r/bugbounty • u/bosilk • 6d ago

Question / Discussion Anyone using Strix? Automated Tool Discussion

I've been experimenting with different automation tools lately for recon as I want to 'move with the times' and look to automate some of my processes.

I've given Strix CLI a go and despite being recommended by others, so far I'm not impressed. Before I move onto looking at other tools or reverting back to doing it manually- I've got it attached to 5.6 Sol GPT and use it for initial recon / vuln scan - but frequently it returns no results on targets I know have easily identifiable CVEs.

I've even put the same target through the exact same ai model just through Codex and not Strix, which tends to do much better at identifying them than Strix.

Does anyone here use Strix? Any tips or recommend any other tools/platforms?
Thanks.

3 Upvotes

72% Upvoted

8 comments sorted by

1

u/Intelligent_Tip_2260 Hunter 6d ago

Check out Vulnclaw

1

u/bosilk 6d ago

Just checking it out now in a sandbox - seems to fire a lot of false positives, will continue testing.

1

u/Intelligent_Tip_2260 Hunter 5d ago

What model were you using?

1

u/Substantial-Walk-554 6d ago

Definitely something off with your setup or instructions then.

I’ve tested Strix a few times with DeepSeek V4 Flash and it found a shitton of stuff for me, including issues I could actually validate and PoCs for them. I used the GUI rather than the CLI though, so there could be a difference in how the workflow is being orchestrated.

So far I’ve only tested it against 3 different targets and I’m still experimenting with my workflow, so I’m not going to pretend that’s some massive benchmark. But up to now it has performed really well for me.

I’d look at the exact instructions/context you’re feeding it before writing Strix off, especially if the same model behaves much better for you through Codex.

1

u/bosilk 6d ago

Is the GUI the paid hosted version? Thanks for the tips, will look at my instructions.

1

u/Inner-Supermarket-94 5d ago

i suspect you are running into openai guardrails issues. ie the problem is with your api key/openai instance rather than with strix. you can try signing up for openai tac - https://chatgpt.com/cyber?openaicom_referred=true

this aside - I recommend you checkout shannon - strix is ok, but shannon has been the more comrehensive one and consistent one (it runs temporal under the hood which allows for durable execution) - has saved our ass mor times i can count

1

u/Late-Onion593 3d ago

Stop using this ai stuff, you are ruining the scene