# Ars0n Framework v2: The Bug Bounty Recon Platform That Teaches You While You Hunt

> A quick look at Ars0n Framework v2 (github.com/R-s0n/ars0n-framework-v2) — Harrison "rs0n" Richardson's open-source bug bounty framework that wraps 50+ recon tools, ranks targets with an ROI algorithm, and builds lessons into every step. Watch the creator's demo, see the Company/Wildcard/URL workflows, and understand the "earn while you learn" idea in a 3-minute read.

Source: https://playciso.com/blog/ars0n-framework-v2-bug-bounty-recon · Published: 2026-09-07 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/R-s0n/ars0n-framework-v2

---

If RedCell is the AI agent that [runs a pentest for you](/blog/redcell-ai-penetration-testing-agent), **Ars0n Framework v2** is the opposite philosophy done well: a guided platform that puts 50+ recon tools behind one methodology and _teaches you_ while you use them. Built by Harrison "rs0n" Richardson ([github.com/R-s0n/ars0n-framework-v2](https://github.com/R-s0n/ars0n-framework-v2)) and released under GPL-3.0, its pitch is refreshingly direct: "Automate the most common bug bounty hunting workflows and earn while you learn." Here's the short version, with the creator's own demo. The creator's official demo of Ars0n Framework v2 (rs0n_live on YouTube). Also worth watching: his [Bug Bounty Village talk at DEF CON 33](https://www.youtube.com/watch?v=DSDLq3GdveQ). ## What it is, fast A Docker-containerized recon platform. You run `docker-compose up --build`, open a browser, and get a UI that wraps dozens of well-known tools into a workflow you can't easily run wrong. Everything lands in one central database so your attack surface is visible in one place, and a "Help Me Learn!" dropdown at each step explains what the tool does and why it matters. v2 is a full rewrite of the original — rebuilt from personal scripts into a real open-source project. ## Three workflows, one methodology The UI enforces the methodology — that's the whole point. - Company — discover every digital asset an organisation owns, on-prem and cloud. - Wildcard — enumerate all subdomains under a root domain, then rank them with an ROI algorithm so you hunt where a bug is most likely to be. - URL (in development) — personalised lesson plans that teach manual testing (XSS, SQLi, SSRF) on real targets. ## The part that will interest builders Ars0n v2 ships an **MCP server that exposes 142 tools to AI assistants** — so an LLM can query the recon database and orchestrate scans in natural language. That's the same Model Context Protocol surface that's becoming a security topic in its own right; if you're wiring AI assistants to security tooling, it's worth understanding the governance and risk side too (we cover the emerging [MCP config auditing](/tools/mcpguard) angle in our tools). Scan data also imports and exports as a `.rs0n` file, so you can share a pre-scanned target and learn from it. ## One rule before you start Everything here runs real recon and scanning tools. Point them only at assets that are **in scope of an authorized bug bounty program** or an engagement you have permission for. Out-of-scope enumeration isn't a grey area — it can be a crime. Read the program rules first, every time. ## Frequently asked questions ### What is the Ars0n Framework v2? Ars0n Framework v2 is an open-source, Docker-based bug bounty reconnaissance platform by Harrison "rs0n" Richardson. It wraps 50+ recon tools behind a guided UI that enforces a proven methodology, stores everything in a central database, ranks targets with an ROI algorithm, and adds "Help Me Learn!" lesson plans at each step. It is released under GPL-3.0. ### What does "earn while you learn" mean? The framework is built to teach real bug bounty methodology on real targets rather than synthetic labs, so a beginner can follow the guided workflows, learn why each step matters, and have a genuine chance of finding and reporting a valid bug — and earning a bounty — while they learn. ### Is it legal to use Ars0n Framework? The tools it runs are real recon and scanning tools, so you may only point them at assets you own or that are in scope of an authorized bug bounty program or engagement. Enumerating and scanning systems outside a program's scope can be illegal. Stay in scope, and treat authorization as the first step. ### What is the ROI scoring in Ars0n Framework? After the Wildcard workflow enumerates subdomains, an ROI algorithm ranks them by how likely they are to hold a vulnerability, using signals like SSL/TLS issues, the technology stack, missing security headers and other metadata — so you spend your time on the targets most likely to pay off. PlayCISO is not affiliated with the Ars0n Framework or Harrison Richardson. This is an independent overview based on the project's public README and the creator's demo; features may change. Use recon tooling only against authorized, in-scope targets. **Wiring AI assistants to security tools?** Audit your MCP setup with the free [MCP Guard](/tools/mcpguard), catch injection in forwarded content with [Prompt Scan](/tools/promptscan), and work the [OWASP LLM Top 10](/tools/llm-security). No signup.