missing", "score": 0} }, "pageFindings": { "isSensitive": true }, "timestamp": "2025-12-12T17:00:00Z" } Dataset Views (Apify Console): - High Risk (riskScore >= 70) - Exposed Admins (exposed_admin tag) - Network Errors (SSL failures, timeouts) ## 👥 Who Benefits | Role | Use Case | | :-- | :-- | | Bug Bounty Hunters | Map attack surface for HackerOne/Bugcrowd invites | | Red Teamers | Engagement scoping + initial foothold discovery | | DevSecOps | Pre-prod hardening audits across staging/prod | | Pen Testers | Quick vuln discovery before Nuclei/ZAP deep scans | | SREs | Monitor 3rd-party vendors for security drift | ## ⚖️ Legal \& Ethical Use ✅ Authorized targets only: - Domains you own - Bug bounty program scopes - Authorized pentest engagements - Your staging/prod environments ❌ Never scan: - Random websites - Competitor domains - Without explicit permission Rate limited to 45 req/min with 3 concurrent browsers to respect targets. ## 🔗 Integrations (Upcoming) Dataset → Burp Suite (JSON import) → Nuclei templates (endpoint discovery) → Slack/Zapier (high-risk webhook) → Google Sheets (team sharing) → GitHub Issues (vuln tracking) ## 🛠️ File Structure bug_bounty_recon_scanner/ ├── .actor/ │ ├── actor.json # Actor metadata │ ├── input_schema.json # Input form schema │ ├── output_schema.json # Output validation │ └── dataset_schema.json # Dataset views ├── src/ │ └── main.js # Crawlee + Playwright core ├── Dockerfile # Node + Playwright + Python ├── package.json # Dependencies └── README.md # This file ## 🐛 Troubleshooting | Issue | Solution | | :-- | :-- | | SSL Errors | Auto-bypassed (ignoreHTTPSErrors: true) | | Network Timeouts | Dataset entry with network_error | | Memory | 2GB allocated | | No Proxy | apify login → RESIDENTIAL | ## 📈 Dataset Views - High Risk (riskScore >= 70) - Exposed Admins (riskTags contains "exposed_admin") - Missing Headers (missing_headers tag) - Dataset Export → JSON/CSV/Excel ## 🤝 Support - Issues: Apify Console → Issues tab - Telegram → t.me/Iamuendo - Custom requests: Contact via Apify messaging ## 📜 Changelog | Version | Date | Changes | | :-- | :-- | :-- | | 0.1.7 | 2025-12-12 | Initial release | | 0.2 | Soon™ | WAF bypass + more paths | *** Built with ❤️ for the bug bounty community. Happy hunting! Respect robots.txt | Stay legal | Report responsibly