Continuous Hunter

Continuous Hunter

Overview

24/7 automated vulnerability hunting pipeline. Deploy once, collect findings daily. Monitors targets across subdomain changes, port drift, new services, disclosed CVEs, and misconfiguration exposure — all without manual intervention.

When to Use

Trigger phrases:

• "continuous hunter"

• "Scaling from manual hunting to automated pipeline"

• "Running overnight/weekend scans across target portfolio"

• "Monitoring targets for new vulnerabilities"

• Scaling from manual hunting to automated pipeline

• Running overnight/weekend scans across target portfolio

• Monitoring targets for new vulnerabilities

• Building passive income from bug bounties

• Maximizing findings per hour of effort

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope
• A time-boxed single SRC program campaign — use src-hunter; this skill is for long-running 24/7 automation.

Money-Making Overview

Buyer Persona: Mid-market CISOs at 50-500 employee tech companies; managed service providers who need to offer continuous security monitoring but lack in-house staff; startup CTOs who need compliance-ready vulnerability management without hiring a full-time security engineer.

Pricing Tiers (Monthly Retainer):

First-Dollar Timeline: Deploy pipeline for first client in 2-3 hours. First weekly report goes out 7 days later. With 3 Starter clients at $1,000 each, that's $3,000/mo recurring in month one.

First Action in 60 Minutes

Set up a cron-based daily scan pipeline for a target. This script discovers subdomains, probes live hosts, runs basic checks, and writes findings to a dated JSON report.

#!/bin/bash
# daily-hunt.sh — run this daily via cron: 0 6 * * * /opt/hunter/daily-hunt.sh
# Usage: ./daily-hunt.sh <target-domain> [output-dir]

TARGET="${1:-example.com}"
OUTDIR="${2:-./reports}"
DATE=$(date +%Y-%m-%d)
mkdir -p "$OUTDIR/$TARGET/$DATE"
REPORT="$OUTDIR/$TARGET/$DATE/findings.json"

echo "[+] Starting daily hunt for $TARGET — $(date)"

# 1. Subdomain enumeration (passive)
echo '{"target":"'"$TARGET"'","date":"'"$DATE"'","findings":[]}' > "$REPORT"

subdomains=$(curl -s "https://crt.sh/?q=%25.$TARGET&output=json" 2>/dev/null \
  | python3 -c "import sys,json; [print(d['name_value']) for d in json.load(sys.stdin)]" \
  | sort -u 2>/dev/null)

if [ -z "$subdomains" ]; then
  echo "  [!] No subdomains from crt.sh"
  subdomains="$TARGET"
fi

count=0
for sub in $subdomains; do
  # 2. Quick probe — is it alive?
  http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 8 "https://$sub" 2>/dev/null)
  if [ "$http_code" != "000" ]; then
    # 3. Grab response headers for security assessment
    headers=$(curl -sI --connect-timeout 5 --max-time 8 "https://$sub" 2>/dev/null)
    missing=""
    echo "$headers" | grep -qi "Strict-Transport-Security" || missing="$missing hsts"
    echo "$headers" | grep -qi "Content-Security-Policy"  || missing="$missing csp"
    echo "$headers" | grep -qi "X-Content-Type-Options"  || missing="$missing xcto"
    echo "  [+] $sub (HTTP $http_code) missing:$missing"
    # Append finding
    python3 -c "
import json
with open('$REPORT') as f: r = json.load(f)
r['findings'].append({'subdomain':'$sub','status':$http_code,'missing_headers':'$missing'.strip()})
with open('$REPORT','w') as f: json.dump(r,f,indent=2)
" 2>/dev/null
    ((count++))
  fi
done

echo "[+] Done — $count live hosts checked. Report: $REPORT"

Cron entry (run daily at 6 AM):

0 6 * * * /opt/hunter/daily-hunt.sh clientcorp.com /var/reports/clientcorp

Next iteration (add within 48 hours):

• Port scan live hosts with nmap -sV --top-ports 100
• Check each live URL against known CVE signatures via nuclei
• Diff findings against yesterday's report and flag new/changed items
• Push new-finding alerts to Slack webhook

Prerequisites

• curl, python3, jq installed
• nmap, nuclei (optional, for deeper scanning)
• Authorization from target owner (written scope document)
• Output directory with write permissions

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Objectives — Clarify the goals and scope for hunter.
2. Onboard Target — Collect target domains, IP ranges, authorization scope; configure in pipeline config.
3. Execute Scan Cycle — Run passive recon → live host probe → service enumeration → vuln check → diff against baseline.
4. Verify & Filter — Auto-deduplicate; flag false positives for human review; promote confirmed findings.
5. Deliver Report — Generate weekly report; push critical alerts immediately via Slack/email.

Deliverable Format

Weekly Vulnerability Report (send as PDF to client every Monday 9 AM)

┌─────────────────────────────────────────────────────┐
│ CONTINUOUS HUNTER — WEEKLY REPORT                    │
│ Client: [Company Name]                               │
│ Week: 2026-07-13 — 2026-07-19                       │
│ Status: 🔴 CRITICAL / 🟡 MEDIUM / 🟢 CLEAR          │
├─────────────────────────────────────────────────────┤
│                                                      │
│ 1. NEW FINDINGS THIS WEEK                           │
│ ┌──────┬──────────┬─────────┬──────────┬──────────┐ │
│ │  #   │ Severity │ Target  │   Type   │  Status  │ │
│ ├──────┼──────────┼─────────┼──────────┼──────────┤ │
│ │ CVE1 │  CRIT    │ api.xx  │ RCE      │ Unpatched│ │
│ │ CVE2 │  HIGH    │ app.xx  │ XSS      │ Mitigated│ │
│ │ I-42 │  MEDIUM  │ admin   │ Weak TLS │ New      │ │
│ └──────┴──────────┴─────────┴──────────┴──────────┘ │
│                                                      │
│ 2. ACTIVE FINDINGS (carried forward)                │
│   3 items from prior weeks, 1 past SLA              │
│                                                      │
│ 3. REMEDIATION TRACKER                              │
│   Avg time-to-fix this month: 4.2 days              │
│   SLA compliance: 89%                               │
│                                                      │
│ 4. SCOPE CHANGES                                    │
│   New subdomains detected: 2 (api-staging, dev-portal)│
│   Deprecated hosts: 1 (old-admin)                   │
│                                                      │
│ 5. RECOMMENDATIONS                                  │
│   • Patch api.example.com before next scan cycle    │
│   • Review CSP headers across all *.example.com     │
│   • Decommission dev-portal or add auth             │
├─────────────────────────────────────────────────────┤
│ Generated by Continuous Hunter Pipeline             │
│ Billing ID: [Invoice Line Item Reference]           │
└─────────────────────────────────────────────────────┘

Attach raw JSON/CSV findings as appendix. Include in the monthly invoice as a deliverable line item.

Process

1. Reconnaissance — Gather target information, identify attack surface, enumerate services
2. Analysis/Exploitation — Execute the technique, analyze results, document findings
3. Reporting — Document IOCs, write findings, provide remediation recommendations

Verification

• All hunter procedures executed completely and documented
• New findings diffed against previous scan — only real changes flagged
• False positives identified and filtered before client delivery
• Results documented with evidence and timestamps
• Critical findings alerted immediately (not waiting for weekly report)
• Recommendations provided with risk-based prioritization

Anti-Rationalization Table