Tool Ecosystem

HunterX is built to work with the security-tooling ecosystem. It does not attempt to replace every security capability itself. Instead, it orchestrates open-source security tools: it executes them with structured contracts, parses and normalizes their output into canonical observations, correlates results, reasons over hypotheses, validates with evidence, engineers and replays proofs/PoCs, and produces professional reports.

The canonical integration registry is the v7 toolchain intelligence architecture and the machine-readable full-toolchain-intelligence.json capability manifest.

Integration status

Every tool below is labeled accurately. HunterX never claims direct execution it does not implement.

Integrated · fully supported — structured execution, versioned parser and normalizer, canonical observations.
Integrated · partial support — parser/normalizer or adapter with documented limitations.
Integrated · execution only — structured execution with a guarded adapter (never arbitrary subprocess).
Planned / Resource — registered as a knowledge resource or known tool in the manifest; direct execution is not claimed.

How tool output becomes findings

For every integrated tool, HunterX applies the canonical pipeline:

tool output → parser → normalizer → canonical observation → correlation →
hypothesis → verification → evidence → proof → PoC → replay → report-ready finding

Tool results are never raw verdicts: output is parsed and normalized into canonical observations before it can influence a finding.

Recon / Asset Discovery

Tool	Primary role	Capabilities fed to HunterX	Status
Amass	subdomain-enumeration, asn-enumeration	subdomain-enumeration, asn-enumeration, org-enumeration, asset-discovery	Integrated · fully supported
Assetfinder	subdomain-enumeration	subdomain-enumeration	Integrated · fully supported
BBOT	subdomain-enumeration, asset-discovery	subdomain-enumeration, asset-discovery, osint	Integrated · fully supported
Crobat	subdomain-enumeration, historical-url-discovery	subdomain-enumeration, historical-url-discovery	Integrated · partial support
crt.sh Certificate Transparency	certificate-enumeration, subdomain-enumeration	certificate-enumeration, subdomain-enumeration	Integrated · partial support
Findomain	subdomain-enumeration, certificate-enumeration	subdomain-enumeration, certificate-enumeration, dns-intelligence	Integrated · fully supported
SpiderFoot	osint, asset-discovery	osint, asset-discovery, org-enumeration, asn-enumeration	Integrated · partial support
Subfinder	subdomain-enumeration, asset-discovery	subdomain-enumeration, asset-discovery	Integrated · fully supported
theHarvester	subdomain-enumeration, osint	subdomain-enumeration, osint, org-enumeration, asset-discovery	Integrated · fully supported

Network / Port Scanning

Tool	Primary role	Capabilities fed to HunterX	Status
arp-scan	host-discovery, network-discovery	host-discovery, network-discovery	Planned / Resource
fping	host-discovery	host-discovery	Planned / Resource
Masscan	port-discovery	port-discovery	Integrated · fully supported
Naabu	port-discovery, host-discovery	port-discovery, host-discovery	Integrated · fully supported
Nmap	port-discovery, service-discovery	port-discovery, service-discovery, version-detection, os-detection, network-discovery	Integrated · fully supported
RustScan	port-discovery	port-discovery	Integrated · partial support
Unicornscan	port-discovery	port-discovery	Planned / Resource

HTTP / Crawling / Discovery

Tool	Primary role	Capabilities fed to HunterX	Status
HTTPx	http-probing, technology-detection	http-probing, technology-detection, http-configuration-analysis	Integrated · fully supported
Nikto	web-server-analysis, http-configuration-analysis	web-server-analysis, http-configuration-analysis	Integrated · partial support
SSLScan	tls-analysis	tls-analysis	Planned / Resource
testssl.sh	tls-analysis, http-configuration-analysis	tls-analysis, http-configuration-analysis	Planned / Resource
Wafw00f	waf-detection	waf-detection	Planned / Resource
WhatWeb	technology-detection, web-server-analysis	technology-detection, web-server-analysis	Integrated · fully supported

Crawling / URL Discovery

Tool	Primary role	Capabilities fed to HunterX	Status
GAU	historical-url-discovery, url-discovery	historical-url-discovery, url-discovery	Integrated · partial support
gauplus	historical-url-discovery, url-discovery	historical-url-discovery, url-discovery	Integrated · partial support
Gospider	crawling, url-discovery	crawling, url-discovery, javascript-discovery	Integrated · partial support
Hakrawler	crawling, url-discovery	crawling, url-discovery	Integrated · partial support
Katana	crawling, url-discovery	crawling, url-discovery, endpoint-discovery	Integrated · fully supported
URLFinder	historical-url-discovery, url-discovery	historical-url-discovery, url-discovery	Integrated · partial support
Waybackurls	historical-url-discovery	historical-url-discovery	Integrated · partial support

Fuzzing / Content Discovery

Tool	Primary role	Capabilities fed to HunterX	Status
Dirsearch	directory-enumeration, file-enumeration	directory-enumeration, file-enumeration	Integrated · partial support
Feroxbuster	content-discovery, directory-enumeration	content-discovery, directory-enumeration, file-enumeration	Integrated · partial support
FFUF	content-discovery, directory-enumeration	content-discovery, directory-enumeration, file-enumeration, vhost-enumeration	Integrated · fully supported
Gobuster	directory-enumeration, file-enumeration	directory-enumeration, file-enumeration, vhost-enumeration	Integrated · partial support

Parameter / Endpoint Discovery

Tool	Primary role	Capabilities fed to HunterX	Status
Arjun	parameter-discovery, get-parameter-discovery	parameter-discovery, get-parameter-discovery, post-parameter-discovery	Integrated · partial support
ParamSpider	parameter-discovery, historical-parameter-discovery	parameter-discovery, historical-parameter-discovery	Integrated · partial support

Vulnerability Detection / Validation

Tool	Primary role	Capabilities fed to HunterX	Status
Nuclei	cve-detection, misconfiguration-detection	cve-detection, misconfiguration-detection, web-vulnerability-detection, exposure-detection	Integrated · fully supported
OpenVAS / Greenbone	cve-detection, misconfiguration-detection	cve-detection, misconfiguration-detection, network-vulnerability-detection	Planned / Resource
Wapiti	web-vulnerability-detection	web-vulnerability-detection	Integrated · partial support

Injection Detection / Validation

Tool	Primary role	Capabilities fed to HunterX	Status
Commix	command-injection-detection, command-injection-validation	command-injection-detection, command-injection-validation	Integrated · partial support
Dalfox	xss-discovery, reflection-analysis	xss-discovery, reflection-analysis, parameter-analysis, xss-validation	Integrated · partial support
Ghauri	sql-injection-detection, sql-injection-validation	sql-injection-detection, sql-injection-validation, database-fingerprinting	Integrated · partial support
SQLmap	sql-injection-detection, sql-injection-validation	sql-injection-detection, sql-injection-validation, database-fingerprinting	Integrated · partial support
SSTImap	ssti-detection, ssti-validation	ssti-detection, ssti-validation, template-engine-identification	Integrated · partial support
Tplmap	ssti-detection, template-engine-identification	ssti-detection, template-engine-identification	Integrated · partial support
XSStrike	xss-discovery, dom-analysis	xss-discovery, dom-analysis, reflection-analysis	Integrated · partial support
XXEinjector	xxe-detection, xxe-validation	xxe-detection, xxe-validation, oob-xml-interaction	Integrated · partial support

OOB / Callback

Tool	Primary role	Capabilities fed to HunterX	Status
Interactsh	oob-callback, dns-callback	oob-callback, dns-callback, http-callback, smtp-callback, interaction-correlation	Integrated · partial support

Source / Code / Secret Analysis

Tool	Primary role	Capabilities fed to HunterX	Status
detect-secrets	secret-discovery, credential-discovery	secret-discovery, credential-discovery, token-discovery	Integrated · partial support
Gitleaks	secret-discovery, credential-discovery	secret-discovery, credential-discovery, token-discovery, key-discovery	Integrated · fully supported
TruffleHog	secret-discovery, credential-discovery	secret-discovery, credential-discovery, token-discovery	Integrated · partial support

SAST

Tool	Primary role	Capabilities fed to HunterX	Status
CodeQL CLI	sast, code-flow-analysis	sast, code-flow-analysis, taint-analysis, vulnerability-pattern-detection	Planned / Resource
Semgrep	sast, code-pattern-analysis	sast, code-pattern-analysis, vulnerability-pattern-detection	Integrated · partial support

Proxy / Web Security

Tool	Primary role	Capabilities fed to HunterX	Status
mitmproxy	http-interception, request-replay	http-interception, request-replay, response-analysis, traffic-capture	Integrated · partial support
OWASP ZAP	http-interception, request-replay	http-interception, request-replay, response-analysis, active-testing	Integrated · partial support

Exploitation / Security Research

Tool	Primary role	Capabilities fed to HunterX	Status
ExploitDB	exploit-research, cve-research	exploit-research, cve-research, version-mapping	Integrated · partial support
Metasploit Framework	exploit-validation, service-validation	exploit-validation, service-validation, payload-capability, session-management	Integrated · execution only
SearchSploit / ExploitDB	exploit-research, cve-research	exploit-research, cve-research, version-mapping	Integrated · partial support

Knowledge / Payload Resources

Tool	Primary role	Capabilities fed to HunterX	Status
FuzzDB	attack-patterns, payload-intelligence	attack-patterns, payload-intelligence, response-patterns, discovery-dictionaries	Integrated · partial support
PayloadsAllTheThings	payload-intelligence, payload-generation	payload-intelligence, payload-generation, vulnerability-class-payloads	Integrated · partial support
SecLists	wordlist-provider, content-discovery-aid	wordlist-provider, content-discovery-aid, dns-bruteforce-aid, password-audit-aid	Integrated · partial support

API / GraphQL

Tool	Primary role	Capabilities fed to HunterX	Status
GraphQLmap	graphql-analysis, graphql-introspection	graphql-analysis, graphql-introspection, query-analysis	Integrated · partial support
InQL	graphql-analysis, graphql-introspection	graphql-analysis, graphql-introspection, query-analysis	Integrated · partial support
jwt_tool	jwt-analysis, authentication-analysis	jwt-analysis, authentication-analysis	Planned / Resource
Kiterunner	api-discovery, content-discovery	api-discovery, content-discovery	Integrated · partial support
OpenAPI / Swagger parser	openapi-analysis, api-discovery	openapi-analysis, api-discovery, api-parameter-analysis	Integrated · partial support
Postman collection parser	api-discovery, api-parameter-analysis	api-discovery, api-parameter-analysis	Integrated · partial support

JavaScript Analysis

Tool	Primary role	Capabilities fed to HunterX	Status
JSluice	javascript-analysis, endpoint-extraction	javascript-analysis, endpoint-extraction, secret-indicator-discovery, source-map-discovery	Integrated · partial support
LinkFinder	javascript-analysis, endpoint-extraction	javascript-analysis, endpoint-extraction	Integrated · partial support
SecretFinder	javascript-analysis, secret-indicator-discovery	javascript-analysis, secret-indicator-discovery	Integrated · partial support
xnLinkFinder	javascript-analysis, endpoint-extraction	javascript-analysis, endpoint-extraction, parameter-discovery	Integrated · partial support

Cloud Assessment

Tool	Primary role	Capabilities fed to HunterX	Status
Prowler	aws-security, azure-security	aws-security, azure-security, gcp-security, cloud-asset-discovery, cloud-misconfiguration	Integrated · partial support
ScoutSuite	aws-security, azure-security	aws-security, azure-security, gcp-security, cloud-misconfiguration	Planned / Resource

Container / Supply Chain

Tool	Primary role	Capabilities fed to HunterX	Status
Grype	container-analysis, cve-analysis	container-analysis, cve-analysis, dependency-analysis	Integrated · partial support
kube-bench	kubernetes-security, k8s-configuration-analysis	kubernetes-security, k8s-configuration-analysis	Planned / Resource
Syft	sbom-generation, container-analysis	sbom-generation, container-analysis, dependency-analysis	Integrated · partial support
Trivy	container-analysis, image-analysis	container-analysis, image-analysis, sbom, dependency-analysis	Integrated · partial support

Dependency Scanning

Tool	Primary role	Capabilities fed to HunterX	Status
OSV-Scanner	dependency-analysis, vulnerability-mapping	dependency-analysis, vulnerability-mapping	Integrated · partial support

Enterprise / Active Directory

Tool	Primary role	Capabilities fed to HunterX	Status
enum4linux-ng	smb-enumeration, windows-enumeration	smb-enumeration, windows-enumeration, domain-enumeration	Planned / Resource
Impacket	smb-enumeration, kerberos-enumeration	smb-enumeration, kerberos-enumeration, domain-enumeration	Planned / Resource
ldapsearch	ldap-enumeration, active-directory-intelligence	ldap-enumeration, active-directory-intelligence	Planned / Resource
NetExec	smb-enumeration, windows-enumeration	smb-enumeration, windows-enumeration, ldap-enumeration, domain-enumeration	Planned / Resource
rpcclient	smb-enumeration, windows-enumeration	smb-enumeration, windows-enumeration	Planned / Resource

SNMP

Tool	Primary role	Capabilities fed to HunterX	Status
snmpwalk	snmp-enumeration, network-device-enumeration	snmp-enumeration, network-device-enumeration	Planned / Resource

Password / Wordlist

Tool	Primary role	Capabilities fed to HunterX	Status
CeWL	wordlist-generation, content-discovery-aid	wordlist-generation, content-discovery-aid, custom-wordlists	Integrated · partial support
Hashcat	password-cracking, hash-analysis	password-cracking, hash-analysis, hash-modes	Planned / Resource
John the Ripper	password-cracking, hash-analysis	password-cracking, hash-analysis	Planned / Resource

DNS & Resolution

Tool	Primary role	Capabilities fed to HunterX	Status
dnspython	dns-resolution, record-enumeration	dns-resolution, record-enumeration	Integrated · fully supported
DNSrecon	dns-enumeration, brute-force-dns	dns-enumeration, brute-force-dns, record-enumeration	Planned / Resource
DNSx	dns-resolution, record-enumeration	dns-resolution, record-enumeration, wildcard-detection	Integrated · fully supported
MassDNS	dns-resolution	dns-resolution	Integrated · partial support
Shuffledns	dns-resolution, brute-force-dns	dns-resolution, brute-force-dns	Integrated · partial support

Proof / Replay

Tool	Primary role	Capabilities fed to HunterX	Status
Proof Replay	safe-validation, proof-replay	safe-validation, proof-replay, impact-statement	Integrated · fully supported

HunterX integrates with and leverages the third-party open-source projects listed above. It does not claim ownership of them. Each project keeps its own license and attribution, which is preserved in THIRD_PARTY_NOTICES. Tool names, trademarks and descriptions are used only to document interoperability.

Vulnerability Proof & PoC — how proof contracts validate hypotheses
Full Toolchain Intelligence — the integration architecture
Tool Integration SDK — the adapter SDK
Features — platform capabilities