GynToolkit

🌐 Language / Idioma: English · Português (BR)

 ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.3
╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
 ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝

All-in-one Python security toolkit for reconnaissance, network scanning, vulnerability analysis and authorized penetration testing — in a single dark-themed interactive CLI (gyntoolkit:~#).

[!] WARNING: Use only against targets you are authorized in writing to test. Unauthorized use is a crime — Lei 12.737/12 (BR), CFAA (US) and equivalents.

Table of Contents

• Why GynToolkit?
• Features
• Installation
• Quick Start
• Example
• Security Lab
• Reports
• Configuration
• Documentation
• Development
• Testing
• Contributing
• Security
• Disclaimer
• License

Why GynToolkit?

• One CLI, many tools — recon, port scanning, TLS/HTTP fingerprinting, CVE lookup and SSH/HTTP auth testing, without juggling a dozen separate commands.
• Safe to try — ships with a local lab (127.0.0.1) and an end-to-end runner, so you can exercise every brute-force module without touching a real target.
• Readable output — rich tables/panels when available, graceful fallback to plain colored text; export any result to JSON or a dark-themed HTML report.
• Authorization-first — every attack module requires explicit confirmation.
• Zero mandatory API keys — recon sources used (crt.sh, ip-api, InternetDB, HIBP, NVD) work on their public/free tiers.

Features

[1] Information Gathering — passive & active recon

[2] Brute Force

Every attack requires typing the authorization word (AUTHORIZE / AUTORIZO) to confirm — no silent bypass.

[3] Advanced Scanning

• Port scan — fast (Top 21 common ports) or full (1–65535)
• SYN scan (stealth) when privileged, automatic fallback to TCP connect
• Banner grabbing — async, parallel
• CVE analysis per service via NVD API v2.0 — parses product + version from the banner and matches by CPE (virtualMatchString), falling back to keyword search; rate-limited and deduplicated per banner
• Risk scoring — each CVE is enriched with CVSS base score/severity, EPSS exploitation probability and a CISA KEV flag; host risk is the highest severity found (KEV forces critical). Filter with --min-cvss / --kev-only
• Host discovery (ARP scan) by CIDR — e.g. 192.168.0.0/24
• Automatic risk classification based on CVEs found

[4] Utilities

[5] Audit — one target, consolidated profile

Orchestrates the recon modules (and, with --active --authorize, the port scan) into a single report with an executive summary. Passive by default; stage selection via --only / --skip. See the CLI examples.

Installation

Requirements: Python 3.10+ and pip.

From PyPI (recommended)

pip install gyntoolkit
gyntoolkit          # launch the interactive CLI

That installs the gyntoolkit command and all dependencies.

From source (development)

git clone https://github.com/flavsjr/gyntoolkit.git
cd gyntoolkit
pip install -e .
gyntoolkit          # or: python -m gyntoolkit

Optional — brute-force wordlists: the "CUPP wordlist" module wraps CUPP. Clone it next to where you run GynToolkit (git clone https://github.com/Mebus/cupp.git); it is not a Python dependency and is not installed by pip.

Windows note: for SYN scan and traceroute (raw sockets) install Npcap and run in an admin terminal. Without Npcap, SYN scan degrades to TCP connect scan automatically.

Quick Start

gyntoolkit               # after `pip install gyntoolkit`
# or, from a source checkout:
python -m gyntoolkit

An interactive dark CLI opens with a numbered menu. Commands are entered at the gyntoolkit:~# prompt. Output degrades gracefully to plain colored text if rich is not installed.

Non-interactive CLI (scriptable)

Pass a subcommand to run a single action and print the result as JSON on stdout (pipe-friendly) — no menu. Omit the subcommand to open the interactive menu.

gyntoolkit recon dns example.com --type MX        # DNS lookup
gyntoolkit recon axfr example.com                 # zone transfer attempt
gyntoolkit recon webscan http://example.com       # web content discovery
gyntoolkit recon shodan 1.1.1.1                   # Shodan host (needs api_keys.shodan)
gyntoolkit recon ssl example.com --port 443       # TLS cert
gyntoolkit scan 127.0.0.1 --type fast             # port scan + CVEs (CVSS/EPSS/KEV)
gyntoolkit scan 10.0.0.5 --min-cvss 7.0 --kev-only # only high-risk / actively exploited
gyntoolkit scan 192.168.0.0/24                    # host discovery (CIDR)
gyntoolkit audit example.com                      # full passive profile → one report
gyntoolkit audit 10.0.0.5 --active --authorize    # + active port scan (authorized)
gyntoolkit utils hash "text" --algo sha1
gyntoolkit utils jwt <token>
gyntoolkit wordlist --terms alice,fluffy,acme --years 1990,2020 --leet --save wl.txt

audit runs a pipeline over one target and consolidates everything into a single report with an executive summary. It is passive by default (WHOIS, DNS, geo, subdomains, TLS, HTTP fingerprint, InternetDB, HIBP, email security); the active port scan only runs with --active --authorize. Narrow it with --only a,b or --skip a,b.

Global flags (place after the subcommand): -o/--output DIR saves a report, -f/--format {json,html,csv,md} picks its format, -q/--quiet silences stdout, --lang {en,pt} overrides the language.

gyntoolkit scan scanme.example.com -o reports -f md     # also save a Markdown report
gyntoolkit recon geo 1.1.1.1 -o reports -f csv -q       # CSV only, no stdout

Active attacks are available but require explicit authorization:

gyntoolkit brute ssh HOST --users users.txt --passwords pass.txt --authorize
gyntoolkit brute http URL  --users admin --passwords pass.txt --mode form \
  --user-field user --pass-field pass --fail-signature "Invalid" --authorize

Without --authorize, brute subcommands abort — you confirm you have written authorization for the target.

Example

Target: the local security lab (never a third-party system).

# 1. Launch GynToolkit
gyntoolkit

# 2. Pick [3] Advanced Scanning → scan 127.0.0.1
# 3. Inspect discovered services / banners
# 4. When prompted, export the result as JSON or HTML report

To exercise the brute-force modules end to end against local mocks:

python lab/run_e2e.py

See Security Lab below.

Security Lab

The project includes a local lab so you can test GynToolkit without targeting external systems — no Docker, no VMs.

GynToolkit  →  Security Lab  →  127.0.0.1  →  Recon / Scan / Auth testing  →  Report

Run the full automated suite (starts mocks, attacks, validates, tears down):

python lab/run_e2e.py     # exit code 0 = all green

Full walkthrough: docs/security-lab.md and lab/README.md.

The mocks accept weak credentials on purpose. Run only on 127.0.0.1 and never expose them on a public network.

Reports

After scans and recon lookups, the CLI offers to export results as JSON, a dark-themed HTML report, CSV or Markdown. Files are written to reports/<module>-<timestamp>.<fmt> (configurable via export.dir; set export.auto: true to export without prompting). Details in docs/reports.md.

Configuration

Optional. Copy .gyntoolkit.example.yaml to .gyntoolkit.yaml and override only the keys you want — everything else falls back to defaults.

cp .gyntoolkit.example.yaml .gyntoolkit.yaml

Resolution order: GYNTOOLKIT_CONFIG env var → .gyntoolkit.yaml in the current directory → .gyntoolkit.yaml in the project root. Full reference: docs/configuration.md.

UI language: menus run in English or Portuguese. Set ui.lang: auto|en|pt in the config, or GYNTOOLKIT_LANG=pt / =en per run; auto detects the OS locale and falls back to English.

Documentation

Development

git clone https://github.com/flavsjr/gyntoolkit.git
cd gyntoolkit
python -m venv .venv && source .venv/bin/activate   # .venv\Scripts\activate on Windows
pip install -e ".[dev]"

Lint and type-check (config in pyproject.toml):

ruff check .
ruff check . --fix
mypy gyntoolkit

See CONTRIBUTING.md and docs/development.md.

Testing

Unit tests (offline — no network, no external services, no real targets):

pytest

End-to-end lab suite (local mocks):

python lab/run_e2e.py

Both run in CI on every push/PR (see the CI badge above).

Contributing

Fork → Branch → Changes → Tests → Pull Request

Commits follow Conventional Commits. Full guide (dev setup, ruff, running the lab): CONTRIBUTING.md. Report bugs and request features with the issue templates.

Security

GynToolkit is intended for authorized security testing, security research, CTFs and controlled lab environments. To report a vulnerability in GynToolkit itself, see SECURITY.md — please do not open a public issue for sensitive reports.

Disclaimer

GynToolkit is intended exclusively for:

• Security testing authorized in writing
• Academic research in controlled environments
• Ethical pentest practice (CTF, HackTheBox, TryHackMe, your own labs)

Any use against systems or networks without explicit authorization is strictly prohibited and constitutes a crime under most jurisdictions. The authors are not liable for misuse or damage caused by this software.

License

MIT — see LICENSE.

Star History

If this project helped you, drop a ⭐ — it really boosts visibility!