GynToolkit

🌐 Language / Idioma: English · Português (BR)

 ██████╗██╗   ██╗███╗   ██╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
██╔════╝╚██╗ ██╔╝████╗  ██║    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
██║  ███╗╚████╔╝ ██╔██╗ ██║       ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║
██║   ██║ ╚██╔╝  ██║╚██╗██║       ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   v2.1
╚██████╔╝  ██║   ██║ ╚████║       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   by: PH,Fl4vs
 ╚═════╝   ╚═╝   ╚═╝  ╚═══╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝

All-in-one Python security toolkit for reconnaissance, network scanning, vulnerability analysis and authorized penetration testing — in a single dark-themed interactive CLI (gyntoolkit:~#).

[!] WARNING: Use only against targets you are authorized in writing to test. Unauthorized use is a crime — Lei 12.737/12 (BR), CFAA (US) and equivalents.

Table of Contents

• Why GynToolkit?
• Features
• Installation
• Quick Start
• Example
• Security Lab
• Reports
• Configuration
• Documentation
• Development
• Testing
• Contributing
• Security
• Disclaimer
• License

Why GynToolkit?

• One CLI, many tools — recon, port scanning, TLS/HTTP fingerprinting, CVE lookup and SSH/HTTP auth testing, without juggling a dozen separate commands.
• Safe to try — ships with a local lab (127.0.0.1) and an end-to-end runner, so you can exercise every brute-force module without touching a real target.
• Readable output — rich tables/panels when available, graceful fallback to plain colored text; export any result to JSON or a dark-themed HTML report.
• Authorization-first — every attack module requires explicit confirmation.
• Zero mandatory API keys — recon sources used (crt.sh, ip-api, InternetDB, HIBP, NVD) work on their public/free tiers.

Features

[1] Information Gathering — passive & active recon

[2] Brute Force

Every attack requires typing AUTORIZO to confirm — no silent bypass.

[3] Advanced Scanning

• Port scan — fast (Top 21 common ports) or full (1–65535)
• SYN scan (stealth) when privileged, automatic fallback to TCP connect
• Banner grabbing — async, parallel
• CVE analysis per service via NVD API v2.0
• Host discovery (ARP scan) by CIDR — e.g. 192.168.0.0/24
• Automatic risk classification based on CVEs found

[4] Utilities

Installation

Requirements: Python 3.10+ and pip.

From PyPI (recommended)

pip install gyntoolkit
gyntoolkit          # launch the interactive CLI

That installs the gyntoolkit command and all dependencies.

From source (development)

git clone https://github.com/flavsjr/gyntoolkit.git
cd gyntoolkit
pip install -e .
gyntoolkit          # or: python -m gyntoolkit

Optional — brute-force wordlists: the "CUPP wordlist" module wraps CUPP. Clone it next to where you run GynToolkit (git clone https://github.com/Mebus/cupp.git); it is not a Python dependency and is not installed by pip.

Windows note: for SYN scan and traceroute (raw sockets) install Npcap and run in an admin terminal. Without Npcap, SYN scan degrades to TCP connect scan automatically.

Quick Start

gyntoolkit               # after `pip install gyntoolkit`
# or, from a source checkout:
python -m gyntoolkit

An interactive dark CLI opens with a numbered menu. Commands are entered at the gyntoolkit:~# prompt. Output degrades gracefully to plain colored text if rich is not installed.

Example

Target: the local security lab (never a third-party system).

# 1. Launch GynToolkit
gyntoolkit

# 2. Pick [3] Advanced Scanning → scan 127.0.0.1
# 3. Inspect discovered services / banners
# 4. When prompted, export the result as JSON or HTML report

To exercise the brute-force modules end to end against local mocks:

python lab/run_e2e.py

See Security Lab below.

Security Lab

The project includes a local lab so you can test GynToolkit without targeting external systems — no Docker, no VMs.

GynToolkit  →  Security Lab  →  127.0.0.1  →  Recon / Scan / Auth testing  →  Report

Run the full automated suite (starts mocks, attacks, validates, tears down):

python lab/run_e2e.py     # exit code 0 = all green

Full walkthrough: docs/security-lab.md and lab/README.md.

The mocks accept weak credentials on purpose. Run only on 127.0.0.1 and never expose them on a public network.

Reports

After scans and recon lookups, the CLI offers to export results as JSON or a dark-themed HTML report. Files are written to reports/<module>-<timestamp>.<fmt> (configurable via export.dir; set export.auto: true to export without prompting). Details in docs/reports.md.

Configuration

Optional. Copy .gyntoolkit.example.yaml to .gyntoolkit.yaml and override only the keys you want — everything else falls back to defaults.

cp .gyntoolkit.example.yaml .gyntoolkit.yaml

Resolution order: GYNTOOLKIT_CONFIG env var → .gyntoolkit.yaml in the current directory → .gyntoolkit.yaml in the project root. Full reference: docs/configuration.md.

UI language: menus run in English or Portuguese. Set ui.lang: auto|en|pt in the config, or GYNTOOLKIT_LANG=pt / =en per run; auto detects the OS locale and falls back to English.

Documentation

Development

git clone https://github.com/flavsjr/gyntoolkit.git
cd gyntoolkit
python -m venv .venv && source .venv/bin/activate   # .venv\Scripts\activate on Windows
pip install -e ".[dev]"

Lint and type-check (config in pyproject.toml):

ruff check .
ruff check . --fix
mypy gyntoolkit

See CONTRIBUTING.md and docs/development.md.

Testing

Unit tests (offline — no network, no external services, no real targets):

pytest

End-to-end lab suite (local mocks):

python lab/run_e2e.py

Both run in CI on every push/PR (see the CI badge above).

Contributing

Fork → Branch → Changes → Tests → Pull Request

Commits follow Conventional Commits. Full guide (dev setup, ruff, running the lab): CONTRIBUTING.md. Report bugs and request features with the issue templates.

Security

GynToolkit is intended for authorized security testing, security research, CTFs and controlled lab environments. To report a vulnerability in GynToolkit itself, see SECURITY.md — please do not open a public issue for sensitive reports.

Disclaimer

GynToolkit is intended exclusively for:

• Security testing authorized in writing
• Academic research in controlled environments
• Ethical pentest practice (CTF, HackTheBox, TryHackMe, your own labs)

Any use against systems or networks without explicit authorization is strictly prohibited and constitutes a crime under most jurisdictions. The authors are not liable for misuse or damage caused by this software.

License

MIT — see LICENSE.

Star History

If this project helped you, drop a ⭐ — it really boosts visibility!