oxhunter 2.0.9

  ___       _   _ _   _ _   _ _____ _____ ____  
 / _ \__  _| | | | | | | \ | |_   _| ____|  _ \ 
| | | \ \/ / |_| | | | |  \| | | | |  _| | |_) |
| |_| |>  <|  _  | |_| | |\  | | | | |___|  _ < 
 \___//_/\_\_| |_|\___/|_| \_| |_| |_____|_| \_\
                                            v2.0.6

What's New in v2.0

Features

Core Modules (9)

Security Testing (6)

New Features (8) 🔥

AI Features (6 — Groq Free)

• AI Payload Generator
• Smart Vulnerability Chaining
• False Positive Reducer
• Natural Language Report (English + Urdu)
• AI Auto-Exploit Generator ← New
• Smart Attack Chain Analysis ← New

Advanced Recon (6)

Integrations (4)

• Slack + Discord Alerts
• Jira + GitHub Issues
• Burp Suite Import/Export
• GitHub Actions CI/CD

Compliance (3)

• OWASP Top 10 + Score
• PCI-DSS v4.0 Report
• ISO 27001:2022 Report + Bug Bounty Mode

Payload Count (2033+)

Installation

Linux / Kali / macOS

git clone https://github.com/Talha-Imran-cloud/OXHUNTER.git
cd OXHUNTER
pip install -r requirements.txt
playwright install chromium
0xhunter version

Windows (PowerShell)

git clone https://github.com/Talha-Imran-cloud/OXHUNTER.git
cd OXHUNTER
pip install -r requirements.txt
playwright install chromium
0xhunter version

Virtual Environment

python3 -m venv venv
source venv/bin/activate       # Linux/Mac
# venv\Scripts\activate        # Windows
pip install -r requirements.txt
playwright install chromium

Commands

0xhunter --help
0xhunter scan --help
0xhunter version

Basic Scan

# Standard scan — 7 core modules
0xhunter scan https://target.com --confirm

# Full scan — all modules + 2033 payloads
0xhunter scan https://target.com --confirm --full

# Verbose output
0xhunter scan https://target.com --confirm --full --verbose

Reports

0xhunter scan https://target.com --confirm --report html
0xhunter scan https://target.com --confirm --report json
0xhunter scan https://target.com --confirm --report both
0xhunter scan https://target.com --confirm --report html --output myreport.html

Authentication

0xhunter scan https://target.com --confirm --cookie "session=abc123"
0xhunter scan https://target.com --confirm --token "Bearer eyJhbGci..."
0xhunter scan https://target.com --confirm --auth "admin:password"

Proxy

0xhunter scan https://target.com --confirm --proxy http://127.0.0.1:8080

AI Features

# Set API key first
export GROQ_API_KEY="gsk_your_key"           # Linux/Mac
$env:GROQ_API_KEY = "gsk_your_key"           # Windows

0xhunter scan https://target.com --confirm --ai
0xhunter scan https://target.com --confirm --ai --lang en
0xhunter scan https://target.com --confirm --ai --lang ur
0xhunter scan https://target.com --confirm --ai --ai-chain
0xhunter scan https://target.com --confirm --ai --ai-fp
0xhunter scan https://target.com --confirm --full --ai --ai-chain --ai-fp --lang ur

WAF

0xhunter scan https://target.com --confirm --waf-detect
0xhunter scan https://target.com --confirm --waf-bypass
0xhunter scan https://target.com --confirm --waf-detect --waf-bypass

Compliance

0xhunter scan https://target.com --confirm --compliance owasp
0xhunter scan https://target.com --confirm --compliance pci
0xhunter scan https://target.com --confirm --compliance iso
0xhunter scan https://target.com --confirm --bug-bounty --scope "*.target.com"

Notifications

0xhunter scan https://target.com --confirm --notify slack
0xhunter scan https://target.com --confirm --notify discord
0xhunter scan https://target.com --confirm --notify both

Integrations

0xhunter scan https://target.com --confirm --github-issues
0xhunter scan https://target.com --confirm --jira
0xhunter scan https://target.com --confirm --export-burp reports/burp.xml

Scan Control

0xhunter scan https://target.com --confirm --threads 20 --timeout 15 --delay 0.3
0xhunter scan https://target.com --confirm --resume SCAN_ID
0xhunter scan --targets targets.txt --confirm

🆕 New Feature Commands

🖥️ Live Web Dashboard

0xhunter dashboard
0xhunter dashboard --port 9000
# Open: http://127.0.0.1:8787

🌐 Mass Scan / ASN Scanner

0xhunter mass-scan --targets-file targets.txt --confirm
0xhunter mass-scan --cidr 192.168.1.0/24 --confirm
0xhunter mass-scan --targets-file targets.txt --asn AS13335 --confirm
0xhunter mass-scan --targets-file targets.txt --confirm --concurrency 20
0xhunter mass-scan --targets-file targets.txt --confirm --output results.json

🎯 Nuclei Template Support

0xhunter nuclei --targets-file targets.txt --confirm
0xhunter nuclei --targets-file targets.txt --confirm --severity critical,high
0xhunter nuclei --targets-file targets.txt --confirm --templates ./my-templates/
0xhunter nuclei --targets-file targets.txt --confirm --output nuclei_results.json

🔍 Passive Recon Engine

0xhunter scan https://target.com --confirm --passive-recon
0xhunter scan https://target.com --confirm --recon-only
# Saves to: reports/passive_recon.html

🤖 AI Auto-Exploit Generator

0xhunter scan https://target.com --confirm --full --ai --exploit-gen
# Saves to: reports/exploits/

⛓️ Smart Attack Chaining

0xhunter scan https://target.com --confirm --full --chain-attacks
0xhunter scan https://target.com --confirm --full --ai --chain-attacks
# Saves to: reports/attack_chains.html

🔑 OAuth 2.0 / OIDC Tester

0xhunter scan https://target.com --confirm --oauth
0xhunter scan https://target.com --confirm --full --oauth

📦 Supply Chain Attack Detector

0xhunter scan https://target.com --confirm --supply-chain
0xhunter scan https://target.com --confirm --full --supply-chain

Power Commands

# Ultimate scan — all features combined
0xhunter scan https://target.com \
  --confirm --full \
  --ai --ai-chain --ai-fp --lang en \
  --waf-detect --waf-bypass \
  --compliance owasp \
  --passive-recon \
  --exploit-gen --chain-attacks \
  --oauth --supply-chain \
  --notify slack \
  --report html \
  --verbose

# Bug Bounty
0xhunter scan https://target.com \
  --confirm --full --ai \
  --bug-bounty --scope "*.target.com" \
  --chain-attacks --exploit-gen \
  --report html --notify discord

# Red Team
0xhunter scan https://target.com \
  --confirm --full --ai \
  --exploit-gen --chain-attacks \
  --waf-bypass --proxy http://127.0.0.1:8080 \
  --report html

All Flags Reference

All Commands

AI Setup

1. Go to console.groq.com/keys
2. Sign up (no credit card required)
3. Create API Key → copy gsk_xxx

GROQ_API_KEY=gsk_your_key_here   # Add to your .env file

Free Tier: 14,400 req/day · 500K tokens/day ✅

CI/CD

name: OXHUNTER Security Scan
on:
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1'

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - run: pip install -r requirements.txt && playwright install chromium
      - run: |
          0xhunter scan ${{ secrets.TARGET_URL }} \
            --confirm --full --report json --output results.json
        env:
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      - uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: results.json

Reports

reports/
├── report.html           ← Main vulnerability report
├── report.json           ← Raw findings (JSON)
├── passive_recon.html    ← Passive recon results
├── attack_chains.html    ← Attack chain analysis
├── exploits.html         ← AI exploit report
├── burp_export.xml       ← Burp Suite format
├── nl_report_en.txt      ← AI English report
├── nl_report_ur.txt      ← AI Urdu report
└── screenshots/          ← Evidence screenshots
    exploits/
    ├── 01_xss_high.js
    └── 02_sqli_critical.py

Severity Levels

Troubleshooting

# chardet warning
pip install --upgrade requests urllib3 chardet

# playwright missing
playwright install chromium

# websocket error
pip install websocket-client

# flask missing (dashboard)
pip install flask flask-socketio

# AI not working
echo $GROQ_API_KEY   # must start with gsk_

# Nuclei not found
# Download: https://github.com/projectdiscovery/nuclei/releases

Legal

✅ Authorized penetration testing
✅ Bug bounty (in-scope only)
✅ Security research + education
✅ CTF challenges

❌ Unauthorized scanning
❌ Malicious use
❌ Illegal activity