I Built a Hackbot for Less Than $250
Source: YouTube · NahamSec · published Oct 12, 2026 · 20:37
[BLUF]
The creator demonstrates "Hackbot," an automated bug bounty agent that identifies new assets, maps APIs, and uncovers vulnerabilities while sleeping, all while strictly managing costs and maintaining human oversight. 2:15-2:30
Key Takeaways:
• The system operates on a "Code gathers, agent judges" principle, using deterministic tools like Subfinder and HTTPX to collect data before passing a filtered list to an AI agent, which prevents excessive token usage and keeps costs under control. 0:48-1:00 1:33-1:50
• Infrastructure is hosted on a Hostinger VPS, with the creator emphasizing affordability and the goal of earning back server costs through a single bounty. 0:30-0:45
• The bot prioritizes "new is better" by fast-tracking brand new assets to find juicy endpoints, API leaks, and exposed Swagger files before competitors. 6:25-6:40
• During a demo on John Deere, the agent successfully identified exposed source maps and admin interfaces, automatically creating collections in Kaido for further manual testing. 10:50-11:30 15:35-16:00
• The creator uses GitHub for backup and reporting, allowing for quick review of findings without relying solely on terminal output, ensuring data persistence and easier reporting. 17:30-18:00
The project illustrates how combining traditional recon tools with AI agents can significantly accelerate bug bounty workflows, though it currently requires human review to validate leads and avoid false positives. As the creator notes, the human element remains crucial for creativity and final decision-making in the automation loop. 20:00-20:15
Sources:
- 0:30 Discussion of cost control rules and VPS infrastructure.
- 1:33 Explanation of the "Code gathers, agent judges" workflow.
- 6:25 Strategy for prioritizing new assets and finding new endpoints.
- 10:50 Demo of the bot identifying exposed source maps and APIs on John Deere.
- 15:35 Demonstration of integrating findings into Kaido for manual testing.
- 17:30 Use of GitHub for backup and streamlined reporting.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This is what I wake up to in the mornings. New leads on my targets, mapped out APIs, and a short list of findings worth investigating. And the best part of it is that all of this has been done by a bot while I sleep. I call this my version one of my hackbot. It's nowhere near finished. Right now, it finds leads and maps APIs. But even at this stage, it saves me a ton of time. So, I figured I'll make a full video and talk a little bit about how I have built it. So, I gave myself three different rules. first keep the cost under control. I'm running it on a VPS on Hostinger that I pay for by a year plus a $100 per month CloudMax subscription. That's also given my recent access to Mythos, which really hasn't been doing a whole lot, but I didn't want to build something that chews through hundre…