PenHunter - Pen Hunter is a comprehensive vulnerability scanni

项目说明

PenHunter

<di="center">

![Go ]()
![Release]()
![GitHub stars]()
![Platform]()

Modular Web Scanner

*Comprehensi for XSS, SQLi, LFI, SSRF, RCE, Open Redirect, and CSRF — built for penetration testers, bug bounty hunters, and security researchers.*

</div>

About

PenHunter is a powerful, modular web scanner written in Go. It provides comprehensi for common web including XSS, SQL Injection, LFI, SSRF, RCE, Open Redirect, and CSRF — with concurrent scanning, ad detection methods, WAF e, and integrations with industry tools like dalfox, sqlmap, and nuclei.

<di="center">
<img alt="PenHunter Demo" src=" width="100%">

*PenHunter — modular scanner with interactive and CLI modes.*
</div>

---

Table of Contents

About

Features

Installation

Quick Start

Usage Examples

Screenshots

Command Reference

Ad Usage

Contributing

License

Support

---

Features

Core Capabilities

Multiple Scanners: XSS, SQLi, LFI, SSRF, RCE, Open Redirect, CSRF

High Performance: Concurrent scanning with configurable thread pools

Ad Detection: Boolean-based, time-based, error-based detection methods

WAF E: Payload mutation, header rotation, TLS fingerprint randomization

External Tool Integration: dalfox, sqlmap, nuclei, and more

Multiple Output Formats: JSON, HTML, TXT

Interactive CLI: Menu-dri for guided scans

Auto-Update: Built-in update mechanism releases

Organized Results: Automatic directory structure for scan results

Intelligent Detection Engine

> Differential analysis, boolean/time/error oracles, and payload mutation built in.

Differential Response Analysis: Detects subtle behavior changes that confirm

Multi-Method Co: Boolean-based, time-based, and error-based detection paths per vuln class

Payload Mutation: Automatic encoding, casing, and obfuscation for WAF bypass

Confidence Scoring: Per-finding confidence to filter true positives from noise

Discovery Pipeline

<details>
<summary><strong>Subdomain → URL → endpoint → </strong></summary>

PenHunter integrates the best-in-class recon stack:

Subdomain enumeration:

subfinder, assetfinder — passi

amass (optional) — active + passive

HTTP probing & URL discovery:

httpx — live host probing

urlfinder, katana, gospider — crawler-based URL collection

gau, gauplus, waybackurls — wayback machine har

Endpoint extraction:

cariddi, getJS — JS endpoint mining

PenHunter nati — built-in JS extractor

scanning:

dalfox, sqlmap, nuclei — best-in-class engines, orchestrated through PenHunter

</details>

Classes

<details>
<summary><strong>Se classes, comprehensi</strong></summary>

| Class | Detection Methods | Default Engine |
|---|---|---|
| XSS | Reflected, stored, DOM | Native + dalfox |
| SQLi | Boolean, time, error, union | Native + sqlmap |
| LFI | Path tra, wrapper, log poisoning | Native |
| SSRF | Internal, cloud metadata, gopher, file | Native + OOB |
| RCE | Command injection, template injection | Native + nuclei |
| Open Redirect | Header, parameter, JS-based | Native |
| CSRF | Missing token, weak token, predictable | Native |

</details>

HTTP & Networking

<details>
<summary><strong>Production-grade HTTP layer for scaling and stealth</strong></summary>

Custom Headers (-H): Repeatable headers for authenticated scans

Cookie Support (-c): Session cookies for protected resources

User-Agent Rotation: Built-in UA rotation for e

Rate Limiting: Configurable request pacing

Timeouts: Per-request timeout control

Retry Logic: Exponential backoff on failures

Proxy Support: Burp Suite and other intercepting proxies

TLS Bypass: Optional certificate skip for testing

</details>

Output & Reporting

<details>
<summary><strong>Three formats, organized result hierarchy</strong></summary>

Console: Color-coded terminal output with se highlighting

TXT: Plain text logs for scripting

JSON: Structured output for automation pipelines

HTML: Self-contained reports for stakeholder review

</details>

---

Installation

Go Install (Recommended)

> Note: go install ships only the binary. To get the bundled config/ (payloads, encoders, user callbacks), clone the repo or use make install.

Build from Source

Add to PATH

From Releases

Download the latest release from GitHub Releases and extract to your $HOME/penhunter/ directory.

System Requirements

Go 1.21+ (for building from source)

Linux, macOS, or Windows (64-bit)

External recon tools (optional but recommended): subfinder, assetfinder, httpx, katana, gau, dalfox, sqlmap, nuclei

---

Quick Start

Interactive mode

Launches the menu where you choose between single-domain or subdomain scanning, classes, and engines.

Single URL scan

Multi-URL scan with JSON output

Update PenHunter

---

Usage Examples

---

Screenshots

<di="center">

<img alt="PenHunter — LFI detection" src=" width="100%">

*LFI scan — path tra detection with confirmed payload.*

<br><br>

<img alt="PenHunter — XSS detection" src=" width="100%">

*XSS scan — reflected payload confirmed in response.*

</div>

---

Command Reference

---

Ad Usage

Bug Bounty Workflow

CI / Continuous Scanning

WAF E Scan

---

Contributing

Contributions welcome from the security community.

Report bugs via GitHub Issues

Suggest features or new classes

Impro

Submit pull requests with new payloads, detectors, or integrations

De Setup

---

License

PenHunter is released under the MIT License. See LICENSE for details.

---

Support

If PenHunter helps with your security research:

<di="center">

Star this repo • Follow • Share with the security community

</div>

---

<di="center">

PenHunter — Modular Web Scanner

*Built by cc1a2b for the security community*

</div>

项目信息

开发语言：Go

Star 数：59

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Pen Hunter is a comprehensive vulnerability scanning tool designed for penetration testers, security researchers and bug bounties. it automates the process of collecting subdomains and URLs and tests them for various vulnerabilities including XSS, SQL Injection, Local File Inclusion, Open Redirect, Server-Side Request Forgery, CSRF, and RCE.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。