EKOII

Day 1 · agent-first operations

Agent EKO-II fleet
Mode read-only
—

Day 0 archived. The lottery Jackpot Board, The Hunt and Radar are retired — that was the manual grind. Operations now run through the read-only fleet: it finds and writes, you pull every trigger.

—

Tier-B claimable

—

Agent findings

—

Assets tracked

—

Scan runs

Ready to file

Pending payout

Collected total

Filing Status

—

Submitted

—

Triaging

—

Paid

—

📍 Programs in Scope

229

HackerOne

226

Bugcrowd

126

Intigriti

YesWeHack

verified · active

📊 Bounty Pipeline

live · loading…

—

Detected

—

L1/L2 Verified

—

Drafted

—

Filed

—

Triaging

—

Paid

🏗️ System Architecture

Agents → Scan & Discover
14 specialized agents hunt across your scope 24/7.

Brain → L1/L2 Verification
Findings land in vuln_findings.json. LLM-judge kills FPs. Only verified → next stage.

Pipeline → Draft & File
Report auto-drafted (CVSS + PoC). Auto-filed to H1, BC, YWH on paced schedule.

Platforms → Triage & Payout
Triagers review. Valid findings → bounty paid. Real-time alerts on your phone.

🔔 Be-First · Fresh Paying Scope

—

Loading radar…

Agent Console

Run the read-only takeover detector. Scan a host or a list; findings, tiers and proof stream in live.

Enter →

Ops Console

The live pipeline board — the Death List and verified findings the fleet surfaces.

Open

Arsenal

The toolchain capability map. Still live.

Open

VPS Sentinel

Host security command center — CPU/RAM/swap/disk, IDS & firewall status, intrusion alerts, one-click remediation on the recon box.

Monitor →

Scanning Operations · what the agents do

Dangling & Takeover

NS zone takeover, CNAME interception, GitHub Pages, unclaimed subdomains.

Exposure & Secrets

.env files, API keys, AWS credentials, private keys, exposed configs.

JavaScript Mining

API endpoints, backend URLs, auth tokens, and sensitive patterns in JS bundles.

API & Access Control

IDOR, broken auth, GraphQL introspection, privilege escalation, unauth endpoints.

Vulnerabilities

CVEs, XXE, SQLi, XSS, SSRF, authentication bypasses, known misconfigurations.

Port & Service

Open ports, banner grabbing, default credentials, unpatched services.

Day 0 · Archive

— prior findings boxed in findings_archive_Day0.json (read-only). The lottery operation is decommissioned.

127.0.0.1:7879 · Day 1Agents · Ops Console