oxhunter 2.1.4

  ___       _   _ _   _ _   _ _____ _____ ____  
 / _ \__  _| | | | | | | \ | |_   _| ____|  _ \ 
| | | \ \/ / |_| | | | |  \| | | | |  _| | |_) |
| |_| |>  <|  _  | |_| | |\  | | | | |___|  _ < 
 \___//_/\_\_| |_|\___/|_| \_| |_| |_____|_| \_\
                                            v2.1.0

What's New in v2.1.0 🔥

What's New in v2.0

Installation

Via PyPI (Recommended)

pip install oxhunter
playwright install chromium
0xhunter version

Via Git Clone

# Linux / Kali / macOS
git clone https://github.com/Talha-Imran-cloud/Oxhunter.git
cd Oxhunter
pip install -r requirements.txt
playwright install chromium
0xhunter version

# Windows (PowerShell)
git clone https://github.com/Talha-Imran-cloud/Oxhunter.git
cd Oxhunter
pip install -r requirements.txt
playwright install chromium
0xhunter version

Update to Latest

pip install oxhunter --upgrade
# or force specific version
pip install oxhunter==2.1.0 --force-reinstall

Speed Presets 🚀

v2.1.0 biggest feature — ab manually --threads, --delay, --timeout set karne ki zaroorat nahi!

# Fast — CTF / Lab
0xhunter scan https://target.com --confirm --speed fast

# Normal — Bug Bounty
0xhunter scan https://target.com --confirm --speed normal

# Stealth — Evade WAF/IDS
0xhunter scan https://target.com --confirm --speed stealth

# Manual override (still works)
0xhunter scan https://target.com --confirm --threads 15 --delay 0.3 --timeout 25

Note: --speed ke saath manually --threads/--delay doge to manual value override karega.

Specific Module Scan 🎯

# Sirf SQLi scan
0xhunter scan https://target.com --confirm --module sqli

# Multiple modules
0xhunter scan https://target.com --confirm --module sqli,xss,cors

# Module + Speed preset
0xhunter scan https://target.com --confirm --module sqli,xss,cors,jwt,headers --speed normal --ai --pdf

Available Modules (26)

Commands

0xhunter --help
0xhunter scan --help
0xhunter version

Basic Scan

# Standard scan — 7 core modules
0xhunter scan https://target.com --confirm

# Full scan — all 61 modules + 2033 payloads
0xhunter scan https://target.com --confirm --full

# Specific modules only
0xhunter scan https://target.com --confirm --module sqli,xss,cors

Speed + Modules (New v2.1.0)

# Google Bug Bounty
0xhunter scan https://www.google.com --confirm \
  --module sqli,xss,cors,jwt,headers \
  --speed normal \
  --ai --pdf \
  --waf-detect --bug-bounty \
  --scope "*.google.com" \
  --compliance owasp \
  --report-dir ./google_reports \
  --verbose

# CTF / Lab (fastest)
0xhunter scan https://testphp.vulnweb.com --confirm \
  --module sqli,xss,cors \
  --speed fast \
  --ai --pdf \
  --report-dir ./reports \
  --verbose

# WAF Protected Target (stealth)
0xhunter scan https://target.com --confirm \
  --module sqli,xss \
  --speed stealth \
  --waf-detect --waf-bypass \
  --report-dir ./reports

Reports

0xhunter scan https://target.com --confirm --pdf --report-dir ./reports
0xhunter scan https://target.com --confirm --report html
0xhunter scan https://target.com --confirm --report json
0xhunter scan https://target.com --confirm --report both

Authentication

0xhunter scan https://target.com --confirm --cookie "session=abc123"
0xhunter scan https://target.com --confirm --token "Bearer eyJhbGci..."
0xhunter scan https://target.com --confirm --auth "admin:password"

AI Features

# Set API key first
export GROQ_API_KEY="gsk_your_key"           # Linux/Mac
$env:GROQ_API_KEY = "gsk_your_key"           # Windows

0xhunter scan https://target.com --confirm --ai
0xhunter scan https://target.com --confirm --ai --lang ur   # Urdu report
0xhunter scan https://target.com --confirm --ai --exploit-gen
0xhunter scan https://target.com --confirm --ai --chain-attacks

WAF

0xhunter scan https://target.com --confirm --waf-detect
0xhunter scan https://target.com --confirm --waf-bypass
0xhunter scan https://target.com --confirm --waf-detect --waf-bypass

Compliance & Bug Bounty

0xhunter scan https://target.com --confirm --compliance owasp
0xhunter scan https://target.com --confirm --compliance pci
0xhunter scan https://target.com --confirm --compliance iso
0xhunter scan https://target.com --confirm --bug-bounty --scope "*.target.com"

Proxy (Burp Suite)

0xhunter scan https://target.com --confirm --proxy http://127.0.0.1:8080

Live Dashboard

0xhunter dashboard
0xhunter dashboard --port 9000
# Open: http://127.0.0.1:8787

Mass Scan / ASN

0xhunter mass-scan --targets-file targets.txt --confirm
0xhunter mass-scan --cidr 192.168.1.0/24 --confirm
0xhunter mass-scan --targets-file targets.txt --asn AS13335 --confirm

Nuclei Templates

0xhunter nuclei --targets-file targets.txt --confirm
0xhunter nuclei --targets-file targets.txt --confirm --severity critical,high

Power Commands

# Ultimate scan — all features
0xhunter scan https://target.com \
  --confirm --full \
  --speed normal \
  --ai --lang en \
  --waf-detect --waf-bypass \
  --compliance owasp \
  --passive-recon \
  --exploit-gen --chain-attacks \
  --oauth --supply-chain \
  --bug-bounty --scope "*.target.com" \
  --pdf --report-dir ./reports \
  --verbose

# Bug Bounty (Google scope)
0xhunter scan https://www.google.com \
  --confirm \
  --module sqli,xss,cors,jwt,headers,ssrf,lfi,cmdi \
  --speed normal \
  --ai --pdf \
  --waf-detect --bug-bounty \
  --scope "*.google.com" \
  --compliance owasp \
  --report-dir ./google_reports \
  --verbose

# Red Team
0xhunter scan https://target.com \
  --confirm --full \
  --speed stealth \
  --exploit-gen --chain-attacks \
  --waf-bypass \
  --proxy http://127.0.0.1:8080 \
  --pdf --report-dir ./reports

All Flags Reference

Features

61 Scan Modules

Payload Count (2033+)

AI Setup

1. Go to console.groq.com/keys
2. Sign up (no credit card required)
3. Create API Key → copy gsk_xxx

# Add to .env file or set directly
GROQ_API_KEY=gsk_your_key_here

Free Tier: 14,400 req/day · 500K tokens/day ✅

Reports

reports/
├── scan_report.pdf       ← PDF report (--pdf)
├── report.html           ← HTML vulnerability report
├── report.json           ← Raw findings (JSON)
├── passive_recon.html    ← Passive recon results
├── attack_chains.html    ← Attack chain analysis
├── burp_export.xml       ← Burp Suite format
├── nl_report_en.txt      ← AI English report
├── nl_report_ur.txt      ← AI Urdu report
└── screenshots/          ← Evidence screenshots
    exploits/
    ├── 01_xss_high.js
    └── 02_sqli_critical.py

Severity Levels

CI/CD

name: OXHUNTER Security Scan
on:
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1'

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - run: pip install oxhunter && playwright install chromium
      - run: |
          0xhunter scan ${{ secrets.TARGET_URL }} \
            --confirm --full \
            --speed normal \
            --report json --output results.json
        env:
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
      - uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: results.json

Troubleshooting

# Update tool
pip install oxhunter --upgrade

# Force reinstall specific version
pip install oxhunter==2.1.0 --force-reinstall

# playwright missing
playwright install chromium

# AI not working
echo $GROQ_API_KEY   # must start with gsk_

# Slow scan
0xhunter scan https://target.com --confirm --speed fast

# flask missing (dashboard)
pip install flask flask-socketio

Legal

✅ Authorized penetration testing
✅ Bug bounty (in-scope only)
✅ Security research + education
✅ CTF challenges

❌ Unauthorized scanning
❌ Malicious use
❌ Illegal activity