[Oxycodone]

FINAL OPPORTUNITY: ACQUIRE SELF-HOSTED SOURCE CODE
VIDEO: (will upload a proper video once I get it some free time)

PHP Code


<?php 
https://streamable.com/e/oqdln8? 


Note: API Key was being spammed from a scanning to quickly , working on this by switching between multiple models across platforms. This video is meant as an update, not entire feature list.


CLICK HERE FOR PLANS, ROADMAP & UPDATES

---

This project is currently in active development as a proprietary SaaS tool. Once fully launched, the self-hosted version will no longer be available for public purchase.

This post represents your only window to acquire the complete source code.

What you secure today is yours indefinitely: no subscriptions, no recurring fees. You pay once and retain permanent access including all future updates. When the SaaS platform officially launches, access will shift to a subscription model. Acquiring the code now grants lifetime ownership at a fraction of that cost.

---

PRICING – ONE-TIME ACQUISITION

Full Source Code + 6 Months of Updates – $300 USD

+ 2-Hour Live Support Session (TeamViewer / Discord) – +$100 USD

Free Telegram text support included (lifetime – rapid response). No ticket systems.

---

TARGET AUDIENCE

This build is designed for:

• Security researchers seeking production-grade reconnaissance automation
  
• Bug bounty hunters wanting to eliminate manual repetitive recon
  
• Developers and pentesters who prefer live exploit patterns over static source analysis
  
• Anyone who wants to go from installation to validated exploit in under 20 minutes
  

Consider this a science kit for ethical hacking. It automates reconnaissance so you can focus on impact.

---

TECHNICAL SUMMARY (60 SECONDS)



Everything runs locally. Your keys. Your targets. My code.

---

WHAT YOU RECEIVE IMMEDIATELY

• Fully functional source code + web dashboard
  
• Step-by-step setup documentation + personal onboarding assistance
  
• 6 months of scheduled updates (new modules and features planned)
  
• Direct Telegram support (fast replies – Discord is not actively monitored)
  

---

---

Need Evidence? A Demo? DM Me. Let's Get Bug Hunting. (Ethical Demo)

Example output (live target validation):

PHP Code


<?php 
https://geocargaweb.sincotic.co/avatar.php?cmd=ls%20../../../../../etc/ 


---

READY TO BEGIN?

Private message me for payment details.
Crypto only. A standard contract is required for all acquisitions. No off-platform sales.

Preferred contact: Telegram – DM directly or leave your handle in replies. Discord is not actively monitored.

---

LEGAL & ETHICAL USE

For authorized security testing and ethical bug bounty use only.

You must have explicit written permission to scan any target. Unauthorized scanning is illegal in most jurisdictions.

By purchasing, you agree to use this tool ethically and lawfully.

Follow the rules = discover vulnerabilities and earn bounties.

---

NEED PROOF BEFORE PURCHASE?

I will provide a full live demo on request. No generic video – direct, interactive walkthrough.

How many sites have I personally exploited for RCE or root access?
DM me for the numbers. This is not a theoretical project.

---

― BAD APPLE ―

Start Contract

Start Contractew

[нцптёятяаcё]

bv
BAD APPLE
Automated Vulnerability Scanner + Exploit Helper
From zero to your first bug bounty – hands held the whole way.

---

I'll be upload a video shortly, and screen shots.

⚠️ LEGAL & ETHICAL DISCLAIMER (READ FIRST)
This tool is designed for ethical bug bounty hunting and authorised security testing only.
– You must have explicit written permission to scan any target (e.g. bug bounty programs, your own servers, CTF labs).
– Unauthorised scanning is illegal and can get you banned from platforms like HackerOne, Bugcrowd, or even prosecuted.
– I do not condone any malicious use. By purchasing, you agree to use BAD APPLE solely for ethical purposes.

✅ If you follow the rules, this tool can help you find your first valid bug bounty report and earn $$$.

---

What is BAD APPLE?
BAD APPLE is a automation tool that:
– Searches LeakIX for publicly exposed .git repositories
– Downloads the full source code of those repos (using git‑dumper)
– Scans for vulnerabilities using Gitleaks, Semgrep, and an LLM (via OpenRouter)
– Verifies if the vulnerable file is actually LIVE on the target website
– Generates a ready‑to‑use exploit URL (e.g. site.com/admin/config.php?cmd=whoami)

You bring your own FREE API keys (LeakIX + OpenRouter). I don't charge any recurring fees – you pay for the code once.

Who is this for?
– Complete beginners who want their first shell / first bug bounty
– People who find reading source code boring but want to automate the hunt
– Anyone who wants to see a real exploit in action within 20 minutes of installing

This is like a science kit for hacking – it makes the boring parts automated so you can focus on the fun part: owning a site (ethically).

---

💰 Pricing

• $50 USD First Client - $75 After – Full source code + 6 months of updates (I have several improvements planned – this is a working beta)
  
• + $50 optional ($30 for first person who wants this additional service) – 2 hours live TeamViewer/Discord session with me (15 years experience). We will:
  - Set everything up together
  - Walk through the code line by line (even if you don't code)
  - Run the tool against fresh, untouched targets (I don't reuse old findings)
  - Find a vulnerability, craft the exploit, and get a valid bug bounty report (or shell in a lab)
  - I'll teach you how to spot vulns without relying 100% on AI – we'll also use AI (free) to speed things up
  - I'll go over my recon process, how I use AI prompts for research, and how to understand what you're looking for
  - If we don't get a win, I'll stay longer. If you aren't learning enough to feel comfortable on your own, we can do another 2‑hour session until you understand the basics – no hard limit.
  

Even without the $50 session, I provide free text support (Telegram – I'm bad at Discord, please use Telegram for fastest replies) to help you install and run the tool. I'm not a professional teacher, but I've been around long enough to have some notable hacks under my belt.

The "Mentor Lite" Deal
This tool/thread is aimed at those looking for a "mentor‑lite" experience without a full‑time mentor. I'm not here to mentor you for months – I'm here to teach you something new. If you already know this stuff, don't expect me to sit through comprehensive recon, attack chains, and full pen test reviews.

Best part: you get me for life (within reason). Ask any customer of my previous products – I don't leave you hanging. I love discussion. I won't target sites for you or do all the work, but I will:
– Go over recon in my free time
– Help you understand your findings
– Check if you overlooked anything and explain why
All ethically, of course. I encourage everyone to use this as a fun way into bug bounties, not to do anything you wouldn't want done to your own code.

---

🔑 API Keys – YOU MUST BE ABLE TO GET THESE (both are FREE)

• LeakIX API key – Free registration at https://leakix.net/account (10 req/min, enough for small/medium scans)
  
• OpenRouter API key – Free tier at https://openrouter.ai/keys (rate‑limited free models like Mistral 7B)
  

⚠️ Please confirm you can create these free accounts before purchasing.
I don't want you to buy the code and then realise you can't use it because you can't get the keys. The tool will not work without them.

If you want higher rate limits, both services offer paid upgrades – but the free tiers are enough for learning and finding bugs. I use the free tiers myself.

Don't want to use LeakIX? You can also provide your own list of URLs manually – the tool works fine without LeakIX. But OpenRouter is required for the AI analysis (free tier is fine).

---

⚙️ How it works (technical)
Again, this is not something you can't do yourself – it automates the boring recon so you can focus on the best attack vectors without wasting time.

⚠️ FREE MANUAL TUTORIAL AVAILABLE: Check my profile for my latest thread that explains this same concept manually, for free. If that tutorial isn't clear enough, DM me and I'll help you follow it. You don't have to pay for automation – the free manual method works too. This tool is for convenience and speed.

simplistic / basic concept of how it works currently, will have updates but just a high level overview:

1. You add your LeakIX API key (free account) and OpenRouter API key (free tier)
   
2. RUN The Web Panel UI / Dashboard
   
3. Tool finds exposed .git/config URLs / Everything's pretty much in here for you.
   
4. Downloads each repo with git-dumper
   
5. Runs gitleaks, semgrep, and LLM (Mistral 7B via OpenRouter)
   
6. If a vulnerable file is found (e.g. admin/config.php with $_GET['cmd']), it checks if the file is LIVE on the actual website
   
7. Prints a working exploit URL: http://target.com/admin/config.php?cmd=whoami
   

Everything is local – you don't rely on my servers. Your keys, your scans.

---

📦 What you get

• Complete Code of the project / working dashboard + automation tool.
  
• requirements.txt + setup instructions + I'll help you set it up incase you're struggling as I'm going to assume most people buying this are new or are at least not familiar with setting up NodeJS Projects locally.
  
• 6 months of updates (new features: better path mapping, more LLM models, etc.) I have a few planned updates as this is just the 1st version. I cant promise how many updates, but I got some cool things I wanted to add in as I get some free time .
  
• Telegram / Discord support (text only, unless you buy the session) + You get a friend for life.
  
• Example config and API key setup guide. + whatever else is needed to get you started.
  

---

🎓 What You'll Learn (Even Without the Paid Session)

• How exposed Git repositories leak source code
  
• How to find them using OSINT (LeakIX) or manual lists
  
• What secrets and vulnerabilities look like in real code
  
• How to verify if a vulnerability is actually exploitable (live check)
  
• Basic command injection, SQLi, and path traversal patterns, concepts and spotting these things etc..
  
• How to use AI (free) to speed up code analysis and recon, learning to prompt for best results to help aid learning and confirming finds.
  
• How to research and understand what you're looking for – regardless of AI or manual methods
  

After using BAD APPLE, you'll be able to manually spot similar issues on other targets – even without the tool.

---

🚀 Ready to get your first bug bounty win?

• PM me for payment details (Crypto) [Must be a contract , no offsite sales. Discuss any questions prior to starting contract. Thank you]
  
• Or add me on Telegram by sending me a DM or leaving yours in the reply of this thread. [/b] (preferred – I'm slow on Discord)
  
• I will send you the source + invite to a private GitHub repo (or zip file)
  

[center]I've used this method and still use it myself to find live RCEs and secrets that led to successful missions / bounties. It works. Now it's your turn – but only if you stay ethical.

― BAD APPLE ―
Start Contract

What a interesting tool, friend, very good post.

[Oxycodone]

Just updated with some pictures, and updating the code at the moment. Just having fun to see how far this goes. Thank you.

[EbonCipher]

this look sick!

[simonq]

Very interesting tool, I will be watching this project closely. Good luck with sales.

[Oxycodone]

Very interesting tool, I will be watching this project closely. Good luck with sales.

Ill be releasing some huge updates and providing demos for those interested shortly, getting the servers setup.

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[7]

This looks good going to look into it some more later

[Oxycodone]

I have a live demo available for a limited time for those who are truly interested in checking out the project.

HF contracts are a requirement and will not deal off site other then handling communications. and questions/support.

[xotw0dd]

Hi I am interested in this hoping to find my first bounty and $$