WHAXON

One platform. Every layer of security.

WHAXON turns your pentest tools into a pipeline. One catalog, three interfaces (terminal, desktop, web). Three things it does that most tools do not:

• Deterministic auto-chaining. When nmap finds an HTTP port on 127.0.0.1:8090, WHAXON queues nikto against that specific port automatically. Rule-based, no LLM in the loop — just a rule that fires on findings. Turn it off with WHAXON_AUTOCHAIN=false.
• Cross-tool correlation. nmap says port 8090 is open. nikto says /login.php is on 8090. WHAXON emits a web_login_surface finding that says both, because that is what a pentester wants to know. Eight rules today, all deterministic, all testable offline.
• AI with hard guardrails. An optional AI layer proposes the next action. A deterministic executor validates every proposal before anything runs: catalog check, scope check, target lock, dedup guard, stagnation stop. The planner proposes; the executor disposes.

Status

v0.2 — adapter architecture, deterministic automation, cross-tool correlation, optional AI with executor guardrails, three working interfaces.

Working now

Planned

Quick start

git clone https://github.com/andreipath26/WHAXON.git
cd WHAXON
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[tui,gui,web]"

Requires Python 3.11+.

whaxon init                # create data/ with strict default scope
whaxon tui                 # Terminal UI (Textual)
whaxon gui                 # Desktop app (PySide6)
whaxon serve --daemon      # Production web server
whaxon web                 # Web, foreground (dev)

Web UI: http://127.0.0.1:5001/ui

Configuration

Change the auth credentials before exposing WHAXON on any network.

Adapters

Every tool can have an adapter — a Python class that parses its output and enriches findings.

Built-in: nmap, nikto, sqlmap, burp, hashcat, impacket, msf.

Catalog tools without an adapter still run; their output just isn't enriched.

See docs/adapters.md.

Scope

Fail-closed. Missing data/scope.json gets a strict default on first load. Unreadable config raises.

whaxon scope --show
whaxon scope --check <target>
whaxon scope --set scope.json
whaxon scope --enable / --disable
whaxon scope --clear

See docs/scope.md.

Interfaces

• Terminal (whaxon tui): r run, x cancel, g chain, s save report, Ctrl+Q quit.
• Desktop (whaxon gui): native window hosting the web UI in a QWebEngineView.
• Web (whaxon serve --daemon): Flask + SSE. API + browser UI at /ui.
• CLI: 16 subcommands — see docs/interfaces.md.

Reports

whaxon report <job_id>                              # Per-job, Markdown
whaxon report <job_id> --format html                # Per-job, HTML
whaxon report <job_id> --format pdf --out scan.pdf  # Per-job, PDF
whaxon report --engagement default --format md      # Engagement, Markdown
whaxon report --all --format whaxon                 # Engagement, signed .whaxon
curl -u whaxon:whaxon "http://127.0.0.1:5001/api/report?format=md"   # Engagement via HTTP

HTML output is escaped — a raw_line with <script> can't execute in a browser.

Testing

python -m pytest tests/ -q

266 tests passing.

Documentation

docs/ — getting started, architecture, adapters, tools, scope, interfaces, findings, reports, API, deployment, troubleshooting, changelog.

Responsible use

Authorized testing only. Use on systems you own or have explicit permission to assess.

Licensing

AGPL-3.0-or-later. See LICENSE-COMMERCIAL.md and LICENSE-ENTERPRISE.md.