Listen to this Post
Introduction:
The fusion of AI and collaborative hacking communities is reshaping how security enthusiasts learn, share, and build tools. Hackbot, a new Discord-based initiative, leverages local LLMs (like Ollama) and cloud APIs (Claude, Copilot) to power a bot that assists with cybersecurity tasks, coding challenges, and real-time problem solving. However, integrating AI into Discord without exposing sensitive keys or creating security holes requires careful design—this article walks you through building a hardened, feature-rich Hackbot clone.
Learning Objectives:
- Set up a production-ready Discord bot with AI capabilities using Python and discord.py.
- Integrate both local LLMs via Ollama and cloud APIs (Claude, Copilot) with automatic fallback and key rotation.
- Implement security controls including API key isolation, rate limiting, and educational hacking command sandboxing.
You Should Know:
1. Setting Up Your Discord Bot Environment
Step‑by‑step guide to create the bot foundation:
- Go to Discord Developer Portal → New Application → Bot → Copy token.
- Enable “Message Content Intent” under Privileged Gateway Intents.
- Install dependencies:
pip install discord.py python-dotenv requests ollama. - Create `.env` file (never commit it):
DISCORD_TOKEN=your_token_here CLAUDE_API_KEY=sk-ant-... COPILOT_API_KEY=... OLLAMA_HOST=http://localhost:11434
- Basic bot skeleton with error handling:
import discord, os, asyncio from dotenv import load_dotenv load_dotenv() client = discord.Client(intents=discord.Intents.default()) @client.event async def on_ready(): print(f'{client.user} is ready') client.run(os.getenv('DISCORD_TOKEN')) - Security tip: Run bot as a non‑root user on Linux: `useradd -r -s /bin/false hackbot` and
sudo -u hackbot python3 bot.py.
- Integrating Ollama for Local LLM Inference (Free & Private)
Step‑by‑step to avoid cloud API costs and keep queries internal:
– Install Ollama on Linux (Ubuntu/Debian):
curl -fsSL https://ollama.com/install.sh | sh sudo systemctl start ollama ollama pull mistral or llama2, codellama
– For Windows (WSL2 recommended): Enable WSL, then same Linux commands inside Ubuntu.
– Test locally: `ollama run mistral “Explain SQL injection mitigation”`
– Python integration with automatic retry:
import ollama, asyncio
async def query_ollama(prompt):
try:
response = ollama.chat(model='mistral', messages=[{'role': 'user', 'content': prompt}])
return response['message']['content']
except Exception as e: return f"Ollama error: {e}"
– Discord command example:
@client.event
async def on_message(msg):
if msg.content.startswith('!ask '):
prompt = msg.content[5:]
response = await query_ollama(prompt)
await msg.channel.send(f"🧠 {response[:1900]}")
– Hardening: Restrict Ollama API to localhost only (OLLAMA_HOST=127.0.0.1), and add request timeouts.
- Using Cloud APIs (Claude, Copilot) as Fallback with Key Rotation
When Ollama fails or heavier reasoning is needed, fall back to cloud models.
– Obtain Claude API key from Anthropic Console (requires payment method but has free tier).
– For Copilot API: Use GitHub Copilot’s unofficial endpoints (educational only) or Azure OpenAI.
– Python fallback handler:
import aiohttp, os
async def query_claude(prompt, key=os.getenv('CLAUDE_API_KEY')):
async with aiohttp.ClientSession() as session:
headers = {'x-api-key': key, 'anthropic-version': '2023-06-01'}
payload = {'model': 'claude-3-haiku-20240307', 'max_tokens': 1024, 'messages': [{'role': 'user', 'content': prompt}]}
async with session.post('https://api.anthropic.com/v1/messages', json=payload, headers=headers) as resp:
return (await resp.json())['content'][bash]['text'] if resp.status == 200 else "API error"
– Rotate keys weekly using environment reload or Docker secrets. Never log keys – scrub with re.sub(r'sk-\w+', '
', text)</code>. - Rate limiting per user: use `asyncio.Queue` or `aiolimiter` to prevent abuse. <h2 style="color: yellow;">4. Securing Your Bot Against API Key Leakage</h2> <h2 style="color: yellow;">Critical for any Hackbot deployment:</h2> <ul> <li>Use `python-dotenv` for local dev; in production use Vault (HashiCorp) or AWS Secrets Manager.</li> <li>On Linux systemd service: create `/etc/systemd/system/hackbot.service` with `EnvironmentFile=/etc/hackbot/secrets.env` (restrict permissions: <code>chmod 600</code>).</li> <li>Windows: Store keys in Windows Credential Manager and retrieve with PowerShell: [bash] $cred = Get-StoredCredential -Target "HackbotAPI" $env:CLAUDE_API_KEY = $cred.Password
docker run --rm -v $(pwd):/path zricethezav/gitleaks detect --source=/path.5. Adding Hacking/Cybersecurity Commands (Educational Sandbox)
Provide safe, legal commands for community learning:
- CVE lookup using NVD API:
async def fetch_cve(cve_id): async with aiohttp.ClientSession() as sess: async with sess.get(f'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId={cve_id}') as resp: data = await resp.json() return data['vulnerabilities'][bash]['cve']['descriptions'][bash]['value'][:500] - Port scan simulation (no actual scanning) – outputs example syntax:
if msg.content.startswith('!simscan'): await msg.channel.send("<code>nmap -sS -p- 192.168.1.1 Example only - never scan without permission</code>") - Hash cracking demo using online rainbow tables (educational):
import hashlib; hash = hashlib.md5(b"password").hexdigest() await msg.channel.send(f"MD5 of 'password' is {hash}. Never store plaintext!") - Always include a disclaimer: `This bot is for educational purposes. Unauthorized scanning/exploitation is illegal.`
6. Deploying the Bot on Cloud with Hardening
Production deployment for 24/7 community bot:
- Use a cheap VPS (DigitalOcean, Linode, AWS t4g.nano) running Ubuntu 22.04.
- Install Docker + Docker Compose:
version: '3' services: hackbot: build: . env_file:</li> <li>secrets.env restart: always network_mode: host ollama: image: ollama/ollama volumes:</li> <li>ollama_data:/root/.ollama restart: always
- Firewall: `ufw allow 22/tcp; ufw allow 443/tcp; ufw deny 11434` (Ollama not exposed externally).
- Rate limiting using nginx reverse proxy (if bot uses webhooks) or implement `@commands.cooldown` in discord.py.
- Monitor logs: `journalctl -u hackbot -f` (systemd) or
docker logs hackbot -f. Set up Discord webhook for crash alerts.
What Undercode Say:
- Local LLMs protect privacy – running Ollama keeps all internal queries off the internet, crucial for sensitive hacking discussions.
- API key hygiene is non‑negotiable – one leaked key in a Discord bot’s code can lead to financial drain or account compromise. Use vaults and environment files religiously.
- Community bots must include safety rails – even educational hacking commands can be abused; implement user cooldowns, logging, and explicit disclaimers to avoid legal exposure.
Prediction:
AI‑powered Discord bots like Hackbot will evolve into autonomous red‑team assistants capable of orchestrating CTF challenges, generating custom payloads, and guiding novice hackers through realistic attack simulations. However, as these bots gain access to cloud APIs and local models, we will see a rise in targeted bot‑jacking attacks – where adversaries compromise the bot’s token to inject malicious commands. The next frontier is self‑healing bots that rotate their own keys, detect anomalies via LLM‑based behavior analysis, and sandbox all external API calls in isolated micro‑VMs. Expect GitHub to overflow with “Hackbot 2.0” clones, but only those that prioritize security hardening and local AI will survive the inevitable wave of API‑key theft and abuse reports.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Yashab Alam - Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
