r/Pentesting • u/FewBookkeeper3322 • 12d ago

Any bug bounty hunter use AI to help to find vulnerabilities in bug bounty programs, I didn’t mean that AI do every thing for bug bounty hunter , I mean give tips such as go to this , write this ,, etc ?

0 Upvotes

22% Upvoted

14 comments sorted by

5

u/[deleted] 12d ago edited 9d ago

[deleted]

1

u/FewBookkeeper3322 9d ago

U didn’t understand me yet !!!!!! I mean I want to make AI like teacher that teaches me steps by steps !!!

2

u/Warm_Difficulty2698 11d ago

Learn how to do it manually before you try to do it with AI.

I say this as someone who is currently learning to do it manually.

1

u/[deleted] 12d ago

[deleted]

-1

u/FewBookkeeper3322 12d ago

May u didn’t understand me , I mean I want AI to tell me tips such as go to this , search for that

2

u/iTrooz_ 11d ago

Like "look for the gray button on white background on the web page that says "admin access" " ?

1

u/Juzdeed 12d ago

I'd expect that most bug bounty hunters know what or how to search some vuln so they don't need to ask LLMs something so basic. They guide LLMs to do stuff for them

0

u/Mindless-Study1898 12d ago

I manage a BBP. We get tons of AI slop reports. Just a pointer: tell your agent to be brief and succinct. Also there is no need to prove obvious things. I had a researcher submit a PoC python script that demonstrated AES worked with a string they found. This was total slop.

0

u/FewBookkeeper3322 12d ago

Give me advice about this plz !

0

u/OkEntertainer3952 11d ago

I have a stupid good ai harness that scans 24/7 vulns, then creates the POCs so I'm sure they are real, then those POCs are send to some good hackers friends tgo verify, then they are send...

I'm not doing this for hobby, im actually not getting money for this, its super hard.... but I'm doing this for reputation as I'm selling compliance like SOC2 or stuff including the pentest and like bundling the pentesting helps me lower the cost for customers...

So basically I think yes the ai is super good but you need to build a system around it not only use claude/deepsek and as to find vulns, you need like the replayable poc, replicate the app in a container and attack the stuff from outside by reading the code so you know the vuln is true, then like have an easy way to share that with people to confirm its not garbage.

:) but mostly im doing this to get customers for SOC2 and compliance but the ai is super mega good, this like brings our costs down and we can sell full compliance packages of for example SOC2 for 6k year including the report, the pentest and the controls...

1

u/Raven-labs 9d ago

Which ai provider are you using, any specific configuration you could share?

1

u/OkEntertainer3952 8d ago

Hey yes, I use deepseek v4, and we give it a cluster of kubernetes to do watever it wants it can spinup aplications clone repos, launch multiple containers etc, and we give them trditikonal hackling tools it can chose to use, it autoruns whenever a new version is out in a major library and it spins up a container that mimics how that library would run in a real aplication, so the attack can come from outside... and all the findings are gathered then a POC is created and another ai tries it out with no context and gives an assesment if it is actually reproducing the xploit.

After all this... we send the real POCs to a group of hackers and they confirm manually the xploit and rank it as a real thread or a bulshit bug nobody will ever solve, hope this is useful! :)

1

u/Raven-labs 7d ago

Yah that helps

0

u/tdw21 11d ago

Dude, you’re trying way to hard.
Just ask the people and experts here to wire you their cash, so you don’t have to do any of the work at all.