$ show Z4nzu/hackingtool
This repository provides an all-in-one CLI/TUI application for launching and managing security testing tools. It features a curated catalog of 215+ tools across 21 categories, defined declaratively in YAML files and loaded into Python tool classes. The interactive REPL supports commands like /run, /search, /tags, /ai, /goal, and /find, with a rich console interface using prompt_toolkit and Rich. A headless engagement mode runs YAML-defined pipelines (e.g., subfinder → httpx → nuclei) and generates structured findings and Markdown reports. AI features are opt-in and use OpenAI-compatible endpoints or local Ollama, with built-in safety guardrails (charter injection, sanitization, anti-fabrication checks) and graceful degradation to offline behavior. The architecture is monolithic but modular, with clear separation between the tool catalog, execution engine, AI integration, and discovery module. The codebase demonstrates strong engineering practices: safe subprocess execution (list-form, cwd, skip if present), declarative YAML overlays, a fixed tag taxonomy enforced by tests, and extensive test coverage including monkeypatching of subprocess and AI transport. While the catalog inherently drifts as upstream tools become archived, the project includes audit scripts to manage this. Overall, it is a well-crafted, production-quality application for authorized security testing.
The LLM identified 3 files worth highlighting for reuse:
Provides HackingTool and HackingToolsCollection base classes that define a declarative pattern for security tools with install/run commands, safe subprocess execution (list-form, cwd, skip if present), and support for archiving. Reusable for any project needing a plugin-like tool registry with safe shell execution.
Implements GitHub repository discovery with a scoring algorithm (log stars, forks, recency, owner boost) and intent-to-tag mapping via Rewrite dataclass. Includes caching, pagination, and YAML persistence. Reusable for any project needing to find and rank GitHub repos by relevance.
Contains AI command generation with safety measures: charter injection, control-character stripping, untrusted data wrapping, and anti-fabrication checks. Degrades gracefully to offline behavior when AI is unavailable. Reusable for any application integrating LLMs with security-sensitive contexts.