@accounta/dsh-bounty-hunt 0.1.0

package/README.md

@@ -0,0 +1,243 @@
+# DSH Bounty Hunt Plugin
+
+DeepSeek Harness plugin for automated bug bounty hunting workflows.
+
+## Features
+
+- **Target Management**: Add, track, and scope targets across multiple bounty programs
+- **Finding Tracking**: Log, verify, and organize security findings
+- **IDOR Testing**: Dedicated tools for testing insecure direct object reference vulnerabilities
+- **Report Generation**: Automatic markdown/JSON/HTML report generation
+- **Agent Presets**: Pre-configured agents for reconnaissance, exploitation, and reporting
+
+## Installation
+
+### Quick Install (Recommended)
+
+```bash
+cd ~/bounty-lab/dsh-bounty-hunt
+./install.sh
+```
+
+This automatically registers the plugin in your DSH Web profile.
+
+### Manual Install
+
+1. **Get the absolute path:**
+```bash
+echo ~/bounty-lab/dsh-bounty-hunt
+# Output: /home/edslawn/bounty-lab/dsh-bounty-hunt (or your actual path)
+```
+
+2. **Edit `~/.dsh/profiles/web/cordis.patch.yml`:**
+```yaml
+patch:
+  - insert:
+      - id: bounty-hunt-plugin
+        name: /home/edslawn/bounty-lab/dsh-bounty-hunt/src/index.ts
+        config:
+          enabled: true
+```
+
+3. **Start DSH:**
+```bash
+dsh web
+```
+
+### Verify Installation
+
+```bash
+dsh bounty/list-targets
+# Should return: { ok: true, targets: [] }
+```
+
+## Usage
+
+### Add a Target
+
+```bash
+dsh bounty/add-target \
+  --name "Acme Inc" \
+  --domain "acme.com" \
+  --program "HackerOne" \
+  --scope '["*.acme.com","api.acme.com"]' \
+  --outOfScope '["test.acme.com"]'
+```
+
+### Test IDOR Vulnerability
+
+```bash
+dsh bounty/test-idor \
+  --endpoint "https://api.target.com/submissions/\{id\}" \
+  --idParam "id" \
+  --authHeader "Bearer YOUR_TOKEN" \
+  --testIds '["submission_1","submission_2","submission_3"]'
+```
+
+### Log a Finding
+
+```bash
+dsh bounty/add-finding \
+  --targetName "Acme Inc" \
+  --severity "critical" \
+  --title "SQL Injection in Login Form" \
+  --description "The username field is vulnerable to SQL injection" \
+  --endpoint "https://acme.com/login" \
+  --proof "' OR '1'='1"
+```
+
+### Generate Report
+
+```bash
+dsh bounty/generate-report \
+  --targetName "Acme Inc" \
+  --format "markdown"
+```
+
+## Agent Presets
+
+### Recon Agent
+
+Specialized for target enumeration and attack surface discovery:
+
+```bash
+dsh --preset recon-agent
+```
+
+Capabilities:
+- Add and manage targets
+- Verify scope compliance
+- List active targets
+
+### Exploit Agent
+
+Specialized for vulnerability discovery and testing:
+
+```bash
+dsh --preset exploit-agent
+```
+
+Capabilities:
+- Test IDOR vulnerabilities
+- Log findings with proof
+- Verify reproducibility
+
+### Reporting Agent
+
+Specialized for documentation and submission:
+
+```bash
+dsh --preset reporting-agent
+```
+
+Capabilities:
+- List findings by severity
+- Generate formatted reports
+- Manage submission status
+
+## Workflow Example
+
+### 1. Start with Recon
+
+```bash
+dsh --preset recon-agent
+# Claude> Add target Acme Inc...
+# Claude> Verify scope for api.acme.com...
+```
+
+### 2. Switch to Exploitation
+
+```bash
+dsh --preset exploit-agent
+# Claude> Test IDOR on /api/submissions/{id}...
+# Claude> Log critical finding...
+```
+
+### 3. Generate Report
+
+```bash
+dsh --preset reporting-agent
+# Claude> Generate markdown report for Acme Inc...
+# Claude> Summarize findings by severity...
+```
+
+## Integration with Bounty-Lab
+
+The plugin integrates with your existing bounty-lab infrastructure:
+
+```
+~/bounty-lab/
+├── dsh-bounty-hunt/          # This plugin
+├── methodology/              # Your existing methodology docs
+├── targets/                  # Your target research
+└── nuclei-templates/         # Your custom templates
+```
+
+Future enhancements can bridge:
+- Nuclei template execution
+- Existing exploit PoCs
+- Historical finding data
+- Methodologies and playbooks
+
+## Architecture
+
+The plugin uses Cordis' service model:
+
+```typescript
+interface BountyHuntService {
+  targets: BountyTarget[]
+  findings: Finding[]
+  addTarget(target: BountyTarget): void
+  addFinding(finding: Finding): void
+  verifyFinding(id: string): void
+}
+```
+
+All state is maintained in memory during the session. For persistence, hook into `ctx.storage` to save findings to SQLite.
+
+## Extending the Plugin
+
+### Add a Custom Tool
+
+```typescript
+ctx.tools.define('bounty/my-custom-scan', {
+  description: 'My custom vulnerability scanner',
+  parameters: { /* ... */ },
+}, async (args) => {
+  // Implementation
+  return { ok: true, result: 'data' }
+})
+```
+
+### Add an Agent Preset
+
+Edit `dsh-bundle.yml` and add to `preset-agents`:
+
+```yaml
+preset-agents:
+  my-agent:
+    description: Custom hunting agent
+    tools: [bounty/...]
+    systemPrompt: >
+      Custom instruction...
+```
+
+## Known Limitations
+
+- Current IDOR testing is a framework; actual HTTP testing requires integration with curl/fetch
+- Findings stored in memory only (not persisted between sessions)
+- No platform API integration yet (HackerOne, Intigriti, Bugcrowd)
+
+## Roadmap
+
+- [ ] HTTP client integration (real IDOR testing)
+- [ ] SQLite persistence for findings
+- [ ] Platform API connectors
+- [ ] Nuclei integration
+- [ ] Multi-target orchestration
+- [ ] Automated verification checks
+- [ ] Slack/Discord reporting
+
+## Contributing
+
+Open an issue or PR to improve the plugin!

package/dsh-bundle.yml

@@ -0,0 +1,51 @@
+# DSH Bounty Hunt Bundle
+# Registers bounty hunting tools and agents
+
+rows:
+  - id: bounty-hunt-core
+    package: '@edslawn/dsh-bounty-hunt'
+    config:
+      description: Core bug bounty hunting plugin
+      features:
+        - target-management
+        - idor-testing
+        - finding-tracking
+        - report-generation
+
+preset-agents:
+  recon-agent:
+    description: Reconnaissance agent for target enumeration
+    tools:
+      - bounty/add-target
+      - bounty/list-targets
+      - bounty/scope-verify
+    systemPrompt: >
+      You are a reconnaissance agent for bug bounty hunting.
+      Your role is to help identify and verify attack surface for targets.
+      Always verify scope before testing any endpoint.
+      Focus on finding new subdomains, APIs, and services.
+
+  exploit-agent:
+    description: Exploitation and vulnerability testing agent
+    tools:
+      - bounty/test-idor
+      - bounty/add-finding
+      - bounty/verify-finding
+    systemPrompt: >
+      You are an exploitation agent for bug bounty hunting.
+      Your role is to identify and test potential vulnerabilities.
+      Always follow responsible disclosure practices.
+      Focus on high-impact findings (RCE, auth bypass, data exposure).
+      Document clear reproduction steps for every finding.
+
+  reporting-agent:
+    description: Report generation and finding management
+    tools:
+      - bounty/list-findings
+      - bounty/generate-report
+      - bounty/add-finding
+    systemPrompt: >
+      You are a reporting agent for bug bounty hunting.
+      Your role is to organize findings, generate reports, and track submission status.
+      Prioritize findings by severity and impact.
+      Format clear, actionable reports for bounty programs.

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@accounta/dsh-bounty-hunt",
+  "version": "0.1.0",
+  "description": "DeepSeek Harness plugin for bug bounty hunting automation",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "files": [
+    "lib",
+    "dsh-bundle.yml"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc --watch",
+    "test": "vitest"
+  },
+  "keywords": [
+    "bug-bounty",
+    "security",
+    "penetration-testing",
+    "recon",
+    "exploit"
+  ],
+  "author": "edslawn",
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/dsh": "*"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh": "workspace:*",
+    "@types/node": "^22",
+    "typescript": "^5",
+    "vitest": "^2"
+  },
+  "dsh": {
+    "bundle": "dsh-bundle.yml"
+  }
+}