mirror of
https://github.com/Z4nzu/hackingtool.git
synced 2026-08-18 11:37:38 +08:00
Hardik Zinzuvadiya
2482cc9fd0
Squashed rework of hackingtool from a tool launcher into an AI-guided operator
console for authorized security testing. 93 commits collapsed into this one;
the pre-rework tree is tagged v2.0.0.
CATALOG & ENGINE
- Data-driven YAML catalog (21 categories, 215 live tools + 59 archived) with a
registry/overlay loader and a fixed 66-tag taxonomy (63 in use). Adding a tool
is one YAML entry, not edits across the codebase.
- Engine honesty: real exit codes, truthful install success/failure, reuse-first
skip, EOF-safe prompts, command audit logging.
- Safe installs: sha256-required safe-fetch (killed `curl | bash` in feroxbuster,
Caido and Sliver), list-form subprocess only, no forced sudo.
AI LAYER (bring-your-own-key or local model; degrades offline, never fabricates)
- AI1 intent -> tools; AI2 tool+goal -> command, curated-first with a grounded
fallback; AI3 findings summary and engagement report; AI4 per-finding impact
and remediation. Prompt-injection hardened per OWASP LLM01.
- /goal plans an objective and runs it one step at a time, showing every command
before it runs, with a plan.json + run.log audit trail.
/find TOOL DISCOVERY (this branch's headline feature)
- Suggests real GitHub projects when the catalog has no tool for a need.
Deterministic: zero model calls, structured API fields only, suggest-only —
it never clones, installs or runs anything.
- A charter filter refuses destructive/DoS/jamming/mass-targeting/evasion asks
before any network I/O, while a defensive-intent guard keeps blue-team and
DFIR phrasing ("detect a SYN flood in a pcap") from being false-refused.
- Query rewriting proved to be the dominant quality lever (the first design
measured 29% precision with no results on 5 of 8 needs): a curated 41-row
intent table maps plain English to canonical jargon plus a GitHub topic, and
a two-arm search unions topic coverage with jargon precision.
- Explainable additive ranking: log-flattened stars, license/age/language,
trusted-author bonus derived from owners we already ship, docs-repo demotion
by name, staleness as a soft demotion rather than a filter (a hard cutoff
would delete THC-Hydan and John the Ripper), and a relevance term weighting
curated topics above free-text description.
- Optional no-scope GitHub token purely as a rate-limit lever (10 -> 30 req/min);
it reaches only an Authorization header, never a cache key, log or output.
- `[a]` saves a pick to ~/.hackingtool/found.yaml as a structurally inert entry,
and the loader strips executable keys from user catalogs at read time so a
hand-edited file cannot become a runnable command.
CONSOLE & PACKAGING
- REPL with a / command palette, @ tool mentions, tag filters, history and
completion; background tmux panes; settings and first-run scaffolding.
- src-layout package with catalog and pipelines as package data, console entry
point, Docker image, signed releases with SBOM and build provenance.
- Health docs (SECURITY, CONTRIBUTING, CHANGELOG, CODE_OF_CONDUCT), a CI gate
(ruff + pytest + catalog/taxonomy conformance) and a pre-push hook.
- README rewritten with a section index, the tool catalog split into
docs/TOOLS.md and a step-by-step docs/HOW-TO-USE.md.
278 tests passing; scripts/check.sh green.
57 lines
2.1 KiB
TOML
57 lines
2.1 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "hackingtool"
|
|
dynamic = ["version"] # single-sourced from constants.VERSION
|
|
description = "All-in-one hacking tool launcher for security researchers and pentesters"
|
|
readme = "README.md"
|
|
requires-python = ">=3.10" # floor: code uses 3.10 union syntax; no upper cap so newer Pythons work
|
|
license = { text = "MIT" }
|
|
authors = [{ name = "Z4nzu" }]
|
|
keywords = ["security", "pentesting", "hacking", "recon", "osint", "cli"]
|
|
dependencies = ["rich>=13.0.0", "pyyaml>=6.0", "platformdirs>=4.0", "prompt_toolkit>=3.0.0", "python-dotenv>=1.0.0"]
|
|
|
|
classifiers = [
|
|
"Development Status :: 4 - Beta",
|
|
"Environment :: Console",
|
|
"Intended Audience :: Information Technology",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Operating System :: POSIX :: Linux",
|
|
"Operating System :: MacOS :: MacOS X",
|
|
"Operating System :: Microsoft :: Windows",
|
|
"Programming Language :: Python :: 3 :: Only",
|
|
"Programming Language :: Python :: 3.10",
|
|
"Programming Language :: Python :: 3.11",
|
|
"Programming Language :: Python :: 3.12",
|
|
"Programming Language :: Python :: 3.13",
|
|
"Programming Language :: Python :: 3.14",
|
|
"Topic :: Security",
|
|
]
|
|
|
|
[project.urls]
|
|
Homepage = "https://github.com/Z4nzu/hackingtool"
|
|
Repository = "https://github.com/Z4nzu/hackingtool"
|
|
Issues = "https://github.com/Z4nzu/hackingtool/issues"
|
|
|
|
[project.scripts]
|
|
hackingtool = "hackingtool.cli:main"
|
|
|
|
# Dev tooling for local checks + CI (single source: `scripts/check.sh`).
|
|
# `uv run --group dev <tool>` auto-installs these into the project env.
|
|
[dependency-groups]
|
|
dev = ["pytest>=8", "ruff>=0.6"]
|
|
|
|
# src-layout: the whole app lives in src/hackingtool/ (PyPA-standard). The YAML
|
|
# catalog + pipelines ship as package data so `catalog/*.yaml` is available at
|
|
# runtime from an installed wheel (registry.py resolves them via __file__).
|
|
[tool.setuptools.packages.find]
|
|
where = ["src"]
|
|
|
|
[tool.setuptools.package-data]
|
|
hackingtool = ["catalog/*.yaml", "pipelines/*.yaml", "skill/*.md"]
|
|
|
|
[tool.setuptools.dynamic]
|
|
version = { attr = "hackingtool.constants.VERSION" }
|