bingo-ai

What it is and what it does

bingo is a terminal-based red team assistant that combines large language models with automated security testing to discover and exploit vulnerabilities in web applications, mobile apps (Android APK, iOS IPA), Windows executables, and blockchain/DApp targets. You describe a target and testing goals in plain English, and bingo orchestrates the attack chain—from reconnaissance (WAF detection, tech fingerprinting) through exploitation (SQLi, XSS, SSRF, file upload, auth bypass) to post-exploitation (credential dumping, database extraction, webshell deployment). It includes built-in engines for SQL injection across all database types, WAF bypass for Cloudflare/AWS/ModSecurity, and optional integration with nmap and sqlmap if installed. The tool supports 25 runtime dependencies including playwright for browser automation, cryptography for JWT/OAuth testing, and various HTTP clients for proxy rotation and Tor integration.

The package is actively maintained (latest release 8 days ago), requires Python 3.12 or later, and runs only on macOS and Linux—Windows support was permanently discontinued. It carries no known security vulnerabilities as of the query date. The tool is designed for authorized penetration testers and red teamers who want to automate reconnaissance and exploitation workflows through conversational prompts.

Use it for:

• Automated web application penetration testing: describe a target URL and let bingo handle recon, SQLi detection, WAF bypass, and credential extraction.
• Mobile app security analysis: extract hardcoded secrets, permissions, exported components, and SSL pinning details from Android APK or iOS IPA.
• Smart contract and DApp auditing: test for reentrancy, flash loan vulnerabilities, oracle manipulation, and wallet authentication bypass.
• Post-exploitation automation: chain SQLi discovery into webshell deployment, RCE execution, and full database dumps with a single prompt.
• Headless CI/CD security scanning: run in silent mode with JSON output for automated vulnerability reporting in deployment pipelines.
• Windows malware analysis: static PE analysis including imports, strings, entropy, hardcoded secrets, and C2 indicator extraction.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

bingo is an AI-powered red team terminal that automates security testing across web applications, mobile apps, and smart contracts by accepting natural-language targets and tasks, then orchestrating attacks like SQLi, XSS, WAF bypass, and credential extraction.

Yes—if you are an authorized penetration tester on macOS or Linux. bingo offers low install friction, active maintenance, permissive MIT licensing, and zero known vulnerabilities. The 25 runtime dependencies are standard and the tool automates complex attack chains. Main gotchas: Python 3.12+ required, macOS/Linux-only, and LLM API keys needed on first launch. Not suitable for Windows users.

Install

bingo-ai on PyPI

pip install bingo-ai

uv add bingo-ai

poetry add bingo-ai

Installing bingo-ai

Before you install

Low friction: pure Python wheel with no compiled dependencies. Active maintenance (released 8 days ago). Requires Python 3.12+. Supports macOS and Linux only—Windows is not supported.

License in practice

MIT license (permissive): you can use, modify, and distribute bingo freely in commercial and private projects with minimal restrictions.

Quickstart

pip install bingo-ai
bingo
# At prompt: enter target URL and describe tasks in natural language
# Example: "Target: https://example.com\nTasks: 1. Full recon 2. SQLi detection"

macOS or Linux only; Windows is not supported. Requires Python 3.12 or later.

Verify before relying

• Whether the 25 runtime dependencies are all actively maintained and free of vulnerabilities beyond OSV reports.
• Whether the AI models (DeepSeek, Claude, GPT, GLM, Qwen, Ollama, custom) are called via external APIs or run locally, and what API key setup is required.
• Whether the anti-hallucination claims and auto-strategy switching are empirically validated.
• Whether findings auto-save to Desktop works reliably across different Linux distributions and macOS versions.

Package facts

Evidence: bingo_ai-7.4.7-py3-none-any.whl

Keywords: ai, cli, cve, exploit, hacker, knowledge-base, llm, pentest, red-team, security, terminal, waf

Tags

More Security packages

Further reading