Scanning tools
The installed tool groups, what each tool does, API-key requirements, configuration, and readiness checks.
Hunt Web combines security tools that perform assessment operations with a skill library that guides investigation. The full installer covers 39 tool, browser, and proxy entries.
These components have different responsibilities. A tool retrieves a page, examines an API, analyzes a file, or records a response. A skill explains how to approach a security question, establish a useful comparison, and assess the resulting evidence. Hermes connects follow-up instructions to the selected Run and its saved work.
This page explains the installed tool groups, individual functions, API-key requirements, configuration, and readiness checks. The research categories and how guidance is loaded are explained in the Skill Library.
Counts refer to the package inspected on 14 October 2026. They describe package contents and installer coverage, rather than the number of tools or skills executed during a particular scan.
- 39
- Tool, browser, and proxy entries in the full installer
- 46
- Total manifest records
- 3
- Credentialed lookup integrations
- 2
- Standard API-key settings
1. What Counts as a Tool?
The tool inventory includes vulnerability scanners, discovery utilities, protocol clients, secret detectors, a Browser, and proxy components. Their outputs serve different stages of an assessment: discovery produces leads, protocol clients expose behavior, and testing tools produce observations that may support a vulnerability candidate.
- 1DiscoveryProduces leads: hostnames, services, and routes.
- 2Protocol clientsExpose how an API or service behaves.
- 3Testing toolsProduce observations that may support a vulnerability candidate.
- 4VerificationEvaluates the evidence before a verified finding is saved.
| Inventory | Count | What the number represents |
|---|---|---|
| Executable entries in the tool catalog | 40 | Security tools and supporting browser/proxy commands. |
| Entries covered by the default full installer | 39 | The executable installation set described below. |
| Catalogued entry outside that installation set | 1 | Proxify; installation and live-capture integration are not enabled. |
| Additional catalog records | 6 | One DNSX execution profile, two data libraries, and three runtime dependencies. |
| Total manifest records | 46 | The combined catalog, including executable and supporting records. |
The count follows catalog entries. For example, mitmdump and mitmproxy
are two commands supplied by the same package. Playwright-managed Chromium
is counted as one browser entry. Kiterunner's kr, CVEMap's vulnx, and
TInjA's executable spelling are aliases of their respective entries.
Hunt Web also provides native operations for HTTP requests, Browser actions, evidence handling, verification, and Run control. Those operations belong to the application runtime and are not additional third-party executable entries in this inventory.
Reconnaissance, network discovery, and intelligence
11 tools. Hostnames, reachable web services, certificates, network services, and external intelligence.
Crawling, routes, parameters, and JavaScript
9 tools. Entry points from links, JavaScript, background API requests, and historical URLs.
Web vulnerability testing
6 tools. Focused security checks against application behavior.
API and protocol testing
7 tools. Token analysis, schema inspection, API request generation, and protocol handling.
Secret detection
2 tools. Content that resembles credentials or other sensitive values.
Browser, traffic, and callback support
4 entries. Observation and execution support for JavaScript applications, traffic, and callbacks.
2. Reconnaissance, Network Discovery, and Intelligence: 11 Tools
This group helps establish what exists around an application: hostnames, reachable web services, certificates, network services, and external intelligence. The results help select a useful starting point for testing. A discovered name or a product associated with a CVE still requires further assessment of the actual application.
| Tool | Function | How the result helps an assessment |
|---|---|---|
| Subfinder | Collects subdomain candidates from passive discovery sources. | Supplies hostnames for subsequent resolution and application checks. Coverage depends on the available sources and their configuration. |
| DNSX | Queries DNS records and checks hostname resolution. | Connects a hostname inventory to DNS observations and helps distinguish names that resolve from unconfirmed candidates. |
| AlterX | Generates hostname permutations from known naming patterns. | Suggests additional names for investigation. Generated names need a separate resolution or reachability check. |
| httpx | Probes HTTP services and collects response information such as status, title, and fingerprints. | Helps identify reachable applications and distinguish services sharing a domain or address. |
| TLSX | Examines TLS endpoints and certificate information. | Provides certificate details and hostname clues for understanding the application's service configuration. |
| CDNCheck | Identifies indications of CDN, WAF, or cloud infrastructure associated with a host or address. | Adds infrastructure context when interpreting responses and planning service checks. |
| Naabu | Discovers TCP ports on appropriate assessment targets. | Identifies reachable network entry points that may require service identification. |
| Nmap | Examines network services and available version information. | Adds protocol and service context to known hosts and ports. Applicable operations depend on the permitted assessment scope. |
| Uncover | Queries a configured external asset-search provider. | Retrieves indexed host and service observations that can guide discovery. Provider data may require current confirmation. |
| ASNMap | Retrieves ASN and network information for a domain, address, or ASN query. | Helps investigate network ownership and infrastructure relationships. Requires ProjectDiscovery credentials in Hunt Web's lookup integration. |
| CVEMap / Vulnx | Searches vulnerability intelligence using product or CVE information. | Helps connect an observed technology to relevant published vulnerability records. Requires ProjectDiscovery credentials in the lookup integration. |
These tools answer different questions. Subfinder supplies names; DNSX checks DNS; httpx examines web responses; CVEMap supplies vulnerability intelligence. Combining their results can guide testing, but an external inventory entry or CVE match does not establish a vulnerability in the current application. Discovered assets also remain subject to the Run's domain and Scope policy.
3. Crawling, Routes, Parameters, and JavaScript Discovery: 9 Tools
Modern applications expose functionality through HTML links, JavaScript, background API requests, and routes that may be absent from the initial page. This group helps build a more complete map of those entry points. Historical URLs and inferred parameters are especially useful as leads that can be compared with current application behavior.
| Tool | Function | Typical assessment use |
|---|---|---|
| Katana | Crawls application pages and discovers linked resources and routes, including supported JavaScript-driven exploration. | Builds an application map from reachable content and observed navigation. |
| gau | Collects known URLs from external archive and indexing sources. | Finds historical routes, query strings, and endpoints worth checking against the current application. |
| Waymore | Provides additional discovery of archived or indexed URLs. | Broadens the historical URL inventory. Hunt Web's registered use focuses on URL discovery. |
| ffuf | Tests selected candidate paths or input values and compares HTTP responses. | Investigates route and content discovery hypotheses using response differences. |
| Arjun | Searches for HTTP parameters accepted by an endpoint. | Identifies input names that may be absent from the visible form or documented request. |
| x8 | Performs parameter discovery through HTTP response comparisons. | Supplies additional parameter candidates for a selected endpoint and follow-up validation. |
| Jsluice | Analyzes JavaScript for URL and related application references. | Extracts endpoint clues from scripts without treating every string as a live route. |
| xnLinkFinder | Extracts links and parameter clues from collected content. | Turns saved application material into a more useful route and input inventory. |
| Kiterunner | Performs route discovery using API-oriented candidate paths and wordlists. | Checks a relevant subset of possible API routes against observed application behavior. |
An archived route may have been removed, and a JavaScript string may refer to a disabled feature or another environment. Current requests and responses establish which discoveries are useful for the active assessment. Application host detection and runtime host handling are explained separately in the Dashboard update guide.
4. Web Vulnerability Testing: 6 Tools
This group performs more focused security checks against application behavior. Tool selection depends on the endpoint, technology, input, and hypothesis under investigation. For example, an input that appears to affect a database query calls for a different approach from a value reflected into a page.
| Tool | Function | Evidence or follow-up produced |
|---|---|---|
| Nuclei | Runs selected template-based security checks. | Produces matched observations or candidates that need interpretation in the target's context. |
| PrivateTools | Performs automated web-security checks through the configured scanner integration. | Supplies candidate observations for investigation and verification alongside other evidence. |
| sqlmap | Tests relevant inputs for SQL injection behavior. | Helps compare normal and altered requests to investigate a database-related hypothesis. |
| Dalfox | Investigates inputs and response contexts relevant to cross-site scripting. | Produces reflection and XSS candidates; the required evidence depends on the actual execution context. |
| TInjA | Tests for template-injection behavior. | Helps identify inputs that may be interpreted by a template engine and guides further confirmation. |
| OWASP ZAP | Provides web crawling and security observations through the configured integration. | Adds application observations and alerts from the enabled execution profile. |
A tool alert is an observation, not a finding
A tool alert enters the evidence workflow as an observation or candidate. Hunt Web's verification process evaluates supporting requests, responses, controls, and demonstrated impact before saving a verified finding. The presence of a scanner in the package does not mean every upstream mode or option is automatically used during every Run.
5. API and Protocol Testing: 7 Tools
APIs can expose security-relevant behavior that is difficult to understand from a normal page alone. This group supports token analysis, schema inspection, API request generation, and investigation of protocol handling. The agent still needs an appropriate endpoint and a concrete testing question.
| Tool | Function | Typical assessment use |
|---|---|---|
| jwt_tool | Analyzes JSON Web Tokens and supports investigation of token-handling behavior. | Examines relevant token structure and authentication assumptions using the target's account context. |
| GraphQL Cop | Checks GraphQL behavior and security-relevant configuration. | Investigates features such as introspection, batching, and information exposed by GraphQL responses. |
| Clairvoyance | Infers GraphQL schema information from observable API behavior when direct introspection is restricted. | Helps map fields and types that may support further endpoint investigation. |
| Schemathesis | Uses an API schema to generate structured tests. | Exercises relevant operations and compares behavior with the interface described by the schema. |
| grpcurl | Inspects gRPC interfaces through reflection or available descriptors. | Helps understand services, methods, and message structures supported by a gRPC endpoint. |
| Smuggler | Investigates HTTP request-framing behavior. | Produces observations relevant to request-smuggling hypotheses and front-end/back-end interpretation differences. |
| h2csmuggler | Investigates HTTP/2 cleartext upgrade handling. | Examines upgrade behavior relevant to the configured protocol-testing hypothesis. |
Protocol observations require careful interpretation. A timeout, unusual status, or advertised protocol alone may be insufficient to establish impact. Likewise, discovering a GraphQL schema helps map the API but does not itself prove unauthorized access to its data.
6. Secret Detection: 2 Tools
Secret detection examines collected material for content that resembles credentials or other sensitive values. This can be useful when an assessment has obtained application files, scripts, or other relevant artifacts.
| Tool | Function | How results are used |
|---|---|---|
| TruffleHog | Examines local material for potential secrets using its detectors. | Supplies candidate secret observations for contextual review. Hunt Web's registered local scan disables external credential verification. |
| Gitleaks | Detects likely secrets and credential patterns in local material. | Produces redacted candidate results that can be linked to the relevant artifact and exposure context. |
A secret match is not proof of exposure
A matching pattern may be an example value, an expired credential, or an actual exposed secret. Review must distinguish those cases. A detector match alone does not prove that a credential is usable or that the associated service was accessed successfully.
7. Browser, Traffic, and Callback Support: 4 Entries
These components support observation and execution rather than functioning as four interchangeable vulnerability scanners. They help the runtime work with JavaScript applications, recorded traffic, and asynchronous interactions.
| Component | Function | Role in Hunt Web |
|---|---|---|
| Playwright-managed Chromium | Runs an actual Chromium browser under automation. | Supports JavaScript execution, page observation, and Browser operations that require browser behavior rather than a basic HTTP client. |
| mitmdump | Provides non-interactive proxy and traffic-processing functionality. | Supports the configured capture and request-analysis workflows, including work with recorded traffic. |
| mitmproxy | Supplies the interactive interface from the same proxy package. | Available as a bundled component; the interactive interface is not scheduled as an autonomous scanning task. |
| Interactsh Client | Receives out-of-band interactions associated with generated callback references. | Helps correlate asynchronous behavior with a specific test when ordinary HTTP responses do not expose the effect. |
Connect a callback to its request
An out-of-band interaction must be connected to the relevant request and application behavior before drawing a conclusion. A callback event without that context is insufficient to explain the vulnerability or its impact.
Desktop and Server installations include headless Chromium for supported operations. Interactive Greybox Browser additionally requires a Desktop graphical session. A VPS with Chromium installed therefore has browser support for headless operations without providing the interactive Desktop workflow.
8. Supporting Libraries and Runtime Components
The installer also supplies resources used by the executable tools:
| Resource | Purpose |
|---|---|
| SecLists | Wordlists that support discovery and selected input-testing tasks. |
| PayloadsAllTheThings | Reference material and payload collections for relevant testing techniques. |
| Nuclei templates | Definitions used by selected template-based checks. |
| Go runtime and build support | Supports installation and building of Go-based utilities. |
| Java runtime | Provides the runtime required by Java-based components such as ZAP. |
| libpcap development dependency | Supports packet-capture-related builds, including the Naabu installation path. |
The manifest counts SecLists and PayloadsAllTheThings as data libraries and
Go, Java, and libpcap-dev as runtime dependencies. Its remaining non-executable
record, dnsx-bruteforce, is an execution profile of DNSX. Nuclei templates
are an additional installation asset rather than another executable tool.
Python and Node dependencies also support the application, but they are not
added to the scanning-tool count.
9. API Keys: Three Lookup Integrations, Two Standard Key Settings
Hunt Web's current credentialed lookup path explicitly supports three tool integrations. Two share the same ProjectDiscovery key; the third uses the credentials of its selected asset-search provider.
| Integration | Required configuration | Purpose of the credential |
|---|---|---|
| ASNMap | PDCP_API_KEY | Authorizes ProjectDiscovery network-intelligence lookups. |
| CVEMap / Vulnx | PDCP_API_KEY | Authorizes ProjectDiscovery vulnerability-intelligence lookups. |
| Uncover | Selected provider's credentials; the default Shodan selection uses SHODAN_API_KEY. | Authorizes queries to that external asset-search service. |
For the standard ProjectDiscovery/Shodan setup, the configuration wizard therefore offers two API-key settings. Shodan is the provider queried through Uncover here, rather than a fourth standalone tool in the installer. A ProjectDiscovery key does not replace Shodan credentials.
Uncover also supports other configured providers. Examples of the credential mapping used by Hunt Web include:
| Uncover provider | Configuration names |
|---|---|
| Shodan | SHODAN_API_KEY |
| Censys | CENSYS_API_TOKEN and CENSYS_ORGANIZATION_ID |
| FOFA | FOFA_EMAIL and FOFA_KEY |
| Quake | QUAKE_TOKEN |
| Netlas | NETLAS_API_KEY |
The runtime also recognizes Hunter, ZoomEye, Criminal IP, PublicWWW, Onyphe, and Driftnet provider mappings. These alternatives have their own credential requirements; the standard wizard does not provide a dedicated prompt for every provider.
The count covers the explicit lookup path only
The three-integration count describes this explicit lookup path. Other upstream tools can offer optional external sources or features with additional credentials. Consequently, the count should not be interpreted as a claim that every other upstream feature always works without a key.
Missing lookup credentials affect the corresponding intelligence operation. Other configured functions remain available. An asset-search result or CVE record supplies a lead for assessment and does not automatically become a verified finding or expand the Run's testing Scope.
10. Configure and Interpret Tool-Key Readiness
Run the configuration wizard from the installed application directory:
./configure.sh
At Configure optional ProjectDiscovery/Shodan keys?, select the optional configuration and follow the prompt for each setting:
- 1Run configure.shFrom the installed application directory.
- 2Choose the optional key setupAt Configure optional ProjectDiscovery/Shodan keys?
- 3Enter, n, or r for each keyKeep or skip, enter a new value, or reuse private configuration.
- 4Stored privatelyValidity and quota are checked when the provider is contacted.
- Press Enter to keep the existing value or skip an unconfigured key.
- Select
nto enter a new value through the hidden prompt. - Select
rto reuse compatible private configuration available to the installation's operating-system account.
The installation stores keys in its private configuration. Credentialed lookups obtain the required values through the runtime, so the agent does not need a key pasted into Hermes Chat. Saving a value records configuration; validity, provider permissions, remaining quota, and connectivity are separate conditions evaluated when the provider is contacted.
| Reported condition | Meaning and useful next check |
|---|---|
| Configuration required | The selected integration lacks required credentials. Check the configuration for that provider. |
| Tool unavailable | The executable or installation requirement is missing. Check installation readiness before changing a key. |
| Provider rejects access | The provider may reject the credentials or account entitlement. Inspect the provider response and account configuration. |
| Rate or quota limit | The provider has limited the request. Review the provider's reported limit and retry conditions. |
| Connection failure or timeout | The lookup could not complete over the network. Check connectivity and the reported endpoint rather than assuming the key is invalid. |
Several credential types appear in Hunt Web, each with a distinct purpose:
Model-service credentials
Access to the selected AI model for scanning or conversation.
Scanner-tool API keys
Access to external intelligence providers such as ProjectDiscovery and Shodan.
Target cookies, tokens, or sessions
Authenticated application access for Greybox testing.
Dashboard password and MFA
Access to the Hunt Web workspace itself.
Each credential belongs to its own flow
A working Dashboard login does not establish provider access, and a valid intelligence key does not authenticate a target account. Each credential belongs in its corresponding configuration or account-setup flow.
11. Tool Selection, Profiles, and Health
The installed inventory is a set of available components. A Run selects operations according to the application, evidence, testing mode, account access, Scope policy, and profile budget. A Blackbox assessment starts from publicly accessible behavior. Greybox Environment adds configured account access; Greybox Browser adds the supported interactive Browser workflow. The same tool can be relevant in more than one mode.
Quick, Standard, and Deep share the assessment engine, skill corpus, tool schema, and verification workflow. Their breadth, budgets, and stopping policies differ. Deep does not simply mean “run all 39 tools,” and Quick does not use a separate, smaller installation.
Open Health → Refresh status to inspect component checks and the displayed next steps. Health helps identify installation and service readiness; the outcome of an actual provider request or target login check supplies additional information specific to that operation.
For installation and configuration, see the Desktop installation guide and Server/VPS installation guide.