Bug Bounty Automation with Python: The Secrets of Bug Hunting

Bug Bounty Automation with Python: The Secrets of Bug Hunting

Bug bounty hunting rewards two things: coverage and speed. The hunters at the top of leaderboards aren't necessarily better at finding vulnerabilities than everyone else they just look at more targets, faster, with less manual effort. That's where Python comes in. It's the duct tape of the bug bounty world: glue together reconnaissance tools, parse their output, filter the noise, and surface the signals that actually lead to payouts.

This guide walks through how to build a real automation pipeline in Python, the patterns experienced hunters use, and the mistakes that keep beginners stuck at low-severity reports.

Why Python Dominates Bug Bounty Automation

Most public bug bounty toolssubfinder, httpx, nuclei, ffuf, gauare written in Go for speed. So why Python on top of them?

Because the work that wins bounties isn't running tools. It's chaining them, deduplicating their output, enriching results with context, and noticing the one weird response in 50,000 that nobody else looked at. Python's requests, asyncio, httpx, and BeautifulSoup libraries make that orchestration trivial, and its ecosystem (pandas, sqlite3, regex) is unmatched for slicing through messy data.

The mental model: Go tools do the heavy lifting, Python does the thinking.

The Core Bug Bounty Automation Pipeline

Every serious automation setup follows roughly the same five stages:

1. Asset discovery find subdomains, IPs, and endpoints owned by the target

2. Liveness probing figure out what's actually reachable

3. Fingerprinting identify tech stacks, frameworks, and versions

4. Vulnerability scanning run templated checks against the live attack surface

5. Notification and triage get alerted only when something interesting appears

Let's build a minimal version of this in Python.

Stage 1: Subdomain Enumeration

import subprocess
import json

def enumerate_subdomains(domain: str) -> set[str]:
    sources = [
        ["subfinder", "-d", domain, "-silent"],
        ["assetfinder", "--subs-only", domain],
    ]
    subdomains = set()
    for cmd in sources:
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
            subdomains.update(line.strip() for line in result.stdout.splitlines() if line.strip())
        except (subprocess.TimeoutExpired, FileNotFoundError) as e:
            print(f"[!] {cmd[0]} failed: {e}")
    return subdomains

The secret here isn't the code it's running this on a schedule. New subdomains appear constantly. A cron job that diffs today's results against yesterday's surfaces fresh attack surface before anyone else sees it.

Stage 2: Async Liveness Probing

This is where Python's asyncio saves hours. Instead of probing 10,000 hosts one at a time, you fire them off in parallel:

import asyncio
import httpx

async def probe(client: httpx.AsyncClient, url: str) -> dict | None:
    try:
        r = await client.get(url, timeout=10, follow_redirects=True)
        return {
            "url": str(r.url),
            "status": r.status_code,
            "title": extract_title(r.text),
            "server": r.headers.get("server", ""),
            "length": len(r.content),
        }
    except Exception:
        return None

async def probe_all(hosts: list[str]) -> list[dict]:
    limits = httpx.Limits(max_connections=50)
    async with httpx.AsyncClient(limits=limits, verify=False) as client:
        tasks = [probe(client, f"https://{h}") for h in hosts]
        results = await asyncio.gather(*tasks)
    return [r for r in results if r]

Fifty concurrent connections will chew through 10,000 hosts in a few minutes. Stay polite don't hammer single targets with hundreds of threads.

Stage 3: Smart Diffing The Real Secret

Most beginners run their pipeline, look at the results, and feel overwhelmed. Pros never look at full output. They look at diffs.

import sqlite3
from datetime import datetime

def store_and_diff(results: list[dict], db_path: str = "recon.db") -> list[dict]:
    conn = sqlite3.connect(db_path)
    conn.execute("""CREATE TABLE IF NOT EXISTS hosts (
        url TEXT PRIMARY KEY, status INT, title TEXT,
        server TEXT, length INT, first_seen TEXT, last_seen TEXT
    )""")
    new_findings = []
    now = datetime.utcnow().isoformat()
    for r in results:
        existing = conn.execute("SELECT * FROM hosts WHERE url=?", (r["url"],)).fetchone()
        if not existing:
            new_findings.append(r)
            conn.execute("""INSERT INTO hosts VALUES (?,?,?,?,?,?,?)""",
                (r["url"], r["status"], r["title"], r["server"], r["length"], now, now))
        else:
            # Detect meaningful changes: status code, response size delta, title change
            if existing[1] != r["status"] or abs(existing[4] - r["length"]) > 500:
                new_findings.append({**r, "_changed": True})
            conn.execute("UPDATE hosts SET last_seen=? WHERE url=?", (now, r["url"]))
    conn.commit()
    return new_findings

This is the single biggest force multiplier in bug bounty automation. You're not hunting for vulnerabilities you're hunting for changes that signal new vulnerabilities. A new subdomain, a status code flip from 403 to 200, a response length jump of 50KB these are the signals worth investigating.

Stage 4: Targeted Vulnerability Scanning

Don't blast every host with every check. Use the fingerprinting data to scan smartly:

def select_nuclei_templates(host: dict) -> list[str]:
    templates = ["cves/", "exposures/"]
    server = host.get("server", "").lower()
    if "nginx" in server: templates.append("technologies/nginx/")
    if "apache" in server: templates.append("technologies/apache/")
    if host.get("status") == 401: templates.append("default-logins/")
    return templates

Running 5,000 targeted templates beats running 50,000 generic ones both in signal quality and in how quickly you get results.

Stage 5: Push Notifications

Automation is worthless if you have to check it manually. Wire it to Discord, Telegram, or Slack:

import httpx

def notify(webhook: str, findings: list[dict]):
    if not findings: return
    msg = f"🎯 {len(findings)} new findings:\n" + "\n".join(
        f"• [{f['status']}] {f['url']}" for f in findings[:10]
    )
    httpx.post(webhook, json={"content": msg})

The dream setup: you wake up, check your phone, see three new endpoints flagged overnight, and go investigate them with coffee in hand.