A Conceptual Introduction to Automating Bug Bounties

1. Create an account on Zulip
   
2. Navigate to Settings > Your Bots > Add a new bot
   
3. Create a new generic bot named kenzer
   
4. Add all the configurations in configs/kenzer.conf
   
5. Install/Run using -
   
   • ./install.sh -b [if you need kenzer-compatible binaries to be installed]
     
   • ./install.sh [if you do not need kenzer-compatible binaries to be installed]
     
   • ./run.sh [if you do not need installation at all]
     
   • ./service.sh [initialize it as a service post-installation] (preferred)
     
   • bash swap.sh [in case you are facing memory issues]
6. Interact with kenzer using Zulip client, by adding bot to a stream or via DM.
   
7. Test @**kenzer** man as Zulip input to display available commands.
   
8. All the commands can be used by mentioning the chatbot using the prefix @**kenzer**.
   

• blacklist <target>,<regex> - initializes & removes blacklisted targets
• whitelist <target>,<regex> - initializes & keeps only whitelisted targets
• program <target>,<link> - initializes the program to which target belongs
• subenum <target> - enumerates subdomains
• repenum <target> - enumerates reputation of subdomains
• portenum <target> - enumerates open ports
• servenum <target> - enumerates services
• webenum <target> - enumerates webservers
• headenum <target> - enumerates additional info from webservers
• urlheadenum <target> - enumerates additional info from urls
• asnenum <target> - enumerates asn records
• dnsenum <target> - enumerates dns records
• conenum <target> - enumerates hidden files & directories
• urlenum <target> - enumerates urls
• socenum <target> - enumerates social media accounts
• subscan <target> - hunts for subdomain takeovers
• cscan[-<severity>] <target> - scan with customized templates
• cvescan[-<severity>] <target> - hunts for CVEs
• vulnscan[-<severity>] <target> - hunts for other common vulnerabilites
• urlcvescan[-<severity>] <target> - hunts for CVEs in URLs
• urlvulnscan[-<severity>] <target> - hunts for other common vulnerabilites in URLs
• endscan[-<severity>] <target> - hunts for vulnerablities in custom endpoints
• idscan[-<severity>] <target> - identifies applications running on webservers
• portscan <target> - scans open ports
• buckscan <target> - hunts for unreferenced aws s3 buckets
• favscan <target> - fingerprints webservers using favicon
• vizscan <target> - screenshots applications running on webservers
• enum <target> - runs all enumerator modules
• scan <target> - runs all scanner modules
• recon <target> - runs all modules
• hunt <target> - runs your custom workflow
• upload - switches upload functionality
• upgrade - upgrades kenzer to latest version
• monitor <target> - monitors ct logs for new subdomains
• monitor normalize - normalizes the enumerations from ct logs
• monitor db - monitors ct logs for domains in summary/domain.txt
• monitor autohunt <frequency(default=5)> - starts automated hunt while monitoring
• sync - synchronizes the local kenzerdb with github
• kenzer <module> - runs a specific modules
• kenzer man - shows this manual

Although few more modules are available & much more is going to be released in the course of time which can advance this workflow, yet this one is enough to get started with & listed below are few of its successful hunts.

COMPATIBILITY TESTED ON DEBIAN(x64) ONLY
RIGGED WITH LOGIC ISSUES
FEEL FREE TO SUBMIT PULL REQUESTS