# Argus

Argus, the all-seeing scanner suite.

- Repository: https://github.com/awarexone/Agentic-Bug-Hunter (5532 stars)
- Category: AI and agents
- License: MIT
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add awarexone/Agentic-Bug-Hunter --skill argus -g -a claude-code -y`
Codex: `npx skills add awarexone/Agentic-Bug-Hunter --skill argus -g -a codex -y`
Cursor: `npx skills add awarexone/Agentic-Bug-Hunter --skill argus -g -a cursor -y`
Gemini CLI: `npx skills add awarexone/Agentic-Bug-Hunter --skill argus -g -a gemini-cli -y`

## Description

Argus, the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes, CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect injection). Use when a target exposes a JSON API, a login endpoint, JWT auth, a parameter that might reach the server, a chatbot/agent, or any endpoint suspected of a blind/out-of-band bug.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# ARGUS, THE ALL-SEEING SCANNER SUITE

> Named for Argus Panoptes, the hundred-eyed giant. Six "eyes" that surface what
> ordinary scans miss: two of the most common web2 classes (CORS, CRLF), the
> NoSQL "db" surface, JWT forging, **blind-bug confirmation via OOB** (the eye
> that sees the invisible, unblocks an entire severity band), and automated LLM
> red-teaming. All pure-Python, no new deps. Core logic is offline-testable.

---

## 0. ROUTING, which tool for what

| Signal on the target | Tool / command |
|---|---|
| API reflects `Origin`, or `ACAO`/`ACAC` headers seen | `/cors` |
| Param reaches a redirect / `Location` / log / response header | `/crlf` |
| JSON login or `{user,pass}` body, Mongo/Mongoose stack | `/nosqli` |
| `Authorization: Bearer ey...` / JWT in cookie or storage | `/jwt-scan` |
| Suspected **blind** SSRF/XXE/SQLi/RCE (no in-band signal) | `/oob` |
| Chatbot / agent / LLM feature | `/llm-redteam` |

---

## 1. CORS, `/cors`

```bash
bughunter/tools/cors_scanner.py https://api.target.com/me --cookie "session=..."
bughunter/tools/cors_scanner.py -l recon/target.com/urls/api.txt --json
```

Sends crafted `Origin` headers, classifies `Access-Control-Allow-Origin` /
`Access-Control-Allow-Credentials`:

- **CRITICAL**, reflects attacker origin **with** `ACAC: true` → cookie-auth'd cross-origin read (account-data exfil).
- **HIGH**, `null` origin trusted with credentials.
- **MEDIUM**, reflects without creds (exploitable when auth = non-cookie token), or trusts http downgrade.
- Probes suffix/prefix regex bypass (`target.com.evil`, `notarget.com`) and subdomain trust (chains with [takeover](../../commands/takeover.md)).

**Always pass `--cookie` with a live session**, the credentialed path is the win.

## 2. CRLF / host-header, `/crlf`

```bash
bughunter/tools/crlf_scanner.py "https://target.com/r?u=x" --host-header
```

The rest: https://github.com/awarexone/Agentic-Bug-Hunter/blob/HEAD/skills/argus/SKILL.md