Beatrix CLI — Bug Bounty Hunting Framework
View on GitHub
0
Scanner Modules
0
Tool Integrations
0
Kill Chain Phases
0
Payloads
What Beatrix Does

Kill Chain Methodology

7-phase structured hunt: CDN bypass, recon, weaponization, delivery, exploitation, installation, and C2. Each phase feeds output into the next.

Auto-Login & Sessions

Authenticates before scanning — probes login endpoints, handles 2FA, captures sessions, and reuses them for 24 hours. HAR file import supported.

GHOST — Autonomous AI

An AI agent that drives the pentest autonomously. Give it a target and an objective. It hunts, pivots, and reports on its own.

13 Tool Orchestration

Wraps subfinder, amass, nmap, katana, nuclei, sqlmap, dalfox, commix, and more. One command coordinates all of them across the kill chain.

Built-in OOB Server

Pure asyncio PoC server for blind SSRF, XXE, and RCE confirmation. No Burp Collaborator or external interactsh dependency required.

WAF Bypass Engine

11 WAF profiles with 3-strategy adaptive retry. SmartFuzzer runs ffuf-verified fuzzing with profile-targeted encoding per target.

Most tools scan.
Beatrix hunts.

The Kill Chain

Seven phases, structured like a real engagement. Each one feeds its output straight into the next.

  • CDN Bypass Discovers origin IPs behind Cloudflare, Akamai, Fastly, and others via DNS history, SSL certs, MX records, and header fingerprinting.
  • Reconnaissance Subdomain enumeration, deep crawling, full 65535-port TCP scan, service fingerprinting, JS bundle analysis, and tech detection.
  • Weaponization Subdomain takeover across 30+ cloud services, cache poisoning, prototype pollution, error disclosure.
  • Delivery CORS bypass (6 techniques), open redirects, OAuth redirect URI manipulation, HTTP request smuggling (CL.TE / TE.CL / TE.TE), WebSocket testing.
  • Exploitation 57K+ injection payloads, SSRF, IDOR, SSTI, XXE, deserialization, GraphQL, business logic, nuclei with 18,000+ templates and WAF bypass.
  • Installation File upload extension bypass, polyglot uploads, path traversal.
  • C2 & Reporting OOB callback correlation, VRT classification, exploit chain generation via PoCChainEngine, deduplication, and impact assessment.
Why Beatrix

Most bug bounty tools solve one problem. Nuclei runs templates. Burp captures traffic. You still have to manually run subfinder, then amass, then nmap, then nuclei, then sqlmap, then dalfox — and correlate everything yourself. Beatrix is the orchestration layer that was missing.

Feature Beatrix Nuclei Burp Suite Pro
Kill Chain methodology ✓ ✕ ✕
Auto-login & session management ✓ ✕ Manual
Autonomous AI pentester ✓ ✕ ✕
13 external tool orchestration ✓ ✕ ✕
Built-in OOB / PoC server ✓ ✕ Collaborator
CLI / automation-friendly ✓ ✓ ✕
Runs in headless environments ✓ ✓ ✕
Cost Free Free $449/yr

Free. Open source. No catch.

Installation

Requires Python 3.11+ on Linux. The installer handles everything else — virtualenv setup, PATH registration, and all 13 external tools.

One-line install
git clone https://github.com/SudoPacman-Syuu/Beatrix-cli.git && cd Beatrix-cli && ./install.sh
First hunt
beatrix hunt example.com --preset full
Full Documentation on GitHub