Bugbounty Python Packages

bbot

The recursive internet scanner for hackers. 🧡

qbraid-core

Where qBraid users discuss, report bugs and submit feature requests.

s3scanner

Scan for misconfigured S3 buckets across S3-compatible APIs!

bugbounty-sa

Unofficial CLI/MCP server for bugbounty.sa (reports, programs, scope,flow-up) ⚙

dirsearch

Web path scanner

requests-ip-rotator

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

qbraid-cli

Where qBraid users discuss, report bugs and submit feature requests.

reflutter

Flutter Reverse Engineering Framework

apkleaks

Scanning APK file for URIs, endpoints & secrets.

netlas

Netlas.io Python SDK & CLI Tool

wayparam

Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).

ywh2bt

YesWeHack BugTracker

knock-subdomains

Knock Subdomain Scan

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

subdominator

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

cewler

CeWLeR - Custom Word List generator Redefined. CeWL alternative in Python, based on the Scrapy framework.

bloodrecon

BloodRecon — 🧠 Master the art of digital hunting with 34+ OSINT modules.

subx-recon

SubX is an open-source asset discovery framework that helps security professionals uncover and map internet-facing assets through subdomain enumeration and reconnaissance techniques.

reconninja

⚡ ReconNinja v10.6.0— 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.

taser

Python resource library for creating security related tooling

graphinder

🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️

webcap

An ultra lightweight web screenshot tool with advanced DOM analysis features.

scopez

Scopez verifies connectivity to target servers, reveals CDN presence, and provides detailed target insights like reachability and RDAP.