web3-ai-tools
starsforks
How to install web3-ai-tools?
shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-ai-tools
$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-ai-toolsAI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery.
SKILL.md
| 1 | # AI TOOLS ARSENAL |
| 2 | > AI-powered automation for every phase of Web3 bug hunting. |
| 3 | > Replaces: 28-cai-framework, 29-claude-skills-security, 30-shannon-ai-pentester, |
| 4 | > 31-luan1ao-agent, 32-ai-generated-code-hunting, 33-smartguard-agent |
| 5 | |
| 6 | --- |
| 7 | |
| 8 | ## TOOL SELECTION GUIDE |
| 9 | |
| 10 | | Tool | Target Type | Best For | Cost | |
| 11 | |------|------------|----------|------| |
| 12 | | **Shannon** | Web apps + API (white-box) | IDOR, SQLi, SSRF, auth bypass | ~$50/run | |
| 13 | | **LuaN1ao** | Any web target | Autonomous OWASP Top 10 | $0.09/exploit | |
| 14 | | **CAI** | Web/network/IoT | Bug bounty recon + validation | API cost only | |
| 15 | | **SmartGuard** | Solidity files | Auto PoC generation for SC bugs | API cost | |
| 16 | | **AI Code Hunt** | AI-written contracts | Bugs Slither/Forge miss | Manual (patterns) | |
| 17 | |
| 18 | **For DeFi smart contracts:** SmartGuard + AI Code Hunt patterns |
| 19 | **For DeFi web frontends:** Shannon (web layer) + skills 01-07 (contract layer) |
| 20 | **For CTF/web targets:** LuaN1ao or CAI |
| 21 | |
| 22 | --- |
| 23 | |
| 24 | ## TOOL 1: SHANNON — AUTONOMOUS WEB PENTESTER |
| 25 | |
| 26 | **Source:** github.com/KeygraphHQ/shannon |
| 27 | **Score:** 96.15% on XBOW source-aware benchmark (100/104 exploits) |
| 28 | **Model:** Claude Agent SDK (Anthropic) |
| 29 | **Cost:** ~$50/run | ~1-1.5 hours |
| 30 | |
| 31 | ### What Shannon Finds |
| 32 | ``` |
| 33 | ✅ IDOR — changes IDs across accounts, tests all API routes |
| 34 | ✅ SQLi — error-based and time-based blind |
| 35 | ✅ Command injection — OS separators in all inputs |
| 36 | ✅ XSS — reflected + stored (confirmed in real browser) |
| 37 | ✅ SSRF — webhook/fetch URL inputs, OOB callbacks |
| 38 | ✅ JWT attacks — alg:none, RS256→HS256 confusion, weak keys |
| 39 | ✅ Auth bypass — session fixation, forgot-password flaws |
| 40 | ✅ Privilege escalation — viewer→admin, cross-tenant |
| 41 | ✅ OAuth misconfigs — state parameter, redirect_uri |
| 42 | |
| 43 | ❌ Race conditions (sequential, not concurrent) |
| 44 | ❌ Business logic (needs domain expertise) |
| 45 | ❌ Smart contract bugs — use files 01-07 for these |
| 46 | ❌ Novel techniques not in prompt templates |
| 47 | ``` |
| 48 | |
| 49 | ### Setup |
| 50 | ```bash |
| 51 | git clone https://github.com/KeygraphHQ/shannon |
| 52 | cd shannon && npm install |
| 53 | cp .env.example .env # Add: ANTHROPIC_API_KEY=sk-ant-... |
| 54 | npm run build |
| 55 | |
| 56 | # Direct mode (simple): |
| 57 | node dist/index.js --config configs/my-target.yaml |
| 58 | |
| 59 | # Docker (includes nmap, subfinder, whatweb): |
| 60 | docker run --env-file .env \ |
| 61 | -v ./configs:/app/configs \ |
| 62 | keygraph/shannon:latest \ |
| 63 | --config configs/my-target.yaml |
| 64 | ``` |
| 65 | |
| 66 | ### Config Template |
| 67 | ```yaml |
| 68 | # configs/target.yaml |
| 69 | target: |
| 70 | name: "DeFi App Frontend" |
| 71 | url: "https://app.DEFI.com" |
| 72 | source_path: "/path/to/frontend/clone" # white-box = much better |
| 73 | additional_context: | |
| 74 | DeFi app. Users connect MetaMask wallets. |
| 75 | Focus on: IDOR in /api/portfolio?address=0x..., |
| 76 | GraphQL introspection, JWT handling, SSRF via webhooks. |
| 77 | DO NOT interact with smart contracts. |
| 78 | |
| 79 | authentication: |
| 80 | login_type: form # form | sso | api | basic |
| 81 | login_url: "https://app.DEFI.com/login" |
| 82 | credentials: |
| 83 | username: "attacker@test.com" |
| 84 | password: "testpassword" |
| 85 | login_flow: |
| 86 | - "Fill in username field with $username" |
| 87 | - "Fill in password field with $password" |
| 88 | - "Click the login button" |
| 89 | success_condition: |
| 90 | type: url |
| 91 | value: "/dashboard" |
| 92 | |
| 93 | test_accounts: |
| 94 | - username: "attacker@test.com" |
| 95 | password: "testpassword" |
| 96 | role: "viewer" |
| 97 | - username: "victim@test.com" |
| 98 | password: "victimpassword" |
| 99 | role: "admin" |
| 100 | |
| 101 | scope: |
| 102 | include: ["https://app.DEFI.com/*"] |
| 103 | exclude: ["https://app.DEFI.com/admin/destroy-all"] |
| 104 | ``` |
| 105 | |
| 106 | ### The Shannon Workflow |
| 107 | ``` |
| 108 | YOUR PLAN: |
| 109 | 1. Setup config + 2 test accounts (15 min) |
| 110 | 2. Run Shannon (90 min) → do MANUAL business logic testing while it runs |
| 111 | 3. Review Shannon findings (30 min) → verify each PoC manually |
| 112 | 4. Manual hunting for what Shannon misses: race conditions, business logic, contract layer (60 min) |
| 113 | 5. Write reports adapting Shannon's PoC to Immunefi/H1 format (30 min) |
| 114 | |
| 115 | Shannon + manual = 4 hours → coverage that takes 2 days manually. |
| 116 | ``` |
| 117 | |
| 118 | **WARNINGS:** |
| 119 | - NEVER run on production without explicit written authorization |
| 120 | - Check program rules: many prohibit automated scanning → instant rejection + ban |
| 121 | - Only worth it for targets with max bounty ≥ $5K (costs ~$50) |
| 122 | - Always verify findings manually before submitting — LLMs can hallucinate |
| 123 | |
| 124 | --- |
| 125 | |
| 126 | ## TOOL 2: LUAN1AO — DUAL-GRAPH AUTONOMOUS PENTESTER |
| 127 | |
| 128 | **Source:** github.com/SanMuzZzZz/LuaN1aoAgent |
| 129 | **Score:** 90.4% on XBOW Benchmark (beats commercial XBOW at 85%) |
| 130 | **Architecture:** Causal Graph + Plan-on-Graph (PoG) | P-E-R (Planner-Executor-Reflector) |
| 131 | **Cost:** $0.09 median per exploit |
| 132 | |
| 133 | ### What Makes LuaN1ao Different |
| 134 | - **Causal Graph:** Every action requires evidence → no hallucinated attacks |
| 135 | - **Plan-on-Graph:** DAG that rewrites itself mid-test → parallel independent paths |
| 136 | - **Reflector:** L1-L |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
