PenHunter

About

PenHunter is a powerful, modular web vulnerability scanner written in Go. It provides comprehensive testing for common web vulnerabilities including XSS, SQL Injection, LFI, SSRF, RCE, Open Redirect, and CSRF — with concurrent scanning, advanced detection methods, WAF evasion, and integrations with industry tools like dalfox, sqlmap, and nuclei.

PenHunter — modular vulnerability scanner with interactive and CLI modes.

Table of Contents

• About
• Features
• Installation
• Quick Start
• Usage Examples
• Screenshots
• Command Reference
• Advanced Usage
• Contributing
• License
• Support

Features

Core Capabilities

• Multiple Vulnerability Scanners: XSS, SQLi, LFI, SSRF, RCE, Open Redirect, CSRF
• High Performance: Concurrent scanning with configurable thread pools
• Advanced Detection: Boolean-based, time-based, error-based detection methods
• WAF Evasion: Payload mutation, header rotation, TLS fingerprint randomization
• External Tool Integration: dalfox, sqlmap, nuclei, and more
• Multiple Output Formats: JSON, HTML, TXT
• Interactive CLI: Menu-driven interface for guided scans
• Auto-Update: Built-in update mechanism via GitHub releases
• Organized Results: Automatic directory structure for scan results

Intelligent Detection Engine

Differential analysis, boolean/time/error oracles, and payload mutation built in.

• Differential Response Analysis: Detects subtle behavior changes that confirm vulnerabilities
• Multi-Method Coverage: Boolean-based, time-based, and error-based detection paths per vuln class
• Payload Mutation: Automatic encoding, casing, and obfuscation variants for WAF bypass
• Confidence Scoring: Per-finding confidence to filter true positives from noise

Discovery Pipeline

Vulnerability Classes

HTTP & Networking

Output & Reporting

Installation

Go Install (Recommended)

go install -v github.com/cc1a2b/PenHunter/cmd/penhunter@latest
penhunter --help

Note: go install ships only the binary. To get the bundled config/ (payloads, encoders, user callbacks), clone the repo or use make install.

Build from Source

git clone https://github.com/cc1a2b/PenHunter.git
cd PenHunter
make build
make install                # installs to $HOME/penhunter/

Add to PATH

# Linux/macOS
export PATH="$HOME/penhunter/bin:$PATH"
Or symlink
sudo ln -sf $HOME/penhunter/bin/penhunter /usr/local/bin/penhunter

From Releases

System Requirements

• Go 1.21+ (for building from source)
• Linux, macOS, or Windows (64-bit)
• External recon tools (optional but recommended): subfinder, assetfinder, httpx, katana, gau, dalfox, sqlmap, nuclei

Quick Start

Interactive mode

penhunter

Single URL scan

penhunter -u https://example.com -v xss,sqli

Multi-URL scan with JSON output

penhunter -l urls.txt -v xss -t 50 --json results.json

Update PenHunter

penhunter --update

Usage Examples

# Test single URL for XSS + SQLi
penhunter -u https://example.com -v xss,sqli
Multi-URL scan with custom thread count
penhunter -l urls.txt -v xss -t 50 --json results.json
Full vulnerability sweep
penhunter -u https://target.com -v xss,sqli,lfi,ssrf,rce,redirect,csrf -t 30
Stealth scan through Burp Suite
penhunter -u https://target.com -v xss --proxy http://127.0.0.1:8080 -R 1000
Authenticated scan with cookies and headers
penhunter -u https://target.com -v xss,sqli \
  -c "session=abc123" \
  -H "Authorization: Bearer eyJ..."
Check installed external tools
penhunter --check-tools
Check for updates
penhunter --check-update

Screenshots

Command Reference

Usage:
  penhunter [flags]
Modes:   (no args)                       Launch interactive menu   -u, --url URL                   Test a single URL   -l, --list FILE                 Test URLs from a file   -v, --vulns LIST                Comma-separated vulns                                   (xss, sqli, lfi, ssrf, rce, redirect, csrf)
HTTP & Performance:   -t, --threads INT               Concurrent threads (default: 10)   -H, --header "K: V"             Custom HTTP headers (repeatable)   -c, --cookies STR               Session cookies   -p, --proxy URL                 HTTP/HTTPS/SOCKS proxy   -k, --skip-tls                  Skip TLS verification   -R, --rate-limit MS             Request delay (milliseconds)
Output:   -o, --output FILE               Output file   --json FILE                     Structured JSON output   --html FILE                     HTML report
Maintenance:   --update                        Update PenHunter to latest   --check-update                  Check if a new version is available   --check-tools                   Verify external tools are installed   -h, --help                      Show help   -V, --version                   Show version

Advanced Usage

Bug Bounty Workflow

# 1. Subdomain enumeration → URL collection → vuln scan
subfinder -d target.com | httpx | tee live.txt
gau < live.txt | tee urls.txt
penhunter -l urls.txt -v xss,sqli,redirect -t 30 --json findings.json

CI / Continuous Scanning

penhunter -l production-urls.txt -v xss,sqli \
  --json "scan-$(date +%F).json" \
  -R 2000 \
  --proxy http://internal-proxy:8080

WAF Evasion Scan

penhunter -u https://target.com -v xss \
  -H "X-Forwarded-For: 1.1.1.1" \
  -H "X-Real-IP: 1.1.1.1" \
  -R 1500

Contributing

Contributions welcome from the security community.

• Report bugs via GitHub Issues
• Suggest features or new vulnerability classes
• Improve documentation
• Submit pull requests with new payloads, detectors, or integrations

Development Setup

git clone https://github.com/cc1a2b/PenHunter.git
cd PenHunter
go mod tidy
make build

License

PenHunter is released under the MIT License. See LICENSE for details.

Copyright (c) 2024-2026 Hussain Alsharman
Licensed under MIT License — free for commercial and personal use

Support

If PenHunter helps with your security research: