The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

2026-06-19 06:11:40 -07:00
commit eb1fad4ecc
28 changed files with 2501 additions and 0 deletions
--- a/engine/ollama-brain.sh
+++ b/engine/ollama-brain.sh
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# The Analyzer - Ollama Brain
+# Decision engine that picks attack vectors based on recon data
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/utils.sh"
+
+ollama_decide() {
+  local target="$1"
+  local domain=$(get_domain "$target")
+  local recon_file="$REPORTS_DIR/.${domain}_recon.txt"
+  
+  print_brain "Consulting Ollama ($OLLAMA_MODEL) on attack strategy..."
+  
+  if [ ! -f "$recon_file" ]; then
+    print_warn "No recon data found. Running blind."
+    RECON_SUMMARY="No reconnaissance data available."
+  else
+    RECON_SUMMARY=$(cat "$recon_file")
+  fi
+  
+  # Available vectors metadata
+  local vector_list=""
+  for f in "$VECTORS_DIR"/*.sh; do
+    local name=$(basename "$f" .sh)
+    local num=$(echo "$name" | cut -d- -f1)
+    local desc=$(head -10 "$f" | grep "^# Desc:" | sed 's/^# Desc: //')
+    local detect=$(head -10 "$f" | grep "^# Detect:" | sed 's/^# Detect: //')
+    local severity=$(head -10 "$f" | grep "^# Severity:" | sed 's/^# Severity: //')
+    vector_list+="$num: ${name#?-} | $desc | Triggers: $detect | Severity: $severity\n"
+  done
+  
+  # Write prompts to temp files to avoid heredoc parsing issues
+  local sys_file=$(mktemp)
+  local usr_file=$(mktemp)
+  
+  cat > "$sys_file" << EOF
+You are The Analyzer, an autonomous security testing engine for authorized bug bounty hunting.
+You analyze reconnaissance data and select the most effective attack vectors.
+
+RULES:
+1. Only recommend vectors with CLEAR EVIDENCE they will work based on recon data
+2. Prioritize HIGH and CRITICAL severity vectors
+3. Recommend 5-10 vectors max
+4. Order by likelihood of success, not just severity
+5. Include a brief reason for each recommendation
+6. NEVER recommend attacking systems without authorization
+7. Focus on: SQLi, XSS, LFI, RCE, SSRF, IDOR, API abuse, auth bypass
+
+Return your response as a numbered list in this EXACT format:
+## DECISION
+1. <vector_number>: <reason>
+2. <vector_number>: <reason>
+
+## SUMMARY
+<brief strategy summary>
+EOF
+
+  cat > "$usr_file" << EOF
+TARGET: $target
+DOMAIN: $domain
+
+RECONNAISSANCE DATA:
+$RECON_SUMMARY
+
+AVAILABLE ATTACK VECTORS:
+$vector_list
+
+Analyze the recon data and select the best attack vectors to run. Return ONLY the numbered list of vectors to execute and a brief summary.
+EOF
+
+  print_brain "Analyzing recon data and selecting vectors..."
+  
+  local decision=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
+  
+  rm -f "$sys_file" "$usr_file"
+  
+  echo "$decision"
+}
+
+# Extract vector numbers from Ollama's decision
+parse_decision() {
+  local decision="$1"
+  echo "$decision" | perl -nle 'print $1 if /^\d+\.\s*(\d+)/' | head -$MAX_VECTORS
+}
+
+# Rate a finding with Ollama
+rate_finding() {
+  local finding="$1"
+  local target="$2"
+  
+  local sys_file=$(mktemp)
+  local usr_file=$(mktemp)
+  
+  cat > "$sys_file" << 'SYS'
+You are a vulnerability severity assessor. Rate findings as CRITICAL, HIGH, MEDIUM, LOW, or INFO based on OWASP standards. Return only the severity level and a one-line justification.
+SYS
+
+  cat > "$usr_file" << EOF
+Target: $target
+Finding: $finding
+
+Rate this finding's severity:
+EOF
+
+  local result=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
+  rm -f "$sys_file" "$usr_file"
+  echo "$result"
+}
+
+# Get exploitation guidance
+get_exploit_advice() {
+  local target="$1"
+  local vector="$2"
+  local evidence="$3"
+  
+  local sys_file=$(mktemp)
+  local usr_file=$(mktemp)
+  
+  cat > "$sys_file" << 'SYS'
+You are an expert penetration tester. Provide specific, actionable exploitation commands for authorized bug bounty testing. Include exact payloads, curl commands, or tool invocations.
+SYS
+
+  cat > "$usr_file" << EOF
+Target: $target
+Vector: $vector
+Evidence found: $evidence
+
+Give me the exact commands/payloads to exploit this.
+EOF
+
+  local result=$(ollama_prompt "$(cat "$usr_file")" "$(cat "$sys_file")")
+  rm -f "$sys_file" "$usr_file"
+  echo "$result"
+}