HHunter - HHunter is a specialized security testing tool des

项目说明

HHunter

<di="center">

![Go ]()
![Release]()
![GitHub stars]()
![Platform]()

Ad HTTP Header Scanner

*1100+ mutations across 22 attack categories with OOB detection, adapti, and e reporting for security professionals*

</div>

About

HHunter is an ad HTTP header security testing engine built for penetration testers and bug bounty hunters. It discovers real through intelligent header mutation and differential response analysis — not just information gathering. With 1100+ attack mutations, out-of-band blind detection, technology-adapti, and chained multi-header attacks, HHunter finds what other tools miss.

<di="center">

*A real terminal capture — HHunter runs a passi, acti, a proxy-trust auth bypass (403 -> 200, CVSS 9.8), and a full 22-category scan against a local lab target. Every finding shown is genuine tool output.*

</div>

---

Table of Contents

About

Features

Installation

Quick Start

Usage Examples

Command Reference

Ad Usage

Detection Categories

Contributing

License

Support

---

Features

Core Capabilities

Authentication Bypass: JWT none/kid/jku attacks, token manipulation, role injection, cloud identity spoofing (198 mutations)

SSRF : IMDSv2 bypass, Azure managed identity tokens, GCP metadata, K8s API/secrets, 50+ internal services (198 mutations)

Injection Engine: SSTI per engine (Jinja2/Twig/Thymeleaf/Freemarker//Pebble), Log4Shell 20+ WAF bypasses, blind SQLi, OGNL/EL (148 mutations)

CORS Exploitation: Origin reflection, null origin, subdomain bypass, method/header expansion detection

Cache Poisoning: Host header injection, X-Forwarded-Host, cache key manipulation, CDN bypass

OOB Detection: Built-in callback server for blind SSRF, blind XSS, blind Log4Shell, blind RCE confirmation

Chained Attacks: Multi-header combo mutations across 7 strategic pairing categories

Intelligent Detection Engine

> E analysis with zero false positi

Differential Analysis: Statistical baseline profiling (multi-sample) with semantic response comparison

Response Similarity: LCS-based body comparison, structural HTML/JSON matching, header set analysis — not just hash comparison

Technology Adaptive: Fingerprints ser/framework/WAF, then prioritizes relevant mutations (PHP payloads for PHP targets, etc.)

Context-Aware Reflection: Distinguishes dangerous reflection contexts (JS, HTML attr, unescaped) from safe ones (JSON strings, CDN headers)

Finding Deduplication: Groups findings by root cause (header family + impact type), keeps highest-confidence instance, merges alternate triggers

Professional HTTP & Networking Suite

<details>
<summary><strong>Enterprise-Grade Network Configuration</strong></summary>

Request Configuration:

Custom Headers (-H): Repeatable custom HTTP headers for authenticated testing

Request Body (-d): POST/PUT body data with Content-Type control (-ct)

Raw Request Import (--raw): Import requests directly from Burp Suite

Cookie Support (-b): Session cookies for accessing protected endpoints

HTTP Methods (-m): Test any HTTP method (GET, POST, PUT, DELETE, PATCH, etc.)

Performance & Control:

Concurrency (-w): Adjustable worker threads (default: 30)

Rate Limiting (-r): Request delay in milliseconds to avoid detection

Timeouts (-t): Configurable request timeout (default: 30s)

Redirect Control (-fr): Follow or block HTTP redirects

Proxy & Stealth:

Proxy Support (--proxy-url): Full Burp Suite and proxy tool integration (HTTP/HTTPS/SOCKS)

WAF E (--waf-e): Header case randomization and e techniques

Stealth Mode (--stealth): Slower, more e scanning approach

> Example: hhunter -u --auth --proxy --proxy-url -H "Authorization: Bearer token"

</details>

Out-of-Band (OOB) Detection

<details>
<summary><strong>Blind Confirmation Server</strong></summary>

HHunter includes a built-in OOB callback server that confirms blind with high confidence:

Blind SSRF: HTTP/HTTPS/DNS-based callbacks for every SSRF mutation

Blind Log4Shell: LDAP/LDAPS/DNS/RMI OOB + obfuscated bypass + en exfiltration

Blind XXE: SYSTEM entity and parameter entity OOB callbacks

Blind SSTI: Per-engine OOB (Java curl, Jinja2 popen, Twig system)

Blind RCE: curl/wget/nslookup/PowerShell callbacks + whoami exfiltration

Blind XSS: Persistent XSS detection via img src and script src OOB

How it works:
1. Start with --oob --oob-url
2. HHunter injects unique interaction IDs into each payload
3. When a target processes a blind payload, it calls back to your server
4. HHunter correlates the callback to the exact mutation → confirmed finding (0.95 confidence)

> Example: hhunter -u --full --oob --oob-url --oob-wait 30

</details>

Attack Categories (22 Total)

<details>
<summary><strong>Comprehensi Attack </strong></summary>

Core Categories:
| Flag | Category | Description |
|------|----------|-------------|
| --auth | Authentication | JWT bypass, token manipulation, role injection, IDOR, CSRF bypass |
| --proxy | Proxy Trust | IP spoofing, X-Forwarded-For, internal network access |
| --cors | CORS | Origin reflection, null origin, subdomain bypass |
| --cache | Cache Poisoning | Host injection, cache key manipulation, CDN bypass |
| --o | Method O | HTTP verb tampering, URL rewrite, path o |
| --cloud | Cloud/CDN | AWS/Azure/GCP/K8s header injection |
| --debug | Debug Exposure | Debug mode acti, feature flags, stack traces |

Ad Categories:
| Flag | Category | Description |
|------|----------|-------------|
| --injection | Injection | XSS, SSTI (9 engines), Log4Shell (20+ bypasses), SQLi (5 DBs), OGNL, NoSQL, LDAP |
| --ssrf | SSRF | Cloud metadata (IMDSv2, Azure MI, GCP), K8s, Docker, 50+ internal services |
| --smuggling | Smuggling | CL-TE, TE-CL, trailer injection |
| --hopbyhop | Hop-by-Hop | Header stripping attacks |
| --ratelimit | Rate Limit | Rate limit bypass techniques |
| --security | Security Headers | CSP, HSTS, X-Frame-Options manipulation |
| --websocket | WebSocket | WebSocket/gRPC/GraphQL upgrade probes |
| --jwt | JWT | alg:none, kid tra, jku/x5u poisoning, weak secrets |
| --crlf | CRLF | Response splitting, header injection |
| --cookie | Cookie | Fixation, tossing, o attacks |
| --content-type | Content-Type | MIME confusion, WAF bypass |
| --redirect | Redirect | Open redirect manipulation |
| --protocol | Protocol | h2c smuggling, HTTP/2 upgrade |
| --encoding | Encoding | Charset attacks, WAF bypass, Range abuse |
| --gateway | Gateway | Kong, Envoy, Traefik, API gateway bypass |

> Full scan: hhunter -u --full runs all 22 categories + audit + recon + + chain

</details>

Professional Reporting & Export

<details>
<summary><strong>Enterprise-Grade Output & CI/CD Integration</strong></summary>

Output Formats:

Console Display: Color-coded findings with se badges, confidence scores, e details, and remediation

JSON Export (-o): Structured output with full scan stats, findings, e, and audit results

HTML Report (--report): Self-contained dark-themed report with expandable findings, stats grid, and se breakdown

SARIF Report (--sarif): SARIF 2.1.0 JSON for GitHub Code Scanning, Azure DevOps, and CI/CD pipelines

Matchers & Filters:

Match Status (-ms): Only process specific status codes (e.g., 200,302)

Filter Status (-fs): Exclude status codes (e.g., 404,500)

Match/Filter Size: Process or exclude responses by byte size

Result Management:

Differential Mode (--diff-only): Show only significant response differences

Quiet Mode (-q): Suppress banner for scripting and automation

Auto- (--): Automatically re-test high-confidence findings for confirmation

Exit Code: Returns exit code 1 when Critical/High findings detected (CI/CD friendly)

> Example: hhunter -l urls.txt --full --report report.html --sarif results.sarif -o findings.json -q

</details>

---

Installation

Go Install (Recommended)

Build from Source

Platform-Specific Builds

System Requirements

Go 1.23+ (for building from source)

Linux, macOS, or Windows (64-bit architecture)

Network connectivity for remote testing

VPS (optional, for OOB callback server)

---

Quick Start

Basic Testing

Complete Security Assessment

---

Usage Examples

---

Command Reference

Get the complete help anytime with hhunter --help

---

Ad Usage

Professional Penetration Testing

Bug Bounty Hunting

Enterprise & CI/CD Integration

---

Detection Categories

Authentication Bypass (173 mutations)

JWT none/None/NONE algorithm bypass, empty signature, weak secret signing

JWT kid directory tra (/dev/null, /etc/passwd), jku/x5u header poisoning

Bearer token manipulation (null, undefined, admin, boolean, array, object)

Basic auth default credentials (admin:admin, root:root, test:test)

Role injection (X-Role, X-Admin, X-Pri, X-Scope, X-ACL)

Cloud identity spoofing (AWS ALB OIDC, GCP IAP, Azure AD principal)

Service mesh auth bypass (Envoy, Istio attributes)

IDOR via user/account/tenant/org ID headers

Cookie-based auth bypass and CSRF token bypass

SSRF (198 mutations)

AWS IMDSv1/v2 bypass, ECS task metadata, Lambda runtime API

Azure managed identity OAuth2 tokens (management, vault, storage, graph)

GCP metadata with Metadata-Fla, service account tokens

Kubernetes API server, secrets enumeration, etcd, kubelet

Docker API (container/image listing)

50+ internal service ports (Redis, MongoDB, Elasticsearch, Consul, Vault, Prometheus, etc.)

20+ IP bypass techniques (octal, hex, decimal, IPv6 mapped, URL authority confusion)

DNS rebinding (nip.io, sslip.io, lvh.me, vcap.me, traefik.me)

URL scheme attacks (gopher, file, dict)

Webhook/callback SSRF headers (X-Callback-URL, X-Webhook-URL, Destination)

Injection Engine (148 mutations)

SSTI per template engine: Jinja2, Twig, Thymeleaf, Freemarker, , Pebble, Groo, Handlebars

Log4Shell: LDAP/LDAPS/DNS/RMI/IIOP/CORBA + 20+ WAF bypass obfuscations + en exfiltration

Blind SQLi time-based: MySQL (SLEEP, BENCHMARK), PostgreSQL (pg_sleep), MSSQL (WAITFOR), Oracle (DBMS_PIPE), SQLite

Error-based SQLi: EXTRACTVALUE, double query, CONVERT

Command injection: semicolon, pipe, backtick, subshell, IFS bypass, DNS exfil

XSS: script, svg, img, details, math tag mutation, dynamic import

NoSQL injection ($gt, $ne, $regex, $where)

LDAP injection, OGNL RCE, Java EL, prototype pollution, GraphQL introspection

CORS Misconfigurations (43 mutations)

Arbitrary origin reflection with and without credentials

Null origin exploitation iframe

Subdomain bypass patterns (.com.evil.com, e.com)

URL encoding bypass (%40, %23, %60, %09, %0d, %0a)

Protocol scheme bypass (data://, ja://, ://)

Method and header expansion detection

Cache Poisoning (52 mutations)

Host header injection and X-Forwarded-Host manipulation

Cache key poisoning headers

CDN-specific bypass (Cloudflare, Fastly, Akamai, )

Cache deception attacks

+ 16 More Categories

Method o, cloud/CDN, debug exposure, HTTP smuggling, hop-by-hop, rate limit bypass, security headers, WebSocket, JWT, CRLF, cookie, content-type, redirect, protocol, encoding, API gateway — all with dedicated mutation sets.

---

Contributing

We welcome contributions! Here's how you can help:

Report bugs via GitHub Issues

Suggest features or new attack categories

Add mutations for emerging attack

Submit pull requests with enhancements

De Setup

Project Structure

---

License

HHunter is released under the MIT License. See LICENSE for details.

---

Support

If HHunter helps with your security research or professional work:

<di="center">

Star this repo • Follow • Share with others

</div>

---

<di="center">

HHunter — Ad HTTP Header Scanner

*Built by cc1a2b for the security community*

</div>

项目信息

开发语言：Go

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕HHunter is a specialized security testing tool designed to detect vulnerabilities through HTTP header manipulation and analysis. Built for penetration testers, bug bounty hunters, and security professionals, it delivers enterprise-grade detection capabilities for header-based attacks with intelligent differential analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。