What is autohunter?

AutoHunter is a self hosted system that automates bug bounty style vulnerability hunting, built for security researchers who submit findings to programs like EduSRC, the education sector bug bounty platform in China. The idea is that you set the system running on a server around the clock, and instead of manually testing targets yourself, you spend your time reviewing the findings it surfaces before deciding what to submit. It works as a pipeline of cooperating pieces. A collector gathers candidate targets, either by querying the FOFA internet asset search service or from a manual list you provide, then checks whether each target is reachable and scores it. Each target is then handed to its own worker, which uses a large language model together with real security tools such as nmap, nuclei, sqlmap, and httpx to investigate it and attempt to find a genuine vulnerability, submitting anything it finds. A reviewer step then uses AI to filter out incomplete results or false positives before anything reaches you, and a dashboard lets you watch what every worker is doing in real time and make the final call on what gets submitted. For education sector targets, it can also automatically look up which university a given IP address or domain belongs to, to help fill out report details. The project explicitly states it is licensed under CC BY NC 4.0, meaning noncommercial use only, and that it must only be used against targets you have clear written authorization to test. It runs through Docker and Docker Compose on Linux, Windows with WSL2, or macOS, and setup is handled by an install script that walks you through supplying a language model API key, which is required, and a FOFA key, which is recommended for automatic target discovery. The backend is written in Python with FastAPI and SQLAlchemy, and the frontend uses Vue 3. The author describes this as a demo level project shared to help others, not a polished production tool.