Argus
Argus, the all-seeing scanner suite.
Install
npx skills add awarexone/Agentic-Bug-Hunter --skill argus -g -a claude-code -y- Repository
- awarexone/Agentic-Bug-Hunter5.5k
- Category
- AI and agents
- Updated
- 7d ago
- License
- MIT
- Context cost
- Mediumabout 1,558 tokens
- Runs scripts
- No, instructions only
What it does
Argus, the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes, CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect injection). Use when a target exposes a JSON API, a login endpoint, JWT auth, a parameter that might reach the server, a chatbot/agent, or any endpoint suspected of a blind/out-of-band bug.
ARGUS, THE ALL-SEEING SCANNER SUITE
Named for Argus Panoptes, the hundred-eyed giant. Six "eyes" that surface what ordinary scans miss: two of the most common web2 classes (CORS, CRLF), the NoSQL "db" surface, JWT forging, blind-bug confirmation via OOB (the eye that sees the invisible, unblocks an entire severity band), and automated LLM red-teaming. All pure-Python, no new deps. Core logic is offline-testable.
0. ROUTING, which tool for what
| Signal on the target | Tool / command |
|---|---|
API reflects Origin, or ACAO/ACAC headers seen | /cors |
Param reaches a redirect / Location / log / response header | /crlf |
JSON login or {user,pass} body, Mongo/Mongoose stack | /nosqli |
Authorization: Bearer ey... / JWT in cookie or storage | /jwt-scan |
| Suspected blind SSRF/XXE/SQLi/RCE (no in-band signal) | /oob |
| Chatbot / agent / LLM feature | /llm-redteam |
1. CORS, /cors
bughunter/tools/cors_scanner.py https://api.target.com/me --cookie "session=..."
bughunter/tools/cors_scanner.py -l recon/target.com/urls/api.txt --json
Sends crafted Origin headers, classifies Access-Control-Allow-Origin /
Access-Control-Allow-Credentials:
- CRITICAL, reflects attacker origin with
ACAC: true→ cookie-auth'd cross-origin read (account-data exfil). - HIGH,
nullorigin trusted with credentials. - MEDIUM, reflects without creds (exploitable when auth = non-cookie token), or trusts http downgrade.
- Probes suffix/prefix regex bypass (
target.com.evil,notarget.com) and subdomain trust (chains with takeover).
Always pass --cookie with a live session, the credentialed path is the win.
2. CRLF / host-header, /crlf
bughunter/tools/crlf_scanner.py "https://target.com/r?u=x" --host-header
