BUILT IN PUBLIC

Building ESTHER

ESTHER is Fink Security's autonomous threat hunter — running 24/7 in the cloud, hunting bug bounties, and delivering real security intelligence. She's built to think like an attacker so you don't have to face one unprepared. And most importantly: she's on your side.

This is the full story: the architecture, the tools, the failures, and the milestones. Built in public. No filter.

FOLLOW THE RESEARCH → VIEW ON GITHUB
ESTHER — Fink Security autonomous threat hunter
THE NAME

What ESTHER Stands For

Every letter maps to a real capability. This isn't a branding exercise — it's a technical specification.

E
Enumeration
Active and passive discovery of hosts, services, subdomains, and exposed infrastructure using Shodan, DNS tools, and certificate transparency logs.
S
Surveillance
Continuous passive monitoring of targets, threat feeds, and breach databases. ESTHER watches so you don't have to.
T
Threat Hunting
Proactive search for indicators of compromise using OpenSearch, audit log analysis, and MITRE ATT&CK framework mapping.
H
Hacking
Authorized offensive operations — penetration testing, bug bounty hunting, and vulnerability exploitation against scoped targets with documented authorization.
E
Exploitation
Structured exploitation workflows mapped to CVEs and MITRE techniques — from reconnaissance through post-exploitation documentation.
R
Reporting
Automated PDF report generation with Fink Security branding, CVSS scoring, and Telegram delivery — executive and technical formats.
INFRASTRUCTURE

The Tech Stack

ESTHER runs on a hardened Kali Linux VPS with a full security research lab stack. Everything is open source, containerized, and reproducible.

OpenClaw
The AI agent runtime. Connects ESTHER to Claude via OpenRouter, manages tools, skills, and Telegram communication.
Docker
Full lab stack containerized — DVWA, Juice Shop, OpenSearch, Dashboards, Ollama, and Portainer all running in isolated containers.
OpenSearch
Security audit log ingestion, threat hunting queries, and visualization via OpenSearch Dashboards. Real-time SIEM capability.
Kali Linux
The operating system of choice for security research. Full access to penetration testing tools, network scanners, and exploit frameworks.
Hugo + GitHub Pages
ESTHER publishes findings autonomously to estherops.tech via Git commits. Every post is a real security research artifact.
Telegram
Primary operator interface. All task assignments, status updates, and PDF report deliveries happen via Telegram bot.
Shodan + OSINT APIs
VirusTotal, AlienVault OTX, NVD, HaveIBeenPwned, and Shodan integrated for real threat intelligence and vulnerability correlation.
Stripe + Handler Bot
Payment pipeline wired directly to ESTHER — purchases automatically create tasks, notify the operator, and queue report generation.
THE BUILD

Week by Week

ESTHER was built in public, one week at a time. Every milestone is documented at estherops.tech.

Week 1 — March 2026
Foundation & First Recon
Deployed OpenClaw on a Kali Linux VPS. Configured Telegram operator interface. Stood up Docker lab stack with DVWA, Juice Shop, and OpenSearch. ESTHER completed her first autonomous recon task and published her first findings to estherops.tech.
VPS SETUPDOCKEROPENSEARCHFIRST RECON$10.48 TOTAL COST
Week 2 — March 2026
MITRE Labs & OSINT Capability
Completed T1083, T1059, and T1190 MITRE ATT&CK lab exercises against DVWA and Juice Shop. Integrated Shodan, VirusTotal, OTX, NVD, and HaveIBeenPwned APIs. ESTHER ran her first live webcam OSINT exercise and documented the methodology. PDF report generation with Telegram delivery implemented.
MITRE ATT&CKOSINTSHODANPDF REPORTSAPI INTEGRATION
Week 3 — March 2026
Bug Bounty Engagements & Integrity Systems
ESTHER joined HackerOne and began two live bug bounty engagements — Playtika and X Corp/xAI. Completed passive recon phases across caesarsgames.com, boardkingsgame.com, houseoffun.com, and x.ai infrastructure. Discovered AEM backend on money.x.com, Cloudflare WAF fingerprints on Playtika, and live application endpoints on x.ai including console.x.ai, auth.x.ai, and api.x.ai with Envoy WASM infrastructure. SHA fabrication detection built into esther-verify.py after integrity issues were identified and resolved.
BUG BOUNTYHACKERONEX.AI RECONPLAYTIKAINTEGRITY SYSTEMS
Week 4 — March 2026
Payment Pipeline & Commercial Launch
Fink Security launched its first commercial services — nine individual security products including Personal Exposure Reports, Breach Checks, and Digital Footprint Audits priced from $15–$95. A custom Stripe Handler bot wires payments directly to ESTHER: purchases automatically create validated task files, notify the operator via Telegram, and queue ESTHER for autonomous execution. Full end-to-end automation from checkout to report delivery.
STRIPE INTEGRATIONHANDLER BOTCOMMERCIAL LAUNCHTASK AUTOMATIONPAYMENT PIPELINE
Week 5 — April 2026
Xiaomi Engagement, Memory & the Ezra Split
ESTHER launched her first solo HackerOne engagement against Xiaomi — 90+ subdomains enumerated via CT logs, 5 live hosts confirmed, and PHP 7.4 EOL identified on market.xiaomi.com as a high-priority finding. Nuclei scanning across 5,472 templates confirmed a hardened WAF posture (Cloudflare, 22% block rate). LanceDB vector memory came online with nomic-embed-text embeddings via Ollama, giving ESTHER semantic recall across sessions for the first time. The x.ai engagement was suspended after 14 vulnerabilities identified (2 critical, 8 high) due to API budget exhaustion — findings archived pending reactivation. Ezra was formalized as a dedicated media agent running on the MacBook Pro, handling thumbnail generation, content publishing, and tweet automation while ESTHER focuses on offensive operations. Fink Security commercial services consolidated to Privacy Essentials ($39/mo) and Full Shield ($55/mo).
XIAOMI H1NUCLEILANCEDBVECTOR MEMORYEZRA AGENTX.AI 14 FINDINGSCOMMERCIAL LAUNCH
Coming Next
Xiaomi Phase 4, x.ai Submission & Scale
Manual web app testing against Xiaomi Phase 4 targets — IDOR on b.mi.com backend APIs, PHP deserialization on market.xiaomi.com, and authentication bypass on account.xiaomi.com. x.ai formal report submission once API budget is restored (2 critical, 8 high findings ready). SendGrid email integration for autonomous client report delivery. HackerOne API auth fix to enable automated submission workflow.
XIAOMI PHASE 4MANUAL TESTINGX.AI SUBMISSIONSENDGRIDH1 API
CURRENT STATUS

What ESTHER Can Do Today

Honest capability assessment as of March 2026. No vaporware — only what's actually working.

✅ Operational Now

  • Passive OSINT reconnaissance via Shodan, crt.sh & web search
  • Active bug bounty recon — HackerOne engagement (X Corp/xAI)
  • Multi-phase recon: subdomain enumeration, httpx probing, JS bundle analysis
  • SQL injection & command injection exploitation against authorized targets
  • OpenSearch audit log ingestion & threat hunting
  • Autonomous publishing to estherops.tech across Intelligence, Methods, Labs & Reports
  • Autonomous tweet posting to @finksecurity after every publication
  • PDF report generation with Telegram delivery
  • VirusTotal, OTX, NVD & HIBP threat intelligence integration
  • Stripe payment pipeline — automated task dispatch on purchase
  • Personal Exposure Reports, Breach Checks, Digital Footprint Audits & Home Network Checks
  • Autonomous commit verification & quality control pipeline
  • Authorization protocol enforcement (SOUL.md + operator approval)
  • Daily journal system for session continuity
  • LanceDB vector memory — semantic recall across sessions
  • Tavily web search skill for real-time research

○ In Development

    • OpenSearch-powered search for estherops.tech
    • OpenSearch Dashboards — real-time activity visualization
    • First verified HackerOne bug bounty submission
    • Cloud security enumeration with ScoutSuite (AWS/Azure/GCP)
    • Metasploit framework integration
    • Multi-target parallel reconnaissance
    • Automated CVE correlation & alerting
    • Dark web monitoring integration
    • TikTok/video content generation via second OpenClaw instance
    • SendGrid email delivery for autonomous client report dispatch
LIVE ACTIVITY

ESTHER Last 30 Days

...
CVEs Analyzed
Last 30 Days
...
Hosts Enumerated
Last 30 Days
...
Critical Findings
Last 30 Days
...
Threat Intel Queries
Last 30 Days
FOLLOW THE BUILD

Watch ESTHER Grow

Every exercise, every finding, every capability added — documented in real time at estherops.tech. This is an AI security agent being built in public. Follow along.

FOLLOW AT ESTHEROPS.TECH → WORK WITH US