How to Build an AI Hacking Agent With Custom Skills transcript

There is endless of videos online showing you how you set up your own Hermes agent, but none of them shows you how you set up your own Hermes agent as a hacker or someone who's doing ethical hacking and penetration testing or even bug hunting. In this video, I'm going to get you from installing your own Hermes agent on the cloud, then we're going to connect it into Telegram so we can chat with our agent just through the Telegram channel.

Then I'm going to show you how to build your own customized skills [music] that you're going to give them to your AI. So, a skill basically is the instruction that you're going to give to your agent in order [music] to follow. Then I'm going to show you how you build an automation that will look for new subdomains on every 24 hours. For example, you have a target and it launches a new subdomain or new asset in the scope.

[music] You want to be the first person who puts your hands into this target because this is where the money sits. If you're interested building your own personalized Hermes hacking agent, all what you need to do is to click the like button and subscribe button and let us get started. So, first we're going to start by setting up our server. And the server is basically the home where our agent is going to live and execute [music] command and I'm going to be using Hostinger.

So, Hostinger is a VPS provider. [music] You can actually find the link on the description in order to get 20% off from your subscription. So, as you can see there is multiple packages. I'm going to go for the middle one which is a KVM 2 which is a very good because it's have a very decent specs. It have [music] two VCPU and 8 gigs of RAM and also 100 gigs of disk storage which will be very enough to run our Hermes agent.

So, I'm going to go ahead and click the choose plan, then we're going to choose the operation system [music] that our agent is going to live in. So, I'm going to select the Ubuntu. Going to click confirm and as you can see right here we have minus 20% off and [music] make sure to select 24 month or the 12 month plan. And the next thing you're going to select the country. I'm going to be choosing Germany. Then we're going to click continue, put our payment details and we are done.

And after you finish setting up your VPS, now we need to connect [music] to it. And we're going to be using SSH in order to connect into our machine. So, first you're going to go to the dashboard, go to the VPS, then we're going to click this IP. [music] So, I'm going to click copy. We're going to copy the IP address, and we're going to open the terminal. For example, [music] SSH root, and we're going to do at the IP address of the VPS that [music] we're going to connect into.

Next thing, you're going to type the password that you have selected on the setup. And now, all we need to do is to install Hermes into this VPS or into this machine. You can go copy this command from the Hermes original website, or you can just copy this command and paste it and [music] click enter. And it's going to start the installation process. You don't have to do anything. And while our Hermes agent is installing, I want to remind you to click the subscribe button and make sure to [music] activate the notification bell so you get notified to all my future videos.

And now, Hermes agent is installed. All we need to do is to configure it. [music] So, you can be using your own Hermes agent using the new portal, or you can actually configure it adding your own API key of Deepseek, etc. So, let me show you what I mean by the new portal. So, the new portal, basically, they're the founder of Hermes agent. [music] You can go into their platform, thenewresearch.com, and you can go into the top up, and you need to top up some balance [music] into your account in order to use their APIs.

And they have multiple models, too. For example, if you're someone who wants to choose different AI models, you want to, for example, work with Deepseek, and you want to work, for example, with Opus or OpenAI, you can get their [music] API right here. So, you have only one API key, and you can choose later on different [music] AI models. You need to top up your balance, then what you need to do is you grab the API key [music] of your new portal.

So, personally, I'm going to go for the second option. It's going to ask us to pick which API we want to be using. For example, you can go for the new portal, which is the website of the founder of Hermes agent. And if your use case, you want to actually use your multiple AI model, I recommend going for the operator because they have multiple AI models right here and they also have some free AI models you can use from.

For example, we're going to go right here and I'm going to select the free and all of these are the AI models they are for free you can actually use in your [music] Hermis Agent. If you want to for example use this one right here, you're just going to click [music] it and you copy the name of your operator LLM. We're going to copy it and come back into our Hermis Agent, [music] select the first option and click enter.

In my case, I'm going to be using the Deep Seek V4 Flash. So, I'm going to be going create new API [music] key. I'm going to just name it for random name and I'm going to copy this API and also you need to top up your balance in order to use it. And we're going to come back into our terminal and I'm going to go down right here into the Deep Seek. And also the GLM model is also very good. So, if [music] you want to use the GLM models or the Zeda.ai, you can also use that one too.

I'm going to click on the Deep Seek. I'm going to paste the API [music] key that we just got and we're going to click enter. Then we're going to click enter right here. Then I'm going to choose the Deep Seek V4 [music] Flash. I'm going to click enter. I'm going to keep it on the medium and basically we are done. So, the next thing you want to be doing is linking your Hermis Agent to Telegram or Discord or even WhatsApp.

But my favorite is to go for the Telegram. As you can see right here, I'm going to go for I'm going to go for the Telegram. Then I'm going to show you two ways to actually connect your Telegram to your Hermis. There is the manual way and there is automatic. I'm going to go for the manual way. And as you can see right here, it's asking us to look for the Bot Father on Telegram. So, we're going to open Telegram and search for the Bot Father.

And what we're going to do is going to do new bots. I'm going to click enter and I'm going to name our bot. For example, I'm going to do Zach >> [music] >> YouTube. I'm going to click enter and I'm going to do Zach YouTube 0x01 bot, >> [music] >> click it, and it will generate me the bot. And it will generate you this API key. We're going to copy it and paste it right here. And you're going to be very careful sharing this API key because it's going to be like [music] the key to your VPS.

If anyone who have access to this API key, he can actually connect your agent. It's like the same thing giving your VPS password to a random user. And the next thing we want to do is we're going to get our Instagram user ID. Our agent knows which one he's going to control that agent. We're going to look for this username into Telegram, click [music] it, and it will give us our user ID. We're going to copy it and paste it right here, and then [music] click enter.

And we're going to click yes. And we are done. Basically, now we need to restart our [music] agent in order to start fresh. We'll just open this agent. You can see right here. I'm going to to click start. [music] As you can see right here, it's saying gateway is online. So, now our agent is connected [music] into our Telegram. So, you can ask it, for example, some questions. For example, what is your name? [music] And as you can see, it's connected.

You might be asking, "What's the difference between a normal chat box [music] and a Hermes agent?" So, Hermes agent is very good on the memory. For example, you've been using Opus or Claude code for very long hours or for days, and you're going to notice that it's going to start to forgetting some things. For example, Claude code is not going to be the same at day 30 as you started with it one. This is where Hermes [music] agent solves this problem.

So, Hermes agent is going to be developing with you. So, if you started on Hermes agent on day one, [music] and on day 30, they're not going to be the same. On the day 30, it's going to learn your skills, and you're going to learn your behaviors, and we can actually train it and give it some things to update the memory. I'm just going to give you some quick [music] example. Let's just say to our agent that, for example, my name is Zack, and I'm going to click enter.

As you can see right here, it's saying updating memory. So, basically, once you're using your Hermes agent on day one or on day two or day three, >> [music] >> it starts to learn your behavior and it starts to learn from the questions or the things you're going to ask it to do. So, Hermes agent is going to actually grow with you by the time, >> [music] >> unlike Cloud Code or Codex. This is why I love to use Hermes agent cuz I feel like I don't have to give it instructions [music] every single time.

So, now, as we installed our Hermes agent, we can actually use it on the [music] terminal by just typing Hermes. As you can see, we are into Hermes. Or, you can actually connect to it from your browser. And in order to do that, we need a gateway to connect from our localhost into the VPS. [music] For example, I'm going to be running this command right here. I'm going to paste it. Then, I'm going to create another tab, >> [music] >> and I'm going to copy that and paste it right here.

So, basically, this command is going to be the gateway or it's going to be connecting into my VPS so we can actually execute some command from my localhost and connect to the VPS. [music] For example, I'm going to type my password right here. Then, now, all I need to do is to open the browser and actually [music] open the localhost on port 1920. And then, as you can see, we are into the Hermes agent dashboard. Now, after we have installed our Hermes agent into the cloud and connected it into our Telegram, now we need to build the back end.

We need to build the skills and all the process behind the scenes that [music] our agent needs to use in order to do reconnaissance and find vulnerabilities for us. As you can see right here on the screen, this is the dashboard [clears throat] of Hermes agent. There is multiple options on the sidebar. We have the chat. So, the chat is the place where you can actually communicate with your agent. And on the right right here, you can see the models I am using.

Personally, I use the Deep Seek V4 Flash, but you can use other AI model like, for example, the Opus or, for example, the OpenAI models. For example, you can be using your own local LLM. And also on Opera browser, they have some free options or free LLMs you can use, but I don't recommend them for serious hacking. [music] And also you can be using this on also the terminal. For example, if I'm going to go into my VPS and I'm just going to run Hermes, you can see right here, I'm going to click it, you can see the same thing.

You can run it on the terminal, but you need to be connected to your VPS. And the next option is the session. So, the sessions is the place when you can see all the connectors. For example, I am connecting into my agent using Telegram. And these are the sessions [music] that I have interacted with my Hermes agent. For example, you can see what you have done in the past. For example, you can see from where you have executed this command.

For example, I executed this session from my Telegram. And the next thing is the models when you can actually choose different AI models into your hacking. Personally, I'm using the Deep Seek V4 Flash. And the most important feature in this sidebar is the skills. So, the skills you can say it's the brain or it's the instructions you're going to give to your agent in order to follow. For example, you want your agent to find an XSS.

You can actually tell him find me an XSS find you an XSS, but only basic one. But if you want your agent to find these advanced cross-site scripting, you need to build a specific skills with some details instructions. For example, you have multiple ways to build a skill. The best way to build a skill, for example, you're going to give your agent or you're go to the chat section and you tell it, for example, "Here is my HackerOne API key.

I want you to grab all the XSS reports or all the broken access control reports, [music] and it will summarize it and build you a specific skills based on these reports you have submitted on the past. So, you can actually give your agent your hunting methodology, and actually find you bugs based on your [music] skills. And the second option you can actually do is you go to the new scanner here, and you just paste your skill.

For example, you have built skills on the past, you have been using, for example, codex, or you have been using call code, and you have some skills. You can just copy paste them right here. And the best feature about Hermes agent is, you can see right here, is the learn skill. It's the most important feature in Hermes agent. Let's just say you have multiple reports, or you have multiple blogs articles, or you have multiple things you want to make your agent try, you can basically give some blogs articles.

I don't recommend doing medium articles, because sometimes they just lie, or sometimes they are so uh generic. So, my recommendation's try to [music] find some really good quality uh blog article about XSS, IDOR, it doesn't matter. You choose the bug type you want to look for, and you give it some hackerone disclosed report, or for example, some blogs articles you want [music] your agent to look for these exact vulnerabilities, or looking for some vulnerabilities using some exact techniques.

For example, let's just go right here and do site. We're going to do hackerone.com, then we're going to look for XSS, and we're going to click enter. So, I'm going to try to add another dork, which is in URL, and I'm going to do reports. [music] So, basically, that's dork what it will do, it will look for all the hackerone URLs, then it will look for some specific keyword, for example, XSS. You can change this XSS, for example, to IDOR, and it will look for all the reports on hackerone that have IDOR word in it.

So, we're going to come back, we're going to open multiple reports in new pages. For For this one, and this one, and this one. So, we're going to let this load. >> [music] >> For example, this report right here and this report and this report and this report. What we can do is we just we just going to copy this URL and go back to my agent. Going to paste it. Collect some for example, some cool blog articles just like this one and I'm going to copy it and paste it.

And this is just an example. You can collect some really cool tricks and I'm going to say read through all these findings >> [music] >> and build me an XSS skill that will find me [music] bugs on bug bounty programs. This is exactly how you should be doing it and we're going to give it some resources. For example, we can be using the hack tricks XSS >> [music] >> and for example, this one right here. We're going to copy it and come back into my agent and paste [music] this URL.

And the next thing you want to click learn. So, when you click learn, it's going to start learning new skill. [music] For example, I did this in the past and it's built me this XSS hunter. If you're going to go inside it, you can see it's generating me a full skill that I can use into my engagements. Whether you're doing bug hunting or for example, uh pen testing. [music] You can see right here and what it tries to do is tries to crawl through all the page that I provided.

For example, I have a URL. It tries to go through the page, crawl for parameters and tries to look for any reflections, any text reflections. Make sure it's reflected, then it going to try to inject some HTML code, then from the HTML, we're going to go to the XSS. I have been seeing so many hunters or some beginners, they go into these one-liner command and they put it on the terminal and they hope to find some a quick XSS. >> [music] >> And this is a very wrong.

Let me tell you why. For example, you have a one-liner that will that will replace all the parameter using QS replace with some [music] specific payload, and you're going to be using HTTPX to check for reflection. This is good, but in other use scenarios. >> [music] >> And what I love to do it is I check first if this page is text HTML content type. >> [music] >> For example, you have a JSON URL, you're not going to inject an HTML code inside it, and you hope for the best, or you have to find a bug.

What you will actually be doing is you're going to ban your IP, or you're going to be flagged by the firewall, and you will be banned, and you won't be able to actually test. And if this URL is actually vulnerable, you won't be able to find it because you have tried multiple payloads or multiple fails on the path, and you have been flagged. So, you're just lowering your chance to find this exact vulnerability. My recommendation is first to check if it's text HTML content type, then you will see if this parameter is actually injectable.

So, for example, you type for example XYZ or Zack, then you're going to see if it's been reflected into the DOM, then from there you're going to inject an HTML code, not an XSS payload. You're going to see if we have an HTML injection here. If you have an HTML injection, you can escalate it to XSS by for example adding on error. For example, you add for example on hover, prompt, >> [music] >> like confirm one, etc. Then you will escalate it from there.

This is exactly how you should be looking for XSS. And this is exactly also how you build a specific skill. You need to give some details to your skills.md in order your agent to do a very good job. And this is exactly how I'm doing it right here. You can see I am going for the form. I'm going to check the HTTP method if it's a post, if it's a get request, and I'm going for a input. For example, the input have some name attribute.

I'm going to grab this name attribute, and I'm going to try if it's actually [music] injectable. For example, this one here. Let's just try it out. So, this is hacker's space when you can actually find report. If you want to learn about bug hunting or you want to learn about web hacking, I have a website called hacker space. You can go in there, pick the best course for you and there is some labs you can actually practice on.

For example, I'm going to look for XSS and I'm going to pick the first one and [music] I'm going to open the first lab. And I'm going to just give this URL. You can see I have no parameters on the URL and there is multiple ways you can execute this is you can go to the chat right here and you can just ask for [music] the skill. You're going to do {slash} XSS and you can see it just loaded the skill right here and I'm just [music] going to say paste the URL where I'm going to and I will click enter.

When I click enter, you can see now it's trying to load the skill that I have built which is the XSS hunter. Then it's going to try to look for vulnerabilities. So, basically, you can use it through the chat but me personally, I use it through my dashboard. You can see right here I have this platform where I have all [music] the findings. For example, I have a reflected XSS, I have an iFrame and I have CSRF. And if you want to access these skills and you have the prompt that's build me this URL, you can just subscribe and click the like button and DM me on my Instagram.

You can also find it on the description, the word skills [music] and I will send everything to you. So, if you're going to come back and check in the chat, you can see it's still executing. But the result is going to be something like this. I'm going to be having a reflected XSS. You can see right here. This is the XSS report I am having. I can make this bigger. I have the description. Everything is ready. And also it's going to give you a POC file.

For example, this is a finding HTML. And only in the skill, you can see I have some validator and this is where my and this is where we actually validate our finding. And the best way to validate your finding because AI is going to give you some false positive, and you don't want to deal with them. So, how you can actually do this is you're going to build a skill. For example, if you come back right here, I have a skill called try it.

[music] And this try it you will actually use a different AI model. And why you going to use it AI a different AI model? For example, I use Deep Seek before Flash in order to find vulnerabilities, but I'm going to be using the Deep Seek V4 Pro in order to validate them, or I'm going to be using the Opus model in order to validate my findings, or even Java AI is very good like [music] defining which one is false positive and which one is a valid bug.

This is exactly how you need to be doing it. You have to put some instructions in details inside your skills, then you're going to try these skills, then you're going to actually list them in a dashboard. And this is very important. Once you're hunting on a target, for example, you have found a bug in a target, I always recommend to build some POC. What I mean by a POC? Even if it's, for example, an IDOR, I want you to build so, for example, some bash scripting or some Python that you will give to the triager.

You will actually needs to execute this Python file or execute this [music] bash scripting, and it will work for them. So, it will make your life easier, and it will be way faster in order to triage your report. And this is exactly what is in my dashboard. I have all the findings, I have all the JSON format, and also the markdown, and I have the finding.html, which is the POC that it found. If you come back into the chat section, you can see everything is ready right here.

And if you want to go into this URL, let me just open the file. Let us hope it's going to show it. Let us do a refresh. If we're going to do a refresh, and I want to click on the finding.html, you can see it's trying to send a request using a post, and you can see I have a pop-up, so it found a post type XSS. You can see right here, it shows hello, and if we do inspect [music] element, and we're going to select just right here, you can see that my payload is this one.

You can see data, XSS scan, etc. Now, let's just look into the proof of concept that MySkill has generated. If we're going to copy this link address, [music] and I'm going to do, for example, control U, and I want to paste my finding just right here. Let's just add [music] right here, click enter. You can see this is the POC that my agent actually made. So, I can actually just send this POC file into my triager, and he just need to install this HTML and run it and get the result that we actually want him to see.

And it will be very easy to triager report, and will make both your life easier. You can see right here, I have, for example, a form request that I have a form right here that have a post method request with an ID of POC. You can see on the script, it's saying document.getElementById, so it's going to get the document with the ID the document with the ID POC. You [music] can see I have ID equal POC. Then, it's going to auto submit it >> [music] >> into this URL.

So, when we're going to click this and we're going to open this finding [music] HTML, you can see it's automatically opening this and executing my XSS payload. [music] And this is exactly how you want the process to be. And if you want to look for multiple vulnerabilities. Let's say you don't want to only look for cross-site scripting. You want to look for IDORs. You want to look for broken access control in your target.

What you will be doing, and my recommendation, you will build another skill that will use other sub agents or other sub skills in order to find you these bugs. For example, right here, I have a skill called web scan. So, the web [music] scan, it will be using the XSS skills, the IDORs, etc., in order to find me all the bugs, and I have exactly how to look for these bugs and what structures needs to follow. I don't need to look for all these vulnerabilities on every target.

I have some details right here in order to pick which [music] skill that I am going to use for each target. For example, if I just scrape my page and I see some interesting parameter, I see for example an ID parameter or an email parameter, I try for example to look for IDOR. Or if I have for example a URL that have for example an email parameter, I'm going to guess where I'm the agent, I'm going to give some instruction, he's going to guess this is URL.

[music] It's very good to look for IDOR on it. If I have for example a URL that's have a URL parameter or for example redirect or for example a file, it's going to be a very good idea to look for LFI or SSRF. This is exactly how you build your agent. [music] And you can see right here, you can see scope the gate, then you're going to surface and see what exactly we're going to be looking for, then we're going to see right here the route and then load the playbook and load or loading the skill to confirm and report.

This is the process of the web [music] scan is going to be using. And on the end, there is some instructions which is the confirmation and it's always very necessary to confirm your findings using the AI and also manual. Even if your AI says this is a 100% valid bugs, you're not going to trust it and just report it directly. And [music] the next feature I want to explain it to you is the cron jobs. What is exactly the cron job?

The cron job, for example, you're chilling on the beach or you're into the gym and you got a new asset or you got a new email notification that is saying there is a new asset have been added into the scope. What you want to be doing is you want to be the first to put your hands into this target because this is where the money actually is. You need to keep monitoring your target for any new asset has been added into the program or any subdomain, you need to be the first one who puts your hands into.

You You create a cron job in Hermes agent that will actually monitor all of this for you. You're going to go click on the create and select the time you want to actually monitor. For example, you have a pen test client that is paying you every week or every month. You're going to select right here every week or monthly in order to perform some security check and it will generate you for example a PDF report and send it directly to your client or for you to revise it before it goes to your client.

So for example, I have the schedule. I'm going to put it on the daily and for example I'm going to go right here. I want you to use the recon skill and I'm going to for example right here, I'm going to select what skill I want it to be using. I have the recon skill right here and the services and the API. You can actually do recon using subfinder or assetfinder and try to do all the work, but I personally I use some paid services and [music] some paid APIs in order for me to make my life easier.

For example, you want to monitor this program if it have a new subdomain. You're going to be automatically notifying you through your Discord or for example your chat channel. For example, in this case I have Telegram connected into my Hermes or for example using the notify tool and link it to your Discord. There is multiple ways to get the notification or even give it your SMTP configuration to send you an email, but if you're connecting your Telegram or your Discord to your Hermes agent, you don't need to do this.

So we're going to select the daily. So on every 24 hours, I'm going to select for example 12 I'm going to I'm going to select the midnight. You can see right here and on every 12:00 a.m. or a midnight, it will actually look for new subdomains and if it finds some, [music] it will alert me or it keeps the process of finding vulnerabilities inside the subdomain. And this is exactly how you want it to be. You're going to select the name.

For example, just name it monitor. Monitor and right here I want you to scan [music] X target. Doesn't matter For new subs, if you find any new any new subdomains, compare it with X TXT, [music] which is the past subdomains that we have done in the past. So, you have collected some subdomains, you're going to compare the new list with the past list. There is a new subdomain, you're going to automatically report it or scan it.

For example, if a new subdomain, I want you to use the web [music] scan scale to scan for bugs and [music] report me the new findings. For example, this is one case scenario you can use. And you can use your creativity to build multiple cron jobs or multiple automation. Myself, I use it to monitor for new subdomains. I use it for if I found a new subdomain, I automatically scan it or report it exactly to my Discord. >> [music] >> And you can select some skills right here, but it's not necessary.

You can see it's optional. And the next thing, you just have to select which tools you want your agent to be using. In my case, I'm just going to be using the Cabana and the skills and the memory. Then I'm going to click create. If you go to the cron jobs dashboard, you can see it's created a new cron job. You can actually pause it, delete it, or modify anything on it. [music] You can see on every midnight, it will run some specific task for you, and it will report it to you directly.

And this is exactly how you need to be building your own automation. >> [music] >> For myself, I have this dashboard right here. So, on every 24 hour, I it will scan for vulnerabilities on certain target [music] that I give it to him. Or some list of target on every midnight, it will check for new subdomains or check for new asset. If it found something interesting, it will report it to me. You can see I have a dashboard of a daily findings that I find, and also the findings all these findings.

This is basically a demo dashboard. If you want to have the exact prompt that build me that dashboard, you can DM me the word skills on my Instagram and I will send you entire process. [music] For example, it will generate your right here. You can see it's the description, the POC and everything you need in order to validate this bug manually. We already have a validator into my automation, but I always don't trust this and try to validate these findings manually.

And this is basically how it's done. And this is the end of the video. If you want to learn more about web hacking or bug hunting or even some AI hacking and building your own automation, I have a platform called Hacker Space. >> [music] >> You can go into Hacker Space and choose the bug bounty program or the web hacking program and join my community where I teach you everything in there from web hacking, bug bounty, AI hacking, etc.

And thank you so much for watching this video. If you have any ideas or any misunderstandings you did not get about this video, you can always type them on the [music] comment section and I will reply to everyone of you. And don't forget to click the like button and subscribe button. That will actually motivate you to make [music] you more videos. Thank you so much. See you in the next one.