Examples

Basic Reconnaissance

# Passive recon only
hunterx scan target.com --passive-only

# Stealth scan for production
hunterx scan target.com --stealth high --threads 2

# Dry run (verify logic, no requests)
hunterx scan target.com --dry-run

Basic Scan

hunterx target.com
hunterx scan https://example.com --preset quick

Multi-Target Scan

# Multi-target: pass target directly or script it
for url in target1.com target2.com target3.com; do hunterx scan "$url" -o "./results/$url"; done

Bounty Profile

hunterx scan https://example.com --profile bounty --preset quick \
    --category injection,authentication

Authenticated Scan (Bearer Token)

hunterx scan https://example.com --auth bearer --token eyJhbG...

Form Login

hunterx scan https://example.com --auth form --username admin --password s3cret \
    --login-url https://example.com/login

AI-Assisted Analysis

# Local Ollama
hunterx scan target.com --ai --ai-model llama3.2

# OpenAI
hunterx scan target.com --ai --ai-model gpt-4

# Generate AI explanations
hunterx scan target.com --ai --explain

API Server

# Start server
hunterx api --port 8443

# Submit scan
curl -X POST http://localhost:8443/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "http://example.com", "profile": "bounty"}'

# Poll results
curl http://localhost:8443/scan/{scan_id}

# Health check
curl http://localhost:8443/health

Docker

docker run --rm -v $(pwd)/reports:/data nullc0d30/hunterx:latest \
    scan target.com -o /data

Reporting

# Generate SARIF for CodeQL integration
hunterx scan target.com --sarif

# Generate visual attack graph
hunterx scan target.com --attack-graph

# Generate threat model
hunterx scan target.com --threat-model

# Generate purple team detection rules
hunterx scan target.com --purple

# Generate knowledge graph
hunterx scan target.com --graph

Python SDK

from hunterx import HunterX

client = HunterX(target="http://example.com", profile="bounty")
results = client.run()
print(results.to_dict())

CI/CD (GitHub Actions)

- name: Run HunterX Scan
  run: |
    docker run --rm nullc0d30/hunterx:latest \
      scan $ -o /reports/report.sarif

Custom Plugin

from hunterx.plugin import detector

@detector("my_custom_check")
class MyDetector:
    def detect(self, response, context):
        if "custom_error" in response.text:
            return {
                "name": "Custom Error Exposure",
                "category": "info",
                "severity": "medium"
            }
        return None