Bug Bounty Recon Scanner

Production-ready attack surface mapper for bug bounty hunters, red teams, and DevSecOps. Discovers exposed admin panels, missing security headers, sensitive files, and HTTPS issues across domains. Built in with robust error handling, SSL bypass, and dataset export.

🎯 What It Does

The Bug Bounty Recon Scanner crawls your target domains and automatically flags high-impact vulnerabilities:

• Exposed Admin Panels (/admin, /wp-admin, /login, /dashboard) - no auth required
• Missing Security Headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options)
• Sensitive File Exposure (.env, config.json, backup.sql, .git/HEAD)
• HTTPS Issues (expired certs, HTTP fallback, weak configs)
• Page Analysis (admin detection, sensitive content regex, form detection)

Perfect for: HackerOne, Bugcrowd, Intigriti hunters needing fast recon on new invites.

🚀 Key Features

Feature	Status	Bounty Impact
22+ Admin Paths	✅ Live	A1:2025 Broken Access Control
6 Security Headers	✅ Scored 0-30	A5:2025 Security Misconfiguration
Risk Scoring	✅ 0-100 per URL	Prioritization
SSL Bypass	✅ ignoreHTTPSErrors	Expired cert scanning
Error Resilience	✅ Network failures → dataset	100% completion
Dataset Views	✅ High-risk filtering	Apify Console

⚙️ Technical Specs

✅ PlaywrightCrawler (Crawlee 3.15.3)
✅ maxConcurrency: 2 (stable)
✅ maxRequestRetries: 1 (fast fail)
✅ 45 req/min rate limit
✅ 25s navigation timeout
✅ 2GB RAM / 1 CPU (production)
✅ Python analyzer (pandas)

🎪 Quick Start

Apify Console (Recommended)

1. Deployed Actor
2. Input → Run → View Dataset

📋 Input Configuration

Parameter	Type	Description	Default
startUrls	array[{url:string}]	Required [{"url": "https://target.com"}]	[]
adminPaths	array[string]	["/admin", "/.env", "/config"]	22 paths
maxDepth	integer	Link crawling (0=disable)	2
maxRequests	integer	Total limit	500
checkXSS	boolean	Form reflection test	true
proxyConfiguration	object	Apify Proxy (RESIDENTIAL)	{}

Example Input:

{
  "startUrls": [
    {"url": "https://example.com"},
    {"url": "https://google-gruyere.appspot.com"}
  ],
  "maxRequests": 100,
  "adminPaths": ["/admin", "/.env", "/config", "/login"]
}

📊 Sample Output

{
  "url": "https://im.com/admin",
  "status": 200,
  "type": "page",
  "isHttps": true,
  "riskScore": 30,
  "riskTags": ["sensitive_leak", "missing_headers"],
  "headerFindings": {
    "strict-transport-security": {"status": "missing", "score": 0}
  },
  "pageFindings": {
    "isSensitive": true
  },
  "timestamp": "2025-12-12T17:00:00Z"
}

Dataset Views (Apify Console):

• High Risk (riskScore >= 70)
• Exposed Admins (exposed_admin tag)
• Network Errors (SSL failures, timeouts)

👥 Who Benefits

Role	Use Case
Bug Bounty Hunters	Map attack surface for HackerOne/Bugcrowd invites
Red Teamers	Engagement scoping + initial foothold discovery
DevSecOps	Pre-prod hardening audits across staging/prod
Pen Testers	Quick vuln discovery before Nuclei/ZAP deep scans
SREs	Monitor 3rd-party vendors for security drift

⚖️ Legal & Ethical Use

✅ Authorized targets only:

• Domains you own
• Bug bounty program scopes
• Authorized pentest engagements
• Your staging/prod environments

❌ Never scan:

• Random websites
• Competitor domains
• Without explicit permission

Rate limited to 45 req/min with 3 concurrent browsers to respect targets.

🔗 Integrations (Upcoming)

Dataset → Burp Suite (JSON import)
      → Nuclei templates (endpoint discovery)
      → Slack/Zapier (high-risk webhook)
      → Google Sheets (team sharing)
      → GitHub Issues (vuln tracking)

🛠️ File Structure

bug_bounty_recon_scanner/
├── .actor/
│   ├── actor.json              # Actor metadata
│   ├── input_schema.json       # Input form schema
│   ├── output_schema.json      # Output validation
│   └── dataset_schema.json     # Dataset views
├── src/
│   └── main.js                 # Crawlee + Playwright core
├── Dockerfile                  # Node + Playwright + Python
├── package.json               # Dependencies
└── README.md                  # This file

🐛 Troubleshooting

Issue	Solution
SSL Errors	Auto-bypassed (ignoreHTTPSErrors: true)
Network Timeouts	Dataset entry with network_error
Memory	2GB allocated
No Proxy	apify login → RESIDENTIAL

📈 Dataset Views

• High Risk (riskScore >= 70)
• Exposed Admins (riskTags contains "exposed_admin")
• Missing Headers (missing_headers tag)
• Dataset Export → JSON/CSV/Excel

🤝 Support

• Issues: Apify Console → Issues tab
• Telegram → t.me/Iamuendo
• Custom requests: Contact via Apify messaging

📜 Changelog

Version	Date	Changes
0.1.7	2025-12-12	Initial release
0.2	Soon™	WAF bypass + more paths

---

Built with ❤️ for the bug bounty community. Happy hunting!

Respect robots.txt | Stay legal | Report responsibly