HunterX
HunterX combines intelligent reconnaissance, adaptive vulnerability discovery, payload orchestration, and explainable security reasoning into a single modular platform. No external scanners required.
Why HunterX?
Traditional scanners rely on payload volume and signature matching. HunterX reasons about what vulnerabilities might exist before probing, then verifies with evidence.
| Tool | AI / Reasoning | Multi-Agent | Payload Intelligence | Reporting | Architecture |
|---|---|---|---|---|---|
| HunterX | LLM-native (multi-provider) | 10 agents, DAG workflows | FTS5-indexed, 5-level policy | SARIF, HTML, graph, purple team | Unified Python framework |
| Nmap | — | — | — | XML | C, single-purpose |
| Nuclei | — | — | — | JSON | Go, template engine |
| Metasploit | — | — | — | Console | Ruby, framework |
| Amass | — | — | — | JSON | Go, single-purpose |
| ffuf | — | — | — | JSON | Go, single-purpose |
Key Features
Everything you need for depth-oriented security assessment in a single platform.
41 Security Skills
Built-in skills covering web, API, cloud, and infrastructure security. Each carries MITRE ATT&CK, OWASP, CWE, and CAPEC metadata.
Reasoning Engine
18 goal types across vulnerability detection, risk assessment, exploit verification, and remediation planning with multi-call consensus.
Multi-Agent Platform
10 specialized agents collaborate through event/message buses with DAG-based workflows, checkpoint/resume, and isolated memory.
AI Provider Abstraction
Decoupled AI provider layer supporting OpenAI and Ollama with caching, metrics, middleware, retry, and circuit breaker.
Payload Intelligence
SQLite + FTS5-indexed payload repository with 5-level safety policy, 10-family mutation engine, provenance tracking, and feedback loop.
Community Payload Knowledge
Payloads are sourced from the community-maintained PayloadsAllTheThings knowledge base, synchronized and indexed locally with provenance tracking.
Knowledge Graph
Entity-relationship store for findings, targets, payloads, and attack paths. Enables cross-scan correlation and relationship analysis.
Threat Modeling
STRIDE/LINDDUN categorization, trust boundary mapping, automated threat scenarios, and kill chain analysis.
Enterprise Reporting
JSON, Markdown, SARIF 2.1 (VS Code / CodeQL), HTML, attack graphs, purple team detection rules, and ZIP evidence packages.
Safety-by-Design
Non-bypassable destructive payload blocklist, WAF detection with auto-abort, configurable rate limiting, and policy-driven execution.
Architecture
Layered design with clear component responsibilities and defined communication interfaces.
+---------------------------+
| CLI / API / Docker |
+---------------------------+
|
+---------------------------+
| Orchestration Engine |
| Observe → Hypothesize → |
| Probe → Verify |
+--+--------+--------+------+
| | |
+--------+ +----+----+ +--------+
| Agents | Reasoning | Skills |
| Platform | Engine | Registry |
| 10 agents| 18 goals | 41 skills|
| Event/Msg| Planner | Executor |
| Bus | Validator | Policy |
| Workflow | Consensus | Cache |
+----+-----+-----+----+-----+----+
| | |
+----+-----+-----+----+-----+----+
| Payload | Knowledge | Threat |
| Intel | Graph | Modeling |
| FTS5 idx | Relations | STRIDE |
| Mutation | Paths | Chains |
| Feedback | Context | Trust |
+----+-----+-----------+----------+
|
+----+------+
| AI Provider|
| OpenAI |
| Ollama |
| Sessions |
| Caching |
| Metrics |
+----+------+
|
+----+------+
| Reporter |
| JSON / MD |
| SARIF / |
| HTML |
+-----------+
Payload Intelligence is backed by the community-maintained
PayloadsAllTheThings knowledge base
(hunterx payload sync).
Assessment Workflow
The HunterX reasoning pipeline drives every scan through four distinct phases.
+----------+ +----------+ +----------+ +----------+ +----------+
| Target | | Recon | |Reasoning | | Payload | |Reporting |
| Input | → | Intel | → | Engine | → | Intel | → | Output |
| URL/ | | Finger- | | Hypothes-| | Select | | JSON/MD |
| Domain | | printing | | ize | | Mutate | | SARIF |
+----------+ | WAF Det. | | Plan | | Execute | | HTML |
+----------+ | Verify | +----------+ | Graph |
+----------+ +----------+
\ /
\ +----------------+ /
→ | Verification | ←
| Agent |
| Confidence |
| Scoring |
| FP Filtering |
+----------------+
Payload selection draws on the locally indexed PayloadsAllTheThings knowledge base with provenance tracking.
Showcase
HunterX in action — from reconnaissance through reporting.
hunterx scan target.com --profile bounty --preset quick
SARIF 2.1 • HTML • Knowledge Graph
41 Skills • 18 Goals • 10 Agents
Community
HunterX is open-source and community-driven. Apache 2.0 licensed.
Related Projects
About
HunterX is built with a focus on reasoning-driven security assessment, safety-by-design, and multi-format reporting (JSON, HTML, SARIF).
👤 Author
Ahmed Awad (NullC0d3) — Cybersecurity Threat Intelligence Analyst and open-source developer. Creator of HunterX, AnubisX Framework, and RabbitHole.
🎯 Mission
Democratize intelligent vulnerability assessment by combining AI-assisted reasoning with comprehensive security testing in a single, extensible open-source platform.
🛰 Responsible Use
HunterX is provided exclusively for authorized security testing. Users are solely responsible for obtaining authorization before scanning any target.
📖 License
Released under the Apache License, Version 2.0. Free to use, modify, and distribute for any purpose.
Documentation
Explore the complete documentation, API reference, tutorials, and guides.
Browse Documentation →