FindBounty

The all-in-one terminal toolkit for bug bounty recon, discovery, and vulnerability scanning.

FindBounty is a free, open-source, terminal-native Python CLI for the complete bug bounty and penetration testing workflow. Replace your pile of separately-installed Go binaries with one pip install — subdomain enumeration, subdomain takeover detection, passive URL harvesting, technology/WAF fingerprinting, content fuzzing, JS secret extraction, CORS/open-redirect checks, a Nuclei-style template engine, and optional OWASP ZAP active scanning. Works out of the box on Windows, macOS, and Linux.

View on GitHub ⭐

Why FindBounty

• Works out of the box — real recon in one pip install, no Go toolchain.
• Zero external binaries — native Python scanning engine.
• Terminal-first — one CLI, scriptable in CI and over SSH.
• Safe by default — rate limiting, scope enforcement, robots.txt respect.
• Boost mode — optionally fold in subfinder/httpx/nuclei.
• Continuous monitoring — delta scan that reports only what changed.

Quick Install

git clone https://github.com/tugrakaymakcioglu/FindBounty.git
cd FindBounty
pip install -e .          # or: pipx install .
findbounty doctor          # verify everything's wired up

Quick Start

findbounty init -t example.com                 # workspace + scope file
findbounty quick -t example.com                # fast single-host pass
findbounty scan -t example.com                 # full recon + scan pipeline
findbounty scan -t example.com --boost         # fold in subfinder/httpx/nuclei
findbounty monitor -d example.com              # continuous delta monitoring