{"id":15108552,"url":"https://github.com/z4nzu/hackingtool","last_synced_at":"2026-10-20T10:08:36.239Z","repository":{"id":37240640,"uuid":"254832799","full_name":"Z4nzu/hackingtool","owner":"Z4nzu","description":"ALL IN ONE Hacking Tool For Hackers","archived":false,"fork":false,"pushed_at":"2026-08-23T16:54:04.000Z","size":6457,"stargazers_count":79837,"open_issues_count":134,"forks_count":9060,"subscribers_count":1484,"default_branch":"master","last_synced_at":"2026-09-29T12:52:29.405Z","etag":null,"topics":["allinonehackingtool","besthackingtool","ctf-tools","ddos-attack-tool","hacker","hacking","linux","password-attack","steganography","web-attack","wireless-attack","xss-attacks","xss-detection"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Z4nzu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-11T09:21:31.000Z","updated_at":"2026-09-29T12:48:30.000Z","dependencies_parsed_at":"2023-10-15T13:22:45.683Z","dependency_job_id":"a141131f-3e8b-46a6-990f-f438987e7902","html_url":"https://github.com/Z4nzu/hackingtool","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/Z4nzu/hackingtool","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Z4nzu%2Fhackingtool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Z4nzu%2Fhackingtool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Z4nzu%2Fhackingtool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Z4nzu%2Fhackingtool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Z4nzu","download_url":"https://codeload.github.com/Z4nzu/hackingtool/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Z4nzu%2Fhackingtool/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38395651,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-20T02:00:06.669Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["allinonehackingtool","besthackingtool","ctf-tools","ddos-attack-tool","hacker","hacking","linux","password-attack","steganography","web-attack","wireless-attack","xss-attacks","xss-detection"],"created_at":"2024-09-25T22:03:43.445Z","updated_at":"2026-10-20T10:08:36.221Z","avatar_url":"https://github.com/Z4nzu.png","language":"Python","funding_links":["https://github.com/sponsors/Z4nzu","https://buymeacoffee.com/hardikzinzu"],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"images/logo.svg\" alt=\"HackingTool\" width=\"600\"\u003e\n\n### AI-guided, all-in-one toolkit for authorized security testing\n\n**219 curated tools across 21 categories** — recon, OSINT, web, wireless, phishing,\nforensics, post-exploitation and more — with an **AI layer that turns plain English\ninto the right tool and the exact command**.\n\n**Built for** penetration testers · red teamers · blue-team/SOC and DFIR analysts ·\nOSINT researchers · bug-bounty hunters · CTF players · security researchers and\nstudents — all working **legally, on systems they own or are authorised to test**.\n\n\u003cdiv align=\"center\"\u003e\n  \u003csub\u003eSponsored by\u003c/sub\u003e\u003cbr\u003e\n  \u003ca href=\"https://webvetted.com/hacking-tools?utm_source=github\u0026utm_medium=sponsor\u0026utm_campaign=hacking-tools\"\u003e\n    \u003cimg width=\"800\" alt=\"WebVetted Intelligence - OSINT \u0026 Recon Platform\" src=\"https://github.com/user-attachments/assets/75b9480e-52ce-4096-bee9-69a26d7823a1\" /\u003e\n  \u003c/a\u003e\n  \u003cbr\u003e\u003cbr\u003e\n  \u003ci\u003e\u003cb\u003eGo beyond manual recon.\u003c/b\u003e WebVetted turns an email, phone or username into a complete identity investigation with deep OSINT enrichment, breach intel, AI analysis, and an interactive identity graph.\u003c/i\u003e\u003cbr\u003e\n  \u003cbr\u003e\n  \u003ca href=\"https://webvetted.com/hacking-tools?utm_source=github\u0026utm_medium=sponsor\u0026utm_campaign=hacking-tools\"\u003e\u003cb\u003eStart an Investigation →\u003c/b\u003e\u003c/a\u003e\n\u003c/div\u003e\n\n\u003cbr/\u003e\u003cbr/\u003e\n\n\n\u003ca href=\"https://trendshift.io/repositories/869\" target=\"_blank\" rel=\"noopener noreferrer\"\u003e\u003cimg src=\"https://trendshift.io/api/badge/repositories/869\" alt=\"Z4nzu/hackingtool | Trendshift\" width=\"250\" height=\"55\"/\u003e\u003c/a\u003e \u003ca href=\"https://trendshift.io/repositories/869\" target=\"_blank\" rel=\"noopener noreferrer\"\u003e\u003cimg src=\"https://trendshift.io/api/badge/trendshift/repositories/869/daily?language=Python\" alt=\"Z4nzu/hackingtool | Trendshift daily\" width=\"250\" height=\"55\"/\u003e\u003c/a\u003e \u003ca href=\"https://trendshift.io/repositories/869\" target=\"_blank\" rel=\"noopener noreferrer\"\u003e\u003cimg src=\"https://trendshift.io/api/badge/trendshift/repositories/869/weekly\" alt=\"Z4nzu/hackingtool | Trendshift weekly\" width=\"250\" height=\"55\"/\u003e\u003c/a\u003e\n\n\u003cbr/\u003e\n\n[![License](https://img.shields.io/github/license/Z4nzu/hackingtool?style=flat-square\u0026labelColor=0D1117\u0026color=7B61FF)](LICENSE) [![Python](https://img.shields.io/badge/Python-3.10+-0D1117?style=flat-square\u0026labelColor=0D1117\u0026logo=python\u0026logoColor=7B61FF)](https://www.python.org/) [![Stars](https://img.shields.io/github/stars/Z4nzu/hackingtool?style=flat-square\u0026labelColor=0D1117\u0026color=7B61FF)](https://github.com/Z4nzu/hackingtool/stargazers) [![Forks](https://img.shields.io/github/forks/Z4nzu/hackingtool?style=flat-square\u0026labelColor=0D1117\u0026color=7B61FF)](https://github.com/Z4nzu/hackingtool/network/members) [![Issues](https://img.shields.io/github/issues/Z4nzu/hackingtool?style=flat-square\u0026labelColor=0D1117\u0026color=7B61FF)](https://github.com/Z4nzu/hackingtool/issues) [![Last Commit](https://img.shields.io/github/last-commit/Z4nzu/hackingtool?style=flat-square\u0026labelColor=0D1117\u0026color=7B61FF)](https://github.com/Z4nzu/hackingtool/commits/master) [![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-DB61A2?style=flat-square\u0026labelColor=0D1117\u0026logo=githubsponsors\u0026logoColor=DB61A2)](#support--sponsor)\n\n\u003cbr/\u003e\n\n![](https://img.shields.io/badge/21_Categories-7B61FF?style=for-the-badge\u0026labelColor=0D1117) \u0026nbsp;![](https://img.shields.io/badge/219_Tools-7B61FF?style=for-the-badge\u0026labelColor=0D1117) \u0026nbsp;![](https://img.shields.io/badge/63_Tags-7B61FF?style=for-the-badge\u0026labelColor=0D1117) \u0026nbsp;![](https://img.shields.io/badge/AI--Guided-7B61FF?style=for-the-badge\u0026labelColor=0D1117\u0026logo=openai\u0026logoColor=white) \u0026nbsp;![](https://img.shields.io/badge/Linux_%7C_Kali_%7C_Parrot_%7C_macOS-7B61FF?style=for-the-badge\u0026labelColor=0D1117\u0026logo=linux\u0026logoColor=white)\n\n\u003cbr/\u003e\n\n\u003ca href=\"#installation\"\u003e\u003cimg src=\"https://img.shields.io/badge/Install_Now-7B61FF?style=for-the-badge\u0026logo=rocket\u0026logoColor=white\" alt=\"Install Now\"\u003e\u003c/a\u003e\u0026nbsp; \u003ca href=\"docs/HOW-TO-USE.md\"\u003e\u003cimg src=\"https://img.shields.io/badge/How_to_Use-30363D?style=for-the-badge\u0026logo=gnometerminal\u0026logoColor=white\" alt=\"How to Use\"\u003e\u003c/a\u003e\u0026nbsp; \u003ca href=\"docs/TOOLS.md\"\u003e\u003cimg src=\"https://img.shields.io/badge/Tool_Catalog-30363D?style=for-the-badge\u0026logo=github\u0026logoColor=white\" alt=\"Tool Catalog\"\u003e\u003c/a\u003e\u0026nbsp; \u003ca href=\"#support--sponsor\"\u003e\u003cimg src=\"https://img.shields.io/badge/%E2%9D%A4_Sponsor-DB61A2?style=for-the-badge\u0026logo=githubsponsors\u0026logoColor=white\" alt=\"Sponsor\"\u003e\u003c/a\u003e\n\n\u003c/div\u003e\n\n---\n\n## Contents\n\n- [Why hackingtool](#why-hackingtool)\n- [Tool Categories](#tool-categories)\n- [Installation](#installation)\n  - [From source with pipx (recommended)](#from-source-with-pipx-recommended)\n  - [For development](#for-development)\n  - [Docker](#docker)\n  - [Optional runtimes](#optional-runtimes)\n- [Quick Commands](#quick-commands)\n  - [Command reference](#command-reference)\n- [Features](#features)\n  - [🔎 `/find` — a tool for a need you don't have yet](#-find--a-tool-for-a-need-you-dont-have-yet)\n  - [🎯 `/goal` — plan an objective, run it one step at a time](#-goal--plan-an-objective-run-it-one-step-at-a-time)\n  - [🧠 Recommendations — say what you want in plain English](#-recommendations--say-what-you-want-in-plain-english)\n  - [🏷 Tags and search](#-tags-and-search)\n  - [▶ Background panes (tmux)](#-background-panes-tmux)\n  - [⚙ Settings and the AI layer](#-settings-and-the-ai-layer)\n  - [📋 Headless engagements](#-headless-engagements)\n- [Documentation](#documentation)\n- [Contributing](#contributing)\n- [Support \u0026 Sponsor](#support--sponsor)\n- [Social](#social)\n\n---\n\n## Why hackingtool\n\n- **🧠 AI-guided workflow** — describe what you want (\"find subdomains of example.com\")\n  and it maps your intent to the right tools, hands you the exact documented command,\n  plans an objective step by step, then summarizes findings and drafts an engagement\n  report. Bring your own key or run a local model — nothing auto-executes and nothing\n  is fabricated.\n- **🗂 219 curated tools, one interactive console** — type to search every tool, then\n  install and run across 21 categories without hunting down Git repos; a fixed tag\n  taxonomy (63 tags in use) makes every tool discoverable.\n- **🔎 It knows what it doesn't have** — `/find` searches your catalog first, then the\n  GitHub API, and shows real maintained projects with the reason each was ranked.\n- **🛡 Safe by default** — standard installs, **no `curl | bash`**, downloads pinned +\n  SHA-256 verified, list-form `subprocess`, no forced `sudo`, and\n  [signed releases with an SBOM](SECURITY.md#verifying-a-release).\n- **🎯 For the whole spectrum** — red team, blue team, OSINT, bug bounty, CTF/THM,\n  forensics/IR — all on **authorized targets only**.\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"images/screenshots/1.png\" alt=\"hackingtool interactive TUI: categories with live tool counts, type to search all tools, / opens the command palette\" width=\"900\"\u003e\n\u003cbr/\u003e\n\u003csub\u003eThe interactive console on launch — browse categories, type to search every tool, and \u003ccode\u003e/\u003c/code\u003e opens the command palette.\u003c/sub\u003e\n\u003c/div\u003e\n\n---\n\n## Tool Categories\n\n**219 tools across 21 categories** — the full list, with links and tags, is in\n**[docs/TOOLS.md](docs/TOOLS.md)**.\n\n\u003cdiv align=\"center\"\u003e\n\n| # | Category | Tools | | # | Category | Tools |\n|:---:|---|:---:|---|:---:|---|:---:|\n| 1 | 🛡 [Anonymously Hiding Tools](docs/TOOLS.md#-anonymously-hiding-tools) | 5 | | 12 | 🔁 [Reverse engineering tools](docs/TOOLS.md#-reverse-engineering-tools) | 10 |\n| 2 | 🔍 [Information gathering tools](docs/TOOLS.md#-information-gathering-tools) | 26 | | 13 | ⚡ [DDOS Attack Tools](docs/TOOLS.md#-ddos-attack-tools) | 7 |\n| 3 | 📚 [Wordlist Generator](docs/TOOLS.md#-wordlist-generator) | 8 | | 14 | 🖥 [Remote Administrator Tools (RAT)](docs/TOOLS.md#-remote-administrator-tools-rat) | 4 |\n| 4 | 📡 [Wireless attack tools](docs/TOOLS.md#-wireless-attack-tools) | 17 | | 15 | 🧪 [XSS Attack Tools](docs/TOOLS.md#-xss-attack-tools) | 6 |\n| 5 | 💉 [SQL Injection Tools](docs/TOOLS.md#-sql-injection-tools) | 7 | | 16 | 🖼 [Steganography Tools](docs/TOOLS.md#-steganography-tools) | 10 |\n| 6 | 🎣 [Phishing attack tools](docs/TOOLS.md#-phishing-attack-tools) | 13 | | 17 | 🏢 [Active Directory Tools](docs/TOOLS.md#-active-directory-tools) | 10 |\n| 7 | 🌐 [Web Attack tools](docs/TOOLS.md#-web-attack-tools) | 23 | | 18 | ☁ [Cloud Security Tools](docs/TOOLS.md#-cloud-security-tools) | 7 |\n| 8 | 🔧 [Post exploitation tools](docs/TOOLS.md#-post-exploitation-tools) | 15 | | 19 | 📱 [Mobile Security Tools](docs/TOOLS.md#-mobile-security-tools) | 6 |\n| 9 | 🕵 [Forensic tools](docs/TOOLS.md#-forensic-tools) | 12 | | 20 | ✨ [Other tools](docs/TOOLS.md#-other-tools) | 10 |\n| 10 | 📦 [Payload creation tools](docs/TOOLS.md#-payload-creation-tools) | 6 | | 21 | 🔑 [Password / Hash Cracking](docs/TOOLS.md#-password--hash-cracking) | 7 |\n| 11 | 🧰 [Exploit framework](docs/TOOLS.md#-exploit-framework) | 6 | | | | |\n\n\u003c/div\u003e\n\n\u003csub\u003e44 further entries are archived (unmaintained or dead upstream) and hidden unless\nyou set `show_archived true` via `/config`. The in-app header counts 22 categories /\n219 tools because it also counts the built-in Update / Uninstall menu.\u003c/sub\u003e\n\n---\n\n## Installation\n\nRequires **Python 3.10+** on **Linux or macOS** (Kali, Parrot, Debian/Ubuntu, Arch,\n…). Windows is not supported — the app tells you so and exits. No `curl | bash`:\nevery path below is a standard, verifiable install.\n\n### From source with pipx (recommended)\n\n[pipx](https://pipx.pypa.io) installs hackingtool into its own isolated environment\nand puts the `hackingtool` command on your PATH, so you can launch it from any\ndirectory.\n\n```bash\n# 1 — get the code\ngit clone https://github.com/Z4nzu/hackingtool.git\ncd hackingtool\n\n# 2 — install it onto your PATH (isolated venv, no system Python touched)\npipx install .\n\n# 3 — run it from anywhere\nhackingtool\n```\n\nNo pipx yet?\n\n```bash\n# macOS\nbrew install pipx \u0026\u0026 pipx ensurepath\n\n# Debian / Ubuntu / Kali\nsudo apt install pipx \u0026\u0026 pipx ensurepath\n```\n\nOpen a new shell after `pipx ensurepath` so the PATH change takes effect.\nTo update later: `git pull \u0026\u0026 pipx install . --force`. To remove it:\n`pipx uninstall hackingtool`.\n\n\u003cdetails\u003e\n\u003csummary\u003eAlternative: \u003ccode\u003euv tool install .\u003c/code\u003e (same result, uses uv instead of pipx)\u003c/summary\u003e\n\n```bash\ngit clone https://github.com/Z4nzu/hackingtool.git\ncd hackingtool\nuv tool install .        # installs the `hackingtool` executable on your PATH\nhackingtool\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eAlternative: plain venv + pip (no PATH changes)\u003c/summary\u003e\n\n```bash\ngit clone https://github.com/Z4nzu/hackingtool.git\ncd hackingtool\npython3 -m venv .venv \u0026\u0026 . .venv/bin/activate\npip install .            # or: pip install -e .   for an editable dev install\nhackingtool\n```\n\nThe command is only on your PATH while that venv is activated.\n\u003c/details\u003e\n\n### For development\n\n[uv](https://docs.astral.sh/uv/) creates the virtualenv and installs everything from\n`pyproject.toml` / `uv.lock` in one step:\n\n```bash\ngit clone https://github.com/Z4nzu/hackingtool.git\ncd hackingtool\nuv sync\nuv run hackingtool\n```\n\nNo uv yet? `pipx install uv` (or see the\n[uv install docs](https://docs.astral.sh/uv/getting-started/installation/)).\n\n**Contributing?** `make setup` wires the pre-push hook and `make check` runs the full\ngate (lint + tests + catalog validation). See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n### Docker\n\nPull and run the published image:\n\n```bash\ndocker run -it --rm hardikzinzu/hackingtool:latest\n```\n\nOr build it locally from a checkout:\n\n```bash\ngit clone https://github.com/Z4nzu/hackingtool.git \u0026\u0026 cd hackingtool\ndocker build -t hackingtool .\ndocker run -it --rm hackingtool\n```\n\n\u003c!-- Hidden until these distribution channels are live. Restore when the package\n     is published to PyPI and the .deb is attached to a release.\n\n### pipx / pip from PyPI\n\n```bash\npipx install hackingtool\nhackingtool\n```\n\n```bash\npython3 -m venv .venv \u0026\u0026 . .venv/bin/activate\npip install hackingtool\nhackingtool\n```\n\n### Debian / Ubuntu / Kali (.deb)\n\nGrab the `.deb` from the [latest release](https://github.com/Z4nzu/hackingtool/releases/latest):\n\n```bash\nsudo apt install ./hackingtool_*.deb\nhackingtool\n```\n--\u003e\n\n### Optional runtimes\n\nSome individual tools need a language runtime to install/run; the core app doesn't.\n\n| Dependency | Version | Needed for |\n|---|---|---|\n| Go | 1.21+ | nuclei, ffuf, amass, httpx, katana, dalfox, gobuster, subfinder |\n| Ruby | any | haiti, evil-winrm |\n| tmux | any | background panes (`/run … \u0026`, `/panes`, `/attach`) |\n| Docker | any | Mythic, MobSF (optional) |\n\n---\n\n## Quick Commands\n\n`hackingtool` opens an **interactive terminal UI**: browse the categories, **type to\nsearch every tool** across all of them, `↑↓` to move, `Enter` to open, `←`/`Esc` to go\nback, and `/` for the command palette (`/config`, `/update`, `/menu`, `/quit`). When a\nnewer release is out it shows an *update available* line on launch, and `/update`\ndetects how you installed hackingtool and shows the exact upgrade command to run.\n\nFor a keyboard-driven REPL instead, `hackingtool --classic` takes three kinds of input:\n\n| You type | It means | Example |\n|---|---|---|\n| `/…` | a command you run | `/search subdomain` |\n| `@…` | a thing you name | `@nmap`, `@tag:osint` |\n| anything else | plain English \"what I want to do\" | `crack a wifi handshake` |\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"images/screenshots/4.png\" alt=\"typing @ in the hackingtool console completes tool names\" width=\"900\"\u003e\n\u003cbr/\u003e\n\u003csub\u003e\u003ccode\u003e@\u003c/code\u003e completes tool names — \u003ccode\u003e@tag:\u003c/code\u003e completes tags, \u003ccode\u003e/\u003c/code\u003e completes commands.\u003c/sub\u003e\n\u003c/div\u003e\n\n### Command reference\n\n| Command | Aliases | What it does |\n|---|---|---|\n| `/run \u003ctool\u003e [args] [\u0026]` | `/open` | open a tool's menu; with a trailing `\u0026` it runs in a background tmux pane instead (that's where `args` are used) |\n| `/search \u003ckeyword\u003e` | | search tools by name, description or tag |\n| `/tags` | | list every tag with its tool count |\n| `/ai \u003cgoal\u003e` | `/recommend`, `/r` | recommend tools for a goal |\n| `/goal \u003cobjective\u003e` | | AI-plan an objective and run it step by step, with per-step confirmation |\n| `/find \u003cneed\u003e` | `/discover` | find tools for a need — your catalog first, then GitHub (suggest-only) |\n| `/panes` | `/jobs` | list background panes |\n| `/attach` | | attach to the background session (`Ctrl-b` `d` to return) |\n| `/kill \u003clabel\\|all\u003e` | | kill one background pane, or all of them |\n| `/config [key value]` | | view/change settings; `/config test` checks the AI connection, `/config github` checks the GitHub token |\n| `/skill` | | show the operator playbook |\n| `/update` · `/uninstall` | `/remove` | update system packages or hackingtool · remove hackingtool and its tools |\n| `/clear` | `/cls` | clear the screen |\n| `/back` | `/b` | leave the current tool and go back |\n| `/help` | `/?`, `/h` | quick reference card |\n| `/quit` | `/q`, `/exit` | exit (also `q`, `Ctrl-C`, `Ctrl-D`) |\n| `@\u003ctool\u003e` | | open a tool (case-insensitive, fuzzy fallback) |\n| `@tag:\u003ctag\u003e` | | list and pick from the tools carrying that tag |\n\nInside a category: `1–N` pick a tool · `97` install everything not yet installed ·\n`98` archived tools · `99` back.\nInside a tool: `1` install · `2` run · `c` ask for the exact command for your goal ·\n`98` project page · `99` back.\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"images/screenshots/5.png\" alt=\"hackingtool /help quick reference card\" width=\"900\"\u003e\n\u003cbr/\u003e\n\u003csub\u003e\u003ccode\u003e/help\u003c/code\u003e — the same card, in the app.\u003c/sub\u003e\n\u003c/div\u003e\n\nThe command set above is the `--classic` REPL. On a non-interactive terminal hackingtool\nfalls back to the classic numbered menu, where `/` or `s` searches, `t` filters by tag,\n`r` or `a` recommends, `?` helps and `q` quits.\n\n\u003e **New here?** [docs/HOW-TO-USE.md](docs/HOW-TO-USE.md) walks through each of these\n\u003e start to finish with numbered steps.\n\n---\n\n## Features\n\n\u003e **Where these live today.** `/find`, `/goal`, plain-English recommendations,\n\u003e `/tags`/`/search` and background panes currently run in the **`--classic`** REPL\n\u003e (`hackingtool --classic`). The default TUI browses and type-searches the whole\n\u003e catalog and runs tools; wiring these AI/search features into it is Phase 2. The\n\u003e screenshots below showing a `/` command prompt are the `--classic` REPL.\n\n### 🔎 `/find` — a tool for a need you don't have yet\n\nSearches the 219 curated tools first, then the GitHub search API, and ranks the\nresults explainably. **Suggest-only** — it never clones, installs or runs anything —\nand it makes **zero model calls**.\n\n```\n/find crack a wpa handshake\n\nIn your toolbox (vetted)\n  • aircrack-ng (WiFi security suite)\n  • Kismet (wireless detector / WIDS)\n  • Reaver (WPS PIN attack)\n  • WiGLE (wardriving map \u0026 API)\n  • hashcat example hashes (WPA mode 22000)\n\nFound on GitHub — NOT vetted by us\n\n  wifiphisher/wifiphisher  14713★  GPL-3.0\n    The Rogue Access Point Framework\n    14713★ · trusted author (ships in our catalog) · active · matches: security, wifi\n    git clone https://github.com/wifiphisher/wifiphisher\n  …\n```\n\nPress `a` to keep a result: it is saved to `~/.hackingtool/found.yaml` as a\n\"Discovered tools\" entry — title, tags, description, link, and **no install or run\ncommand**, so a discovered entry can never execute anything. It shows up in your menu\nand in `/search` next launch.\n\nOut-of-scope asks (jamming, DoS, mass-targeting, malware) are refused **before any\nnetwork call**, with an authorized alternative where one exists. Defensive/DFIR\nphrasing is never refused.\n\nWorks anonymously at 10 GitHub searches/minute; a **no-scope, no-permission** token\nraises that to 30 — see\n[`/config github`](docs/HOW-TO-USE.md#7-add-a-github-token-for-find-config-github).\n\n### 🎯 `/goal` — plan an objective, run it one step at a time\n\n```\n/goal find live subdomains of example.com\n```\n\nhackingtool drafts a short plan of real commands (with the reason for each step and\nan install hint for tools you don't have), asks you to confirm you are **authorized**\nto test the target, then walks the steps: `[y]` run · `[s]` skip · `[e]` edit ·\n`[q]` abort. Every step runs list-form — never through a shell — and each goal gets a\ntimestamped workspace under `~/.hackingtool/goals/` holding `plan.json`, a\nUTC-stamped `run.log`, and the raw output of each step.\n\nThe model is called **once**, for planning; tool output is never fed back to it. With\nno model configured, `/goal` degrades to tool recommendations for the same objective.\n\n### 🧠 Recommendations — say what you want in plain English\n\nBare text (or `/ai`) maps intent to tools. The model may only return tags from the\nfixed taxonomy, and the catalog resolves tags → tools, so a tool can never be\ninvented; with no model reachable a stdlib keyword matcher answers instead.\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"images/screenshots/3.png\" alt=\"hackingtool /ai — pick a common task or describe your own\" width=\"900\"\u003e\n\u003cbr/\u003e\n\u003csub\u003e\u003ccode\u003e/ai\u003c/code\u003e — pick one of the common tasks, or type the job in your own words.\u003c/sub\u003e\n\u003c/div\u003e\n\n### 🏷 Tags and search\n\n`/tags` prints every tag in use with its live tool count; `@tag:\u003cname\u003e` opens the\ntools carrying it; `/search \u003ckeyword\u003e` matches names, descriptions and tags.\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"images/screenshots/2.png\" alt=\"hackingtool /tags — every tag with its tool count\" width=\"900\"\u003e\n\u003cbr/\u003e\n\u003csub\u003e\u003ccode\u003e/tags\u003c/code\u003e — 63 tags in use, with the number of tools behind each.\u003c/sub\u003e\n\u003c/div\u003e\n\n### ▶ Background panes (tmux)\n\nLong scans shouldn't block your console. With tmux installed, `/run \u003ctool\u003e … \u0026` opens\na labeled window in one detached `hackingtool` session:\n\n```\n/run nmap -sV -oA scan 10.0.0.5 \u0026\n▶ started 'nmap' in background — /attach to view\n```\n\n`/panes` lists them, `/attach` watches one (`Ctrl-b` `d` to come back), `/kill \u003clabel\u003e`\nor `/kill all` stops them, and the status line under the prompt shows `▶ N running`.\nNo tmux? It says so and opens the tool inline instead; disable it entirely with\n`/config background_runner off`.\n\n### ⚙ Settings and the AI layer\n\n`/config` opens a searchable settings screen — type to filter, `↑↓` move, `Enter` cycles\na choice or edits a value (auto-saved), `←`/`Esc` back; in `--classic` it's a full-screen\neditor with `t` to test the AI connection. `/config \u003ckey\u003e \u003cvalue\u003e` sets one key directly.\nSettings live in `~/.hackingtool/config.json`.\n\nThe AI layer is **opt-in and bring-your-own-key**: an OpenAI-compatible endpoint when\n`ai_base_url` + an API key are set, else a local [Ollama](https://ollama.com), else\nnothing — every feature degrades to a deterministic offline behaviour instead of\nguessing. Your API key is written only to `~/.hackingtool/.env` (mode 600), never to\n`config.json`, and never printed back. `/config test` reports the real failure if a\nprobe fails.\n\n### 📋 Headless engagements\n\nThe same catalog drives a non-interactive orchestrator that normalizes tool output\ninto one `findings.json`:\n\n```bash\nhackingtool --engagement acme --targets example.com --pipeline recon\nhackingtool --engagement acme --report          # deterministic Markdown report\nhackingtool --engagement acme --ai-summary      # opt-in triage of the REAL findings\nhackingtool --engagement acme --ai-report       # opt-in narrative draft (report.draft.md)\n```\n\nOut-of-scope targets are flagged and logged before anything runs, and the AI passes\nonly ever summarize findings that exist.\n\n---\n\n## Documentation\n\n| Document | What's in it |\n|---|---|\n| [How to use hackingtool](docs/HOW-TO-USE.md) | numbered walkthroughs: first run, `/find`, `/goal`, `/config`, background panes, headless mode |\n| [Tool catalog](docs/TOOLS.md) | every tool, by category, with links and tags |\n| [Operator playbook](src/hackingtool/skill/OPERATOR.md) | the charter and grounding rules the AI layer runs under (also `/skill`) |\n| [SECURITY.md](SECURITY.md) | disclosure policy, release verification, threat model |\n| [CONTRIBUTING.md](CONTRIBUTING.md) | catalog-first tool additions, the gate your PR must pass |\n\n---\n\n## Contributing\n\nNew tools, fixes, and docs are all welcome — for **authorized security testing** only.\n\n\u003e **The easy path:** most tools are just **one YAML entry** in\n\u003e `src/hackingtool/catalog/` — no Python needed. Tags come from a fixed taxonomy, so\n\u003e your tool is instantly discoverable and searchable.\n\n| I want to… | Do this |\n|---|---|\n| 💡 Suggest a tool | Open a [Tool Request](.github/ISSUE_TEMPLATE/tool_request.md) issue |\n| ➕ Add a tool | Add a catalog entry (or a class for custom install/run logic), then open a PR with the [template](.github/PULL_REQUEST_TEMPLATE.md) |\n| 🐛 Report a bug | Open a [Bug report](.github/ISSUE_TEMPLATE/bug_report.md) issue |\n| 🔒 Report a vulnerability | **Privately** — do not open a public issue; see [SECURITY.md](SECURITY.md) |\n\nBefore opening a PR, run **`make check`** (lint + tests + catalog validation) and use\nthe title format `[New Tool] Name — Category`. The full guide — security rules and the\none-entry catalog walkthrough — is in **[CONTRIBUTING.md](CONTRIBUTING.md)**.\n\n\u003csub\u003e📄 [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md)\u003c/sub\u003e\n\n---\n\n\u003c!-- Star History — enabled later.\n     GitHub now restricts anonymous star-history data, so a live chart can't render.\n     To enable: open https://star-history.com/#Z4nzu/hackingtool\u0026Date (sign in with a\n     GitHub token — it's your repo), download the chart image, save it as\n     images/star-history.png, and uncomment the block below.\n\n## Star History\n\n\u003cdiv align=\"center\"\u003e\n\u003ca href=\"https://star-history.com/#Z4nzu/hackingtool\u0026Date\"\u003e\u003cimg src=\"images/star-history.png\" alt=\"HackingTool Star History Chart\" width=\"640\"\u003e\u003c/a\u003e\n\u003c/div\u003e\n\n---\n--\u003e\n\n## Support \u0026 Sponsor\n\nhackingtool is free and open-source. If it saves you time on an engagement or helps\nyou learn, please consider sponsoring — funding goes to tool curation, the AI layer,\nand keeping installs safe and current.\n\n\u003ca href=\"https://github.com/sponsors/Z4nzu\"\u003e\u003cimg src=\"https://img.shields.io/badge/GitHub_Sponsors-EA4AAA?style=for-the-badge\u0026logo=githubsponsors\u0026logoColor=white\" alt=\"Sponsor on GitHub\"\u003e\u003c/a\u003e\u0026nbsp; \u003ca href=\"https://buymeacoffee.com/hardikzinzu\" target=\"_blank\"\u003e\u003cimg src=\"https://img.shields.io/badge/Buy_Me_A_Coffee-1F2328?style=for-the-badge\u0026logo=buymeacoffee\u0026logoColor=FFDD00\" alt=\"Buy Me A Coffee\"\u003e\u003c/a\u003e\n\n⭐ Starring the repo is free and helps others discover the project.\n\n## Social\n\n[![Twitter](https://img.shields.io/badge/Twitter-Follow-1DA1F2?style=for-the-badge\u0026logo=twitter\u0026logoColor=white)](https://twitter.com/_Zinzu07) [![GitHub](https://img.shields.io/badge/GitHub-Follow-181717?style=for-the-badge\u0026logo=github\u0026logoColor=white)](https://github.com/Z4nzu/)\n\n\u003e **For authorized security testing only.**\n\u003e Thanks to all original authors of the tools included in hackingtool.\n\nYour favourite tool is not listed? [Suggest it here](https://github.com/Z4nzu/hackingtool/issues/new?template=tool_request.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fz4nzu%2Fhackingtool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fz4nzu%2Fhackingtool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fz4nzu%2Fhackingtool/lists"}