Bug Bounty Tool: El Kraken

The problem: automating end to end#

One of the keys to succeeding at bug bounty is automating as many of the manual processes that eat up our time as possible. Those processes are basically two: recon and exploitation of known vulnerabilities (CVEs).

In the community you can find tools published on GitHub or on specialised blogs that automate some phases of these two big processes: subfinder, nuclei, amass and so on. But none of them covers the process end to end, or at least not a high percentage of it.

The premises behind El Kraken#

Running into this problem, several months ago I decided to build my own, more complete tool. There were three premises:

• It had to be modular, so I could update it or add new analysis features easily.
• It had to let me reuse the tooling that already exists in the community.
• It had to take the output of the earlier modules as input for the following ones.

So, with help from ChatGPT and my own bash scripting knowledge, I built a tool I called “El Kraken”.

How it works#

El Kraken uses well-known community tools such as nuclei, subfinder, wayback and dirsearch. Each one covers a key phase of the automated process, and the results each one produces are used as input for the next ones, in order to automate the process end to end based on expected results.

The tool is written entirely in bash scripting, so it leans heavily on the pipe | helper to chain OS executions, on grep, awk and cat to shape the output as needed, and on IO streams to persist results to text files.

Those results can be reviewed manually or fed into visualisation tooling, Kibana for instance. I wrote a separate post about exactly that: integrating GitHub Actions + ELK into bug bounty.

The repository#

Here is the GitHub repository for the tool so you can use it; it already includes a README with installation and usage instructions.

I hope it helps you cut down the routine manual reviews in your bug bounty methodology, or even serves as inspiration or a base to build your own automated tooling. I am open to criticism and improvements, and if you want to contribute a PR to the repository with an improvement or a new feature already implemented, it is more than welcome.