HunterX - AI-Assisted Vulnerability Discovery, Validation &

项目说明

<di="center">

<img src=" alt="HunterX official logo" width="220" height="auto">

HunterX

AI-Directed Autonomous Security Assessment Engine

Obser. Test. . Pro.

HunterX is an AI-directed autonomous security assessment engine for planning and executing authorized security-assessment missions. It combines reconnaissance, tool orchestration, AI-directed strategic decision-making, acti testing, , proof, e, replay, correlation, impact assessment, and professional reporting into a single autonomous workflow.

Ahmed Awad (NullC0d3) — Creator & Maintainer

Official Website · GitHub Repository

![GitHub Release]()
![Python ]()
![License]()
![Tests]()
![Docker]()
![PyPI]()
![OWASP Community]()
![Awesome]()
![Awesome Red Teaming]()
![Awesome AI in Cybersecurity]()
![Platform]()
![GitHub Sponsors]()

Autonomous security assessment. e. Report-ready findings.

</div>

---

What HunterX Is

HunterX is an AI-directed autonomous security assessment engine. It is not a scanner. It does not stop at detection.

HunterX directs the complete security assessment lifecycle: it discovers, reasons, selects the next security question, executes the appropriate capability, observes the result, the e, proves the finding, reassesses, and continues until genuine exhaustion. It is an autonomous security assessment engine that orchestrates the entire workflow—reconnaissance, acti testing, , proof, e, replay, correlation, and reporting—under AI direction.

HunterX provides the execution engine, tool orchestration, policy enforcement, scope enforcement, security-test state management, e management, , proof generation, replay, correlation, reporting, and resource controls. The AI Hunt Director is the strategic decision-maker.

---

Why HunterX Is Different

| Traditional Scanner | HunterX |
|---|---|
| Stops at "possible " | Carries candidate through , proof, and replay |
| Fixed tool sequence | AI-directed adaptive test selection |
| No | Acti → → proof → replay |
| No proof | Proof contracts, minimal safe PoCs, deterministic replay |
| No replay | Deterministic replay with |
| No correlation | Cross-tool e chains, attack paths, knowledge graph |
| No strategic direction | AI Hunt Director selects next security question |

AI-directed adapti — The AI Hunt Director receives the complete mission state and a tool capabilities, then decides the next security question and capability to execute.

Multi-tool orchestration — 92+ external security tools orchestrated through capability contracts, not hardcoded pipelines.

Acti testing — Not just discovery. SQL injection, SSRF, IDOR, XSS, path tra, command injection, SSTI, XXE, authentication, authorization, API, GraphQL, JWT, cloud misconfiguration, business logic, client-side, and more—all actively tested.

→ Proof → Replay — Every finding passes through , proof contracts, minimal safe PoC generation, deterministic replay with , and reproducibility requirements.

E & Replay — Every finding is backed by e chains, proof artifacts, and deterministic replay records with .

Correlation & Reporting — Cross-tool e chains, attack paths, knowledge graph, and professional multi-format reports (Markdown, HTML, JSON, SARIF 2.1, PDF, e packages).

---

How It Works

The AI Hunt Director is the strategic decision-maker. It receives the complete mission state—target, scope, authorization, current phase, discovered technologies, services, endpoints, parameters, obser, negati, hypotheses, findings, e, proofs, attack paths, previous actions, a tools with capability schemas, resource budget, and Security Test Matrix—and decides the next security question, the capability to execute, and the arguments.

HunterX provides the execution engine, tool orchestration, policy enforcement, scope enforcement, security-test state, e management, , proof generation, replay, correlation, reporting, and resource controls. The AI directs; HunterX executes and enforces.

---

What Full Security Assessment Means

full_security_assessment is not:

full_security_assessment means:

1. Discover — Assets, services, technologies, endpoints, parameters, API schemas, Ja, authentication mechanisms
2. Assess — Map attack surface, fingerprint technologies, enumerate parameters, map APIs
3. Actively Test — SQL/NoSQL injection, SSRF, IDOR/BOLA, XSS, path tra/LFI, command injection, SSTI, XXE, authentication, session, authorization, API/GraphQL, business logic, client-side, JWT/token, cloud misconfiguration, sensitive data exposure, information disclosure, open redirect, CORS, CSRF, HTTP methods, rate limiting, input
4. — Differential probes, e e, negati, hypothesis state transitions
4. Prove — Proof contracts, minimal safe PoCs, safety/scope , deterministic execution
5. Replay — Deterministic replay with (SUCCESS/FAILED/INCONCLUSI), reproducibility requirements
6. Correlate — Cross-tool e chains, attack paths, knowledge graph, impact assessment
7. Reassess — AI reassesses after every result; new e changes the next decision
8. Report — Multi-format professional reports with e traceability

Security-testing domains are e based on applicability. The Security Test Matrix tracks each domain: NOT_ASSESSED → IN_PROGRESS → TESTED_NEGATIVE / TESTED_POSITI / NOT_APPLICABLE_WITH_E / BLOCKED_WITH_REASON. The mission completes only when all applicable domains reach terminal states.

---

AI Pro (Summary)

HunterX supports cloud and local AI pro. Provider and model are selected independently.

Cloud: OpenRouter, OpenAI, Anthropic, DeepSeek, Google Gemini, xAI/Grok, Requesty (OpenAI-compatible)

Local: LM Studio (lmstudio), Ollama (ollama), generic OpenAI-compatible endpoints

Minimal configuration:

Local (Ollama):

Guided configuration: hunterx ai configure — interacti/model/key setup with .

Full reference: docs/configuration/ai.md | GitHub Pages

---

Quick Start

Note: hunterx hunt --deterministic is an explicit deterministic mode. It is not equi to AI-directed autonomous mode. It bypasses the AI Hunt Director entirely. For full_security_assessment, if AI is required by the autonomous mode and una, HunterX clearly instructs the user how to configure it rather than silently pretending deterministic execution is equi.

---

Security Model

---

Findings and Proof

Every finding passes through , proof contract, minimal safe proof generation, deterministic replay with , and reproducibility requirements before reaching REPORT_READY.

---

Tool Ecosystem

HunterX orchestrates 92+ external security tools through capability contracts: nmap, subfinder, nuclei, ffuf, arjun, sqlmap, dalfox, xssstrike, ghau, commix, tplmap, xxeinjector, interactsh, katana, gospider, hakrawler, gau, waybackurls, ffuf, feroxbuster, dirsearch, arjun, paramspider, kiterunner, whatweb, httpx, dnsx, massdns, shuffledns, masscan, naabu, rustscan, nmap, os, tri, scoutsuite, and more.

Tools are discovered, , and pro before a mission runs. hunterx tools check shows per-tool status and per-capability co.

Full reference: docs/tool-ecosystem.md | Tool Readiness

---

Reporting

Professional multi-format reports with e traceability:

| Format | Purpose |
|---|---|
| Markdown | Human-readable |
| HTML | dashboard |
| JSON | Machine-parsable |
| SARIF 2.1 | VS Code / GitHub CodeQL integration |
| PDF | Document export |
| E Package (ZIP) | Bundled e |

Every statement traces to obser, e, , proof, replay, impact, tool result, target intelligence, or explicit analyst reasoning.

---

Documentation

| Topic | Link |
|---|---|
| Installation | docs/installation/index.md |
| AI Configuration | docs/configuration/ai.md |
| CLI Reference | docs/cli/index.md |
| Tool Ecosystem | docs/tool-ecosystem.md |
| Tool Readiness | docs/tool-readiness.md |
| Proof / | docs/poc-.md |
| Responsible Use | docs/responsible-use.md |
| Security | SECURITY.md |
| Release Notes | CHANGELOG.md |

---

Contributing

Contributions welcome. See CONTRIBUTING.md for guidelines. All PRs must pass tests and linting.

---

License

Apache License 2.0 — see LICENSE.

---

Responsible Use

HunterX is an authorized cybersecurity testing and research platform. You are responsible for obtaining appropriate authorization before testing any system. The author is not responsible for misuse, unauthorized access, illegal activity, or damage caused by the software.

See Responsible Use and SECURITY.md.

---

Copyright & Attribution

Copyright © 2026 Ahmed Awad (NullC0d3)

---

Project Links

项目信息

开发语言：Python

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-Assisted Vulnerability Discovery, Validation & Proof Engine展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。