what is this?
It's a reconnaissance search engine for the web's public surface.
neobotnet indexes the public-facing assets of companies running a vulnerability reward program (VRP). It collects the assets they own, the web services they run, and the URLs reachable across that surface — then highlights what's most exposed on that surface. All of it normalized, deduplicated, and queryable through a web UI and a REST API.
You query neobotnet. You see the public surface reconnaissance reveals.
how it works
Every company on the internet leaves a footprint.
neobotnet runs open-source and custom tooling, applied with a proper mapping methodology. Output is normalized, deduped, signal-typed, and indexed.
The same workflow a careful security researcher would run.
vulnerability signals
Vulnerability signals are URL parameters and values that match patterns commonly tied to security flaws. neobotnet detects them through parameter-name and value-pattern analysis across every URL collected — a parameter named redirect_uri pointing to an external host, a value matching a JWT pattern, a numeric user_id. Each is a candidate entry point a researcher can investigate, not a confirmed vulnerability.
available signal types
same taxonomy you'll filter on inside /urls — click a category to see the subtypes
- jwt
- auth token
- credential in url
- cloud / api key (any vendor)
the index
The index, right now:
sample vulnerability signals from the index:
param: redirect_uriDemohttps://auth.example.com/oauth/authorize?client_id=app-1&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&response_type=codeparam: user_idDemohttps://api.example.com/v2/orders?user_id=4827&status=openparam: access_tokenDemohttps://app.example.com/dashboard?access_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2Mj…the full index opens behind sign-in.
what it isn't
- ×not a botnet. doesn't take control of anything. doesn't run on machines you don't own.
- ×not a vulnerability scanner. it surfaces signals — patterns that correlate with real vulnerabilities. Investigation stays yours.
- ×not a general-purpose internet crawler. targets are bug-bounty programs that authorize reconnaissance. out-of-scope hosts are excluded.
- ×not a replacement for your own process. if you have one that works, keep it — neobotnet handles the repetitive groundwork so you can skip to analysis.
questions you might be asking
›is this a botnet?
›is this legal?
›why is it called neobotnet?
Because the name argues with itself, and that's the point. A botnet exists to exploit. neobotnet uses the same distributed-automation shape — many small jobs, many small payloads, many small writes — but pointed at mapping authorized public surface so defenders see their exposure first. It's deliberately uncomfortable. If the name makes you stop and check, the page did its job.
who's behind this
Sam Paredes — @caffeinedoom. Security engineer by day, researcher by night. Web intel and research have been at the core of my work ever since.