HunterX is built to work with the security-tooling ecosystem. It does not
attempt to replace every security capability itself. Instead, it orchestrates
open-source security tools: it executes them with structured contracts, parses
and normalizes their output into canonical observations, correlates results,
reasons over hypotheses, validates with evidence, engineers and replays
proofs/PoCs, and produces professional reports.
The canonical integration registry is the
[v7 toolchain intelligence]({{ '/v7-full-toolchain-intelligence/' | relative_url }}) architecture and
the machine-readable
full-toolchain-intelligence.json
capability manifest.
Every tool below is labeled accurately. HunterX never claims direct
execution it does not implement.
- Integrated · fully supported — structured execution, versioned
parser and normalizer, canonical observations.
- Integrated · partial support — parser/normalizer or adapter with
documented limitations.
- Integrated · execution only — structured execution with a guarded
adapter (never arbitrary subprocess).
- Planned / Resource — registered as a knowledge resource or known tool in
the manifest; direct execution is not claimed.
For every integrated tool, HunterX applies the canonical pipeline:
tool output → parser → normalizer → canonical observation → correlation →
hypothesis → verification → evidence → proof → PoC → replay → report-ready finding
Tool results are never raw verdicts: output is parsed and normalized into
canonical observations before it can influence a finding.
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Amass | subdomain-enumeration, asn-enumeration | subdomain-enumeration, asn-enumeration, org-enumeration, asset-discovery | Integrated · fully supported |
| Assetfinder | subdomain-enumeration | subdomain-enumeration | Integrated · fully supported |
| BBOT | subdomain-enumeration, asset-discovery | subdomain-enumeration, asset-discovery, osint | Integrated · fully supported |
| Crobat | subdomain-enumeration, historical-url-discovery | subdomain-enumeration, historical-url-discovery | Integrated · partial support |
| crt.sh Certificate Transparency | certificate-enumeration, subdomain-enumeration | certificate-enumeration, subdomain-enumeration | Integrated · partial support |
| Findomain | subdomain-enumeration, certificate-enumeration | subdomain-enumeration, certificate-enumeration, dns-intelligence | Integrated · fully supported |
| SpiderFoot | osint, asset-discovery | osint, asset-discovery, org-enumeration, asn-enumeration | Integrated · partial support |
| Subfinder | subdomain-enumeration, asset-discovery | subdomain-enumeration, asset-discovery | Integrated · fully supported |
| theHarvester | subdomain-enumeration, osint | subdomain-enumeration, osint, org-enumeration, asset-discovery | Integrated · fully supported |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| arp-scan | host-discovery, network-discovery | host-discovery, network-discovery | Planned / Resource |
| fping | host-discovery | host-discovery | Planned / Resource |
| Masscan | port-discovery | port-discovery | Integrated · fully supported |
| Naabu | port-discovery, host-discovery | port-discovery, host-discovery | Integrated · fully supported |
| Nmap | port-discovery, service-discovery | port-discovery, service-discovery, version-detection, os-detection, network-discovery | Integrated · fully supported |
| RustScan | port-discovery | port-discovery | Integrated · partial support |
| Unicornscan | port-discovery | port-discovery | Planned / Resource |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| HTTPx | http-probing, technology-detection | http-probing, technology-detection, http-configuration-analysis | Integrated · fully supported |
| Nikto | web-server-analysis, http-configuration-analysis | web-server-analysis, http-configuration-analysis | Integrated · partial support |
| SSLScan | tls-analysis | tls-analysis | Planned / Resource |
| testssl.sh | tls-analysis, http-configuration-analysis | tls-analysis, http-configuration-analysis | Planned / Resource |
| Wafw00f | waf-detection | waf-detection | Planned / Resource |
| WhatWeb | technology-detection, web-server-analysis | technology-detection, web-server-analysis | Integrated · fully supported |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| GAU | historical-url-discovery, url-discovery | historical-url-discovery, url-discovery | Integrated · partial support |
| gauplus | historical-url-discovery, url-discovery | historical-url-discovery, url-discovery | Integrated · partial support |
| Gospider | crawling, url-discovery | crawling, url-discovery, javascript-discovery | Integrated · partial support |
| Hakrawler | crawling, url-discovery | crawling, url-discovery | Integrated · partial support |
| Katana | crawling, url-discovery | crawling, url-discovery, endpoint-discovery | Integrated · fully supported |
| URLFinder | historical-url-discovery, url-discovery | historical-url-discovery, url-discovery | Integrated · partial support |
| Waybackurls | historical-url-discovery | historical-url-discovery | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Dirsearch | directory-enumeration, file-enumeration | directory-enumeration, file-enumeration | Integrated · partial support |
| Feroxbuster | content-discovery, directory-enumeration | content-discovery, directory-enumeration, file-enumeration | Integrated · partial support |
| FFUF | content-discovery, directory-enumeration | content-discovery, directory-enumeration, file-enumeration, vhost-enumeration | Integrated · fully supported |
| Gobuster | directory-enumeration, file-enumeration | directory-enumeration, file-enumeration, vhost-enumeration | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Arjun | parameter-discovery, get-parameter-discovery | parameter-discovery, get-parameter-discovery, post-parameter-discovery | Integrated · partial support |
| ParamSpider | parameter-discovery, historical-parameter-discovery | parameter-discovery, historical-parameter-discovery | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Nuclei | cve-detection, misconfiguration-detection | cve-detection, misconfiguration-detection, web-vulnerability-detection, exposure-detection | Integrated · fully supported |
| OpenVAS / Greenbone | cve-detection, misconfiguration-detection | cve-detection, misconfiguration-detection, network-vulnerability-detection | Planned / Resource |
| Wapiti | web-vulnerability-detection | web-vulnerability-detection | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Commix | command-injection-detection, command-injection-validation | command-injection-detection, command-injection-validation | Integrated · partial support |
| Dalfox | xss-discovery, reflection-analysis | xss-discovery, reflection-analysis, parameter-analysis, xss-validation | Integrated · partial support |
| Ghauri | sql-injection-detection, sql-injection-validation | sql-injection-detection, sql-injection-validation, database-fingerprinting | Integrated · partial support |
| SQLmap | sql-injection-detection, sql-injection-validation | sql-injection-detection, sql-injection-validation, database-fingerprinting | Integrated · partial support |
| SSTImap | ssti-detection, ssti-validation | ssti-detection, ssti-validation, template-engine-identification | Integrated · partial support |
| Tplmap | ssti-detection, template-engine-identification | ssti-detection, template-engine-identification | Integrated · partial support |
| XSStrike | xss-discovery, dom-analysis | xss-discovery, dom-analysis, reflection-analysis | Integrated · partial support |
| XXEinjector | xxe-detection, xxe-validation | xxe-detection, xxe-validation, oob-xml-interaction | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Interactsh | oob-callback, dns-callback | oob-callback, dns-callback, http-callback, smtp-callback, interaction-correlation | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| detect-secrets | secret-discovery, credential-discovery | secret-discovery, credential-discovery, token-discovery | Integrated · partial support |
| Gitleaks | secret-discovery, credential-discovery | secret-discovery, credential-discovery, token-discovery, key-discovery | Integrated · fully supported |
| TruffleHog | secret-discovery, credential-discovery | secret-discovery, credential-discovery, token-discovery | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| CodeQL CLI | sast, code-flow-analysis | sast, code-flow-analysis, taint-analysis, vulnerability-pattern-detection | Planned / Resource |
| Semgrep | sast, code-pattern-analysis | sast, code-pattern-analysis, vulnerability-pattern-detection | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| mitmproxy | http-interception, request-replay | http-interception, request-replay, response-analysis, traffic-capture | Integrated · partial support |
| OWASP ZAP | http-interception, request-replay | http-interception, request-replay, response-analysis, active-testing | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| ExploitDB | exploit-research, cve-research | exploit-research, cve-research, version-mapping | Integrated · partial support |
| Metasploit Framework | exploit-validation, service-validation | exploit-validation, service-validation, payload-capability, session-management | Integrated · execution only |
| SearchSploit / ExploitDB | exploit-research, cve-research | exploit-research, cve-research, version-mapping | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| FuzzDB | attack-patterns, payload-intelligence | attack-patterns, payload-intelligence, response-patterns, discovery-dictionaries | Integrated · partial support |
| PayloadsAllTheThings | payload-intelligence, payload-generation | payload-intelligence, payload-generation, vulnerability-class-payloads | Integrated · partial support |
| SecLists | wordlist-provider, content-discovery-aid | wordlist-provider, content-discovery-aid, dns-bruteforce-aid, password-audit-aid | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| GraphQLmap | graphql-analysis, graphql-introspection | graphql-analysis, graphql-introspection, query-analysis | Integrated · partial support |
| InQL | graphql-analysis, graphql-introspection | graphql-analysis, graphql-introspection, query-analysis | Integrated · partial support |
| jwt_tool | jwt-analysis, authentication-analysis | jwt-analysis, authentication-analysis | Planned / Resource |
| Kiterunner | api-discovery, content-discovery | api-discovery, content-discovery | Integrated · partial support |
| OpenAPI / Swagger parser | openapi-analysis, api-discovery | openapi-analysis, api-discovery, api-parameter-analysis | Integrated · partial support |
| Postman collection parser | api-discovery, api-parameter-analysis | api-discovery, api-parameter-analysis | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| JSluice | javascript-analysis, endpoint-extraction | javascript-analysis, endpoint-extraction, secret-indicator-discovery, source-map-discovery | Integrated · partial support |
| LinkFinder | javascript-analysis, endpoint-extraction | javascript-analysis, endpoint-extraction | Integrated · partial support |
| SecretFinder | javascript-analysis, secret-indicator-discovery | javascript-analysis, secret-indicator-discovery | Integrated · partial support |
| xnLinkFinder | javascript-analysis, endpoint-extraction | javascript-analysis, endpoint-extraction, parameter-discovery | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Prowler | aws-security, azure-security | aws-security, azure-security, gcp-security, cloud-asset-discovery, cloud-misconfiguration | Integrated · partial support |
| ScoutSuite | aws-security, azure-security | aws-security, azure-security, gcp-security, cloud-misconfiguration | Planned / Resource |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Grype | container-analysis, cve-analysis | container-analysis, cve-analysis, dependency-analysis | Integrated · partial support |
| kube-bench | kubernetes-security, k8s-configuration-analysis | kubernetes-security, k8s-configuration-analysis | Planned / Resource |
| Syft | sbom-generation, container-analysis | sbom-generation, container-analysis, dependency-analysis | Integrated · partial support |
| Trivy | container-analysis, image-analysis | container-analysis, image-analysis, sbom, dependency-analysis | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| OSV-Scanner | dependency-analysis, vulnerability-mapping | dependency-analysis, vulnerability-mapping | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| enum4linux-ng | smb-enumeration, windows-enumeration | smb-enumeration, windows-enumeration, domain-enumeration | Planned / Resource |
| Impacket | smb-enumeration, kerberos-enumeration | smb-enumeration, kerberos-enumeration, domain-enumeration | Planned / Resource |
| ldapsearch | ldap-enumeration, active-directory-intelligence | ldap-enumeration, active-directory-intelligence | Planned / Resource |
| NetExec | smb-enumeration, windows-enumeration | smb-enumeration, windows-enumeration, ldap-enumeration, domain-enumeration | Planned / Resource |
| rpcclient | smb-enumeration, windows-enumeration | smb-enumeration, windows-enumeration | Planned / Resource |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| snmpwalk | snmp-enumeration, network-device-enumeration | snmp-enumeration, network-device-enumeration | Planned / Resource |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| CeWL | wordlist-generation, content-discovery-aid | wordlist-generation, content-discovery-aid, custom-wordlists | Integrated · partial support |
| Hashcat | password-cracking, hash-analysis | password-cracking, hash-analysis, hash-modes | Planned / Resource |
| John the Ripper | password-cracking, hash-analysis | password-cracking, hash-analysis | Planned / Resource |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| dnspython | dns-resolution, record-enumeration | dns-resolution, record-enumeration | Integrated · fully supported |
| DNSrecon | dns-enumeration, brute-force-dns | dns-enumeration, brute-force-dns, record-enumeration | Planned / Resource |
| DNSx | dns-resolution, record-enumeration | dns-resolution, record-enumeration, wildcard-detection | Integrated · fully supported |
| MassDNS | dns-resolution | dns-resolution | Integrated · partial support |
| Shuffledns | dns-resolution, brute-force-dns | dns-resolution, brute-force-dns | Integrated · partial support |
| Tool | Primary role | Capabilities fed to HunterX | Status |
|---|
| Proof Replay | safe-validation, proof-replay | safe-validation, proof-replay, impact-statement | Integrated · fully supported |
HunterX integrates with and leverages the third-party open-source projects
listed above. It does not claim ownership of them. Each project keeps its own
license and attribution, which is preserved in
THIRD_PARTY_NOTICES.
Tool names, trademarks and descriptions are used only to document
interoperability.
- [Vulnerability Proof & PoC]({{ '/v7-vulnerability-proof-and-poc/' | relative_url }}) — how proof
contracts validate hypotheses
- [Full Toolchain Intelligence]({{ '/v7-full-toolchain-intelligence/' | relative_url }}) — the
integration architecture
- [Tool Integration SDK]({{ '/v7-tool-integration-sdk/' | relative_url }}) — the adapter SDK
- [Features]({{ '/features/' | relative_url }}) — platform capabilities