What problem does it solve?
It converts messy bug bounty reconnaissance into specific, high-value attack hypotheses you can test next, without wasting time on low-payoff or scanner-obvious ideas.
Core Features & Use Cases
- Recon-to-hypotheses generation: Reads all recon files in a target directory and produces 5–10 hypotheses tied to concrete endpoints, parameters, and flows.
- Hard-stop quality filtering: Discards informational-only, theoretical, scanner-catchable, missing-header, best-practice, public-data, and low-severity vectors before output.
- Self-learning noise reduction: Checks weak-pattern and recon-noise logs to avoid repeating known time-wasters, then logs discarded classes after generation.
- Adversarial review and prioritization: Applies a structured thinking process (assumptions, trust boundaries, break conditions, exact test locations) and ranks hypotheses by uniqueness and duplicate risk.
Quick Start
Run the hypothesis-agent with your recon directory path so it reads the recon files and returns 5–10 concrete attack hypotheses tailored to that target.
