gerobug

KO | EN

gitlite — search

#javascript #hacktoberfest #react #llm #go #android #deep-learning #docker #nodejs #macos #vue #security #openai #open-source

(★ 104)

The First Open Source Bug Bounty Platform

gerobug Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Gerobug: The First Open Source Bug Bounty Platform.

![gerobugLogo](https://raw.githubusercontent.com/gerobug/gerobug-docs-images/main/logo.png)

![CodeQL](https://github.com/gerobug/gerobug/actions/workflows/github-code-scanning/codeql/badge.svg)
[![License](https://img.shields.io/badge/License-AGPLv3-red.svg?&logo=none)](https://www.gnu.org/licenses/agpl-3.0)
[![Black Hat Arsenal](https://raw.githubusercontent.com/toolswatch/badges/master/arsenal/asia/2023.svg?sanitize=true)](https://www.blackhat.com/asia-23/arsenal/schedule/index.html#gerobug-open-source-private-self-managed-bug-bounty-platform-31241)
[![Black Hat Arsenal](https://raw.githubusercontent.com/toolswatch/badges/master/arsenal/asia/2024.svg?sanitize=true)](https://www.blackhat.com/asia-24/arsenal/schedule/#gerobug-the-first-open-source-bug-bounty-platform-37538)

# Gerobug
__The first open source self-managed bug bounty platform.__

Are you a company, planning to have your own bug bounty program, with minimum budget?

__WE GOT YOU!__

We are aware that some organizations have had difficulty establishing their own bug bounty program. 
Using a third-party managed platform usually comes with a hefty price tag and security risks. _(If you know, you know...)_ 
In the other hand, creating your own self-managed platform will take time and effort to build and maintain it.

## Why Gerobug?
- __EASY        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:__ Have your bug bounty program running with just single line of command
- __SECURE      &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:__ Gerobug uses email parser and network segregation to minimize security risks.
- __OPEN SOURCE &nbsp;&nbsp;&nbsp;&nbsp;:__ It is FREE.

## (Minimum) Recommended Specification
* Ubuntu 24.04
* vCPU 2 Core
* RAM 2 GB
* HDD 16 GB

## Requirements
* <a href="https://support.google.com/accounts/answer/185833">Gmail</a> or <a href="https://support.microsoft.com/en-us/account-billing/using-app-passwords-with-apps-that-don-t-support-two-step-verification-5896ed9b-4263-e681-128a-a6f2979a7944">Outlook</a> Email with App password implemented
* VPN Server (Recommended for Production Server)
* Domain for HTTPS (Recommended for Production Server)
* Port 80, 443, 6320
* Python 3.x
* Docker 
* Docker Compose v2

__(You don't need to install anything manually, we'll do it for you!)__

## Deployment and Usage
To deploy gerobug:
1. Clone this repository
```bash
git clone https://github.com/gerobug/gerobug
cd gerobug
```
2. Run the Setup Script: 
```bash
./gerobug.sh
```
3. Follow the setup instructions (Read the [documentation](https://gerobug.gitbook.io/documentation/) for details)
4. By default, Gerobug Dashboard will listen at port __6320__

Access the login page at `http://[Domain/IP]:6320/login` 
 __Credential__ 
Username&nbsp;&nbsp;: `geromin` 
Password&nbsp;&nbsp;&nbsp;: Randomly generated at `gerobug/gerobug_dashboard/secrets/gerobug_secret.env`

You can read the __detailed documentation [here](https://gerobug.gitbook.io/documentation/)__

## Main Features
- Network Segregation 
All services are running on seperate containers. Public users should only able to access the static page (Rules and guidelines).

- Easy and Quick Installation 
Use our run script to install Gerobug, its quick and easy!

- HTTPS Implementation 
Automated HTTPS configuration using NGINX and Let's Encrypt.

- Homepage 
This should be the only page accessible by public, which contains Rules and Guidelines for your bug bounty program.

- Email Parser 
Bug Hunter will submit their findings by email, which Gerobug will parse, filter, and show them on dashboard.

- Auto Reply and Notification for Bug Hunters 
Bug Hunter's inquiries will be automatically replied and notified if there any updates on their report.

- Notification Channel 
Company will also be notified via Slack/Telegram if there any new report.

- User Management 
Gerobug has a role-based user management.

- Report Management 
Manage reports easily using a kanban model dashboard.

- Report Filtering and Flagging 
Reports from Bug Hunter will be filtered and flagged if there are duplicate indication.

- CVSS / OWASP Risk Calculator 
Gerobug has an integrated CVSS / OWASP Risk Calculator to support the bug review process.

- Email Blacklisting 
Gerobug can temporarily block and release emails that conducted spam activity.

- Auto Generate Certificate 
We can generate certificate of appreciations for bug hunters so you don't have to ;)

- Personalization 
You can customize Gerobug to fit your brand colors

- Logging and Log Rotation 
Gerobug have internal audit log with log rotation enabled

- Hall of Fame / Wall of fame / Leaderboard 
Yeah we have it too

## Authors
- [@VGR6479](https://github.com/VGR6479)
- [@as3ng](https://github.com/as3ng)
- [@jessicaggan](https://github.com/jessicaggan)

## Feedback
If you have any feedback, please reach out to us at __support@gerobug.com__

gerobug

gerobug Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

gerobug

gerobug Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README