Turn security signals into something you can act on.
A workbench for investigating threats and vulnerabilities, connecting scattered findings to the systems they affect.
Explore how it works ↓Explore the project
Open the design and demonstrations, then follow the references for more detail.
The design, in more detail
Definition
A personal offensive security and threat intelligence workbench orchestrating multi-vector reconnaissance, vulnerability correlation, and structured CVSS reporting.
The problem
Modern attack surfaces are vast and constantly mutating. Security engineers are plagued by tool sprawl, disjointed reconnaissance outputs, and manual correlation bottlenecks. API vulnerabilities like Broken Object Level Authorization (BOLA) and multi-step authorization bypasses slip through conventional single-request scanners.
The approach
BugZap provides an end-to-end autonomous CTI loop in a native pywebview desktop environment with an embedded Hetty intercepting proxy. It orchestrates 129 specialized engines through 6 unified execution phases—from asset discovery and ASN perimeter mapping to tri-state BOLA verification and automated disclosure reports.
How it works
- 15-Stage Reconnaissance: Performs passive DNS resolution, ASN perimeter mapping, TLS certificate mining, and JavaScript endpoint extraction.
- Tri-State BOLA Detection: Generates cross-tenant credential pairs to test unauthorized object manipulation across REST and GraphQL endpoints.
- Embedded Hetty Interceptor: Transparently intercepts, modifies, and replays HTTP/2 traffic locally with millisecond packet inspection.
- 18-Stage Exploitation Matrix: Tests for SSRF, SQLi, IDOR, race conditions, and deserialization vulnerabilities with bounded safety constraints.
- Automated Disclosure Compilation: Formats discovered vulnerabilities into standardized CVSS v3.1 reports ready for bug bounty programs or enterprise remediation.
Project notes
- Analysis Engines
- 129 Integrated Tools
- Execution Stages
- 15 Recon + 18 Attack
- Proxy Engine
- Embedded Hetty Core
These are the project’s documented design notes. Consult the linked implementation and its version before relying on a specific capability.
Development history & next steps
Core Reconnaissance Engine
Built unified CLI orchestrator chaining subdomain enumeration, port scanning, and URL discovery.
Hetty Proxy & BOLA Synthesis
Embedded lightweight Go-based proxy and tri-state cross-account authorization testing.
Full Desktop Suite
Built pywebview desktop UI workbench with automated CVSS scoring and structured database storage.
What comes next
Integrating local-first LLM agents for natural-language protocol reverse-engineering and zero-day endpoint discovery.
Source material & related links
Follow the documentation, repositories, and related sites behind this project.
Pywebview native application, Hetty intercepting proxy bindings, and 129 engine adapters.
Architectural overview of multi-stage autonomous vulnerability correlation.
Topics: Cybersecurity · CTI · Pentesting · BOLA · Reconnaissance · Python · Go