[{"_1":2,"_183":-5,"_184":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_158":159},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_89":-5,"_90":91,"_149":-5,"_150":11,"_151":17,"_152":11,"_153":-5,"_154":11,"_155":-5,"_156":157},"canonicalUrl","https://hub.docker.com/r/mcnamee/huntkit/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","mcnamee","reponame","huntkit","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_43":44,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":56,"_39":31,"_28":29,"_58":59,"_60":45,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":69,"_70":71,"_72":11,"_73":29,"_74":75,"_80":11,"_81":82,"_86":29,"_87":88},"categories",[38],{"_39":40,"_41":42},"name","Security","slug","security","content_types",[45],"image","date_registered","2020-09-23T22:13:08.630956Z","description","HuntKit is a collection of pen testing, bug bounty hunting, capture the flag, red teaming tools.","is_private","last_updated","2026-07-12T10:40:50.21965Z","last_modified","2025-02-20T09:14:53.42122Z","media_types",[57],"application/vnd.oci.image.index.v1+json","pull_count",12236,"repository_type","star_count",2,"status",1,"status_description","active","source","collaborator_count",0,"full_description","

\r\n $\"HuntKit\"$ \r\n

\r\n ^{\r\n \r\n \r\n \r\n \r\n \r\n \r\n}\r\n
\r\n

\r\n What is this?\r\n — \r\n Instructions\r\n — \r\n Tools\r\n

\r\n
\r\n

\r\n\r\n## What is this?\r\n\r\nHuntKit is a collection of penetration testing, bug bounty hunting, capture the flag, red teaming tools in a single Docker image. Simply run the image and start using the tools.\r\n\r\n__Why?__\r\n\r\nI got sick of waiting for VitualBox to start, Kali to boot, then dealing with the slugish-ness of operating in a VM. I still use Kali for certain tasks. But for a quick nmap scan (for example), using this container is *a lot* quicker.\r\n\r\n## Instructions\r\n\r\n### Run from DockerHub\r\n\r\n```bash\r\ndocker run -it mcnamee/huntkit\r\n\r\n# - OR -\r\n\r\n# Advanced:\r\n# Line 2: maps ~/Projects to the Docker /root/projects\r\n# Line 3: Allows OpenVPN\r\n# Line 4: Opens and maps port 4444 (for listeners such as Metasploit)\r\n# Line 5: Sets the machine's hostname to huntkit\r\ndocker run -it \\\r\n -v ~/Projects:/root/projects \\\r\n --cap-add=NET_ADMIN --device=/dev/net/tun \\\r\n -p 4444:4444 \\\r\n -h huntkit \\\r\n mcnamee/huntkit\r\n```\r\n\r\n[![asciicast](https://asciinema.org/a/403549.svg)](https://asciinema.org/a/403549)\r\n\r\n### Build\r\n\r\n```bash\r\n# 1. Clone the repo\r\ngit clone https://github.com/mcnamee/huntkit.git && cd huntkit\r\n\r\n# 2. Build the image\r\ndocker build . -t mcnamee/huntkit\r\n```\r\n\r\n## Tools\r\n\r\n### Recon\r\n\r\n| Tool | Description & Example |\r\n| --- | --- |\r\n| [amass](https://github.com/OWASP/Amass) | _Network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques._
`amass enum -v -src -ip -brute -min-for-recursive 2 -d kali.org` |\r\n| [brutespray](https://github.com/x90skysn3k/brutespray) | _Service scanner by bruteforcing._
`brutespray --file nmap.gnmap` |\r\n| [cloudfail](https://github.com/m0rtem/CloudFail) | _CloudFail is a tool to find origin servers of websites protected by CloudFlare._
`cloudfail --target resound.ly` |\r\n| [cloudflair](https://github.com/christophetd/CloudFlair) | _CloudFlair is a tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should._
`export CENSYS_API_ID=... && export CENSYS_API_SECRET=...`
`cloudflair resound.ly` |\r\n| [commix](https://github.com/commixproject/commix) | _Command injection exploiter - used to test web applications with the view to find bugs, errors or vulnerabilities related to command injection attacks._
`commix --url=\"http://192.168.0.23/commix-testbed/scenarios/referer/referer(classic).php\" --level=3` |\r\n| [dalfox](https://github.com/hahwul/dalfox) | _XSS Scanning and Parameter Analysis tool._
`dalfox url http://testphp.vulnweb.com/listproducts.php\\?cat\\=123 -b https://hahwul.xss.ht` |\r\n| [dirb](https://tools.kali.org/web-applications/dirb) | _Looks for existing (and/or hidden) Web Objects, by launching a dictionary based attack against a web server and analyzing the response._
`dirb https://kali.org $WORDLISTS/seclists/Discovery/Web-Content/CommonBackdoors-PHP.fuzz.txt` |\r\n| [dnmasscan](https://github.com/rastating/dnmasscan) | _dnmasscan is a bash script to automate resolving a file of domain names and subsequentlly scanning them using masscan._
`dnmasscan listofdomains.txt dns.log -p80,443 - oG masscan.log` |\r\n| [dnsx](https://github.com/projectdiscovery/dnsx) | _Allows you to run multiple probers using retryabledns library, that allows you to perform multiple DNS queries of your choice with a list of user supplied resolvers._
cat domains.txt | dnsx |\r\n| [ffuf](https://github.com/ffuf/ffuf) | _A fast web fuzzer._
- `ffuf -w /path/to/postdata.txt -X POST -d \"username=admin\\&password=FUZZ\" -u https://target/login.php -fc 401` |\r\n| [gau](https://github.com/lc/gau) | _getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl for any given domain._
- `gau example.com` |\r\n| [httpx](https://github.com/projectdiscovery/httpx) | _Take a list of domains and probe for working http and https servers._
cat domains.txt | httpx |\r\n| [linkfinder](https://github.com/GerbenJavado/LinkFinder) | _Discover endpoints and their parameters in JavaScript files._
`linkfinder -i https://example.com -d -o cli` |\r\n| [masscan](https://github.com/robertdavidgraham/masscan) | _An Internet-scale port scanner._
`masscan -p1-65535 -iL listofips.txt --max-rate 1800 -oG masscan.log` |\r\n| [meg](https://github.com/robertdavidgraham/masscan) | _A tool for fetching lots of URLs but still being 'nice' to servers._
`meg paths.txt hosts.txt` |\r\n| [nikto](https://tools.kali.org/information-gathering/nikto) | _Web server scanner which performs comprehensive tests against web servers for multiple items (dangerous files, outdated dependencies...)._
`nikto -host=https://kali.org` |\r\n| [nmap](https://nmap.org/) | _A utility for network discovery and security auditing_.
`nmap -sV 192.168.0.1` |\r\n| [nuclei](https://github.com/projectdiscovery/nuclei) | _Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use._.
`nuclei -l urls.txt -t $ADDONS/nuclei/ADDONS/nuclei/technologies/ -o ~/projects/results.txt` |\r\n| [pagodo](https://github.com/opsdisk/pagodo) | _Passive Google dork script to collect potentially vulnerable web pages and applications on the Internet._.
`pagodo -d $DOMAIN -g dorks/sensitive_directories.dorks -l 100 -s -e 35.0 -j 1.1` |\r\n| [recon-ng](https://github.com/lanmaster53/recon-ng) | _Web-based open source reconnaissance framework._
`recon-ng` |\r\n| [sherlock](https://github.com/sherlock-project/sherlock) | _Hunt down social media accounts by username across social networks._
`sherlock user1 user2 user3` |\r\n| [subfinder](https://github.com/projectdiscovery/subfinder) | _Subdomain discovery tool to find valid subdomains for websites by using passive online sources._
`subfinder -d kali.org -v` |\r\n| [subjs](https://github.com/lc/subjs) | _Fetches javascript files from a list of URLS or subdomains. Analyzing javascript files can help you find undocumented endpoints, secrets, and more._
`cat urls.txt | subjs` |\r\n| [subjack](https://github.com/haccer/subjack) | _A Subdomain Takeover tool._
`SJFP=$(find \"${GOPATH}/pkg\" -name fingerprints.json)`
`subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -a -c $SJFP` |\r\n| [sublist3r](https://github.com/aboul3la/Sublist3r) | _Enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and more._
`sublist3r -d kali.org` |\r\n| [sqlmap](http://sqlmap.org/) | _Automates the process of detecting and exploiting SQL injection flaws and taking over of database servers_
`sqlmap -u https://example.com --forms --crawl=10 --level=5 --risk=3` |\r\n| [theharvester](https://tools.kali.org/information-gathering/theharvester) | _Gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database._

theharvester -d kali.org -b \"bing, certspotter, dnsdumpster, dogpile, duckduckgo, google, hunter, linkedin, linkedin_links, twitter, yahoo\"

|\r\n| [wafw00f](https://github.com/enablesecurity/wafw00f) | _Web Application Firewall Fingerprinting Tool._
`wafw00f resound.ly` |\r\n| [whatweb](https://github.com/urbanadventurer/WhatWeb) | _Scans websites and highlights the CMS used, JavaScript libraries, web servers, version numbers, email addresses, account IDs, web framework modules, SQL errors, and more._
`whatweb kali.org` |\r\n| [wpscan](https://github.com/wpscanteam/wpscan) | _WordPress Security Scanner._
`wpscan --url kali.org` |\r\n| [xsstrike](https://github.com/s0md3v/XSStrike) | _Advanced XSS Detection Suite._
`xsstrike -u=\"http://192.168.0.115\" --data=\"query\"` |\r\n\r\n### Exploitation\r\n\r\n| Tool | Description & Example |\r\n| --- | --- |\r\n| [breach-parse](https://github.com/hmaverickadams/breach-parse) | _A tool for parsing breached passwords._
`breach-parse @tesla.com tesla.txt \"~/Downloads/BreachCompilation/data\"` |\r\n| [crunch](https://tools.kali.org/password-attacks/crunch) | _Wordlist generator where you can specify a standard character set or a character set you specify._
`crunch 6 6 0123456789abcdef -o 6chars.txt` |\r\n| [cupp](https://github.com/Mebus/cupp) | _Personal wordlist generator._
`cupp -i` |\r\n| [john](https://github.com/magnumripper/JohnTheRipper) | _John the Ripper is a fast password cracker._
`zip2john filename.zip > hash.txt`
`john hash.txt` |\r\n| [jwttool](https://github.com/ticarpi/jwt_tool) | _A toolkit for validating, forging and cracking JWTs (JSON Web Tokens)._
`jwttool eyJ0eXAiOiJ.eyJsb2dpbi.aqNCvShlN -A` |\r\n| [metasploit](https://tools.kali.org/exploitation-tools/metasploit-framework) | _A penetration testing platform that enables you to find, exploit, and validate vulnerabilities.._
`msfconsole` |\r\n| [hydra](https://tools.kali.org/password-attacks/hydra) |

hydra -f -l email@admin.com -P $WORDLISTS/seclists/Passwords/darkweb2017-top1000.txt website.com http-post-form \"/login:user=^USER^&pass=^PASS^:Failed\"

|\r\n| [netcat](http://netcat.sourceforge.net/) | _A networking utility which reads and writes data across network connections, using the TCP/IP protocol._
`nc -nvlp 1234` |\r\n| [searchsploit](https://tools.kali.org/exploitation-tools/exploitdb) | _Searchable archive from The Exploit Database._
`searchsploit oracle windows remote` |\r\n| [setoolkit](https://www.trustedsec.com/tools/the-social-engineer-toolkit-set/) | _Social Engineering Toolkit._
`setoolkit` |\r\n\r\n### Other\r\n\r\n| Tool | Description |\r\n| --- | --- |\r\n| FTP | _Connect to an FTP server._
`ftp ftp.google.com` |\r\n| [Go](https://golang.org/) | The PHP programming language |\r\n| [Interlace](https://github.com/codingo/Interlace) | _Easily turn single threaded command line applications into a fast, multi-threaded application._
`interlace -tL targets.txt -threads 5 -c \"gobuster dns -d _target_ -w wordlist.txt --noprogress --quiet >> _target_.txt\" -v` |\r\n| [NodeJS](https://nodejs.org/) | _Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine._ |\r\n| [Oh My Zsh](https://ohmyz.sh/) | _Zsh is a framework for managing your zsh configuration, bundled with thousands of helpful functions, helpers, plugins, themes._ |\r\n| [OpenVPN](https://openvpn.net/) | _Connect to a VPN._
Add `--cap-add=NET_ADMIN --device=/dev/net/tun` to the `docker run` to use OpenVPN. |\r\n| [Perl](https://www.perl.org/) | _Perl is a highly capable, feature-rich programming language with over 30 years of development._ |\r\n| [PHP](https://www.php.net/) | _The PHP scripting language._ |\r\n| [Proxychains](https://github.com/haad/proxychains) | _Redirects connections through SOCKS4a/5 or HTTP proxies._ |\r\n| [Python 2 & 3](https://www.python.org/) | _The Python programming language_ |\r\n| [Ruby](https://www.ruby-lang.org/) | _A dynamic, open source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write._ |\r\n| [smbclient](https://installlion.com/kali/kali/main/s/smbclient/install/index.html) | `smbclient \\\\192.168.0.45\\Media` |\r\n| [Tor](https://www.torproject.org/) | _Browse Privately._ |\r\n| [tmux](https://github.com/tmux/tmux/wiki) | _tmux is a terminal multiplexer. It lets you switch easily between several programs in one terminal, detach them (they keep running in the background) and reattach them to a different terminal._
`CNTR+b c` Create window
`CNTR+b n` Switch to next window |\r\n| [unfurl](https://github.com/tomnomnom/unfurl) | _Pull out bits of URLs provided on stdin._
`cat urls.txt | unfurl --unique domains` |\r\n| [zsh](https://www.zsh.org/) | _Zsh is an extended Bourne shell with many improvements, including some features of Bash, ksh, and tcsh._ |\r\n\r\n\r\n\r\n## Wordlists\r\n\r\n- Amass\r\n- Dirb\r\n- Kali's `rockyou.txt`\r\n- Metasploit\r\n- The Harvester\r\n- [SecLists](https://github.com/danielmiessler/SecLists)\r\n","has_starred","hub_user","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":17,"_84":11,"_85":11},"read","write","admin","user","storage_size",569303573423,"orgData","recentTags",[92],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":101,"_102":103,"_51":137,"_138":95,"_139":29,"_140":57,"_39":141,"_142":143,"_144":145,"_146":137,"_147":66,"_148":17},"content_type","creator",1710007,"digest","sha256:874ff2e46b76c344566903650386524aa2223f948a6fb7bb50e3657298d999f1","full_size",5051731097,"id",118693576,"images",[104,121,126,132],{"_105":106,"_96":107,"_108":109,"_110":111,"_112":113,"_114":115,"_116":109,"_117":-5,"_118":119,"_63":66,"_120":-5},"architecture","amd64","sha256:50b448a6320b56b80124de5253ebf695d9cc1c2f2a6257bc9843e162eaa92ae8","features","","last_pulled","2026-09-25T01:12:55.166960948Z","last_pushed","2026-07-12T10:32:40.80941088Z","os","linux","os_features","os_version","size",5130595627,"variant",{"_105":122,"_96":123,"_108":109,"_110":124,"_112":125,"_114":115,"_116":109,"_117":-5,"_118":99,"_63":66,"_120":-5},"arm64","sha256:3e274a24e3af74115930cc8d865c78646b2f5a017a159cffb036249ee0a6daa9","2026-09-20T18:15:18.731967192Z","2026-07-12T10:31:27.80833398Z",{"_105":127,"_96":128,"_108":109,"_110":129,"_112":130,"_114":127,"_116":109,"_117":-5,"_118":131,"_63":66,"_120":-5},"unknown","sha256:489c8ecfdf5ec25477f9cec8820703efa064729929b0a14b99b632c8f4c2338b","2026-09-20T18:15:18.851283046Z","2026-07-12T10:31:28.539512068Z",288212,{"_105":127,"_96":133,"_108":109,"_110":134,"_112":135,"_114":127,"_116":109,"_117":-5,"_118":136,"_63":66,"_120":-5},"sha256:8966e6ffd80292ff9446cea7bd4e75dd2ffc48e4b8db2755e9fbcc0f2a6e10fc","2026-09-22T15:01:14.027359137Z","2026-07-12T10:32:41.330309699Z",288225,"2026-07-12T10:40:49.812326Z","last_updater","last_updater_username","media_type","latest","repository",9893547,"tag_last_pulled","2026-09-25T09:50:13.245581995Z","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":160,"_168":169,"_156":181,"_182":11},{"_36":161,"_43":163,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":164,"_39":31,"_28":29,"_58":59,"_60":45,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":69,"_70":71,"_72":11,"_73":29,"_74":165,"_80":11,"_81":167,"_86":29,"_87":88},[162],{"_39":40,"_41":42},[45],[57],{"_76":11,"_77":166},[79],{"_83":17,"_84":11,"_85":11},"tags",{"_170":64,"_171":-5,"_172":-5,"_173":174},"count","next","previous","results",[175],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":101,"_102":176,"_51":137,"_138":95,"_139":29,"_140":57,"_39":141,"_142":143,"_144":145,"_146":137,"_147":66,"_148":17},[177,178,179,180],{"_105":106,"_96":107,"_108":109,"_110":111,"_112":113,"_114":115,"_116":109,"_117":-5,"_118":119,"_63":66,"_120":-5},{"_105":122,"_96":123,"_108":109,"_110":124,"_112":125,"_114":115,"_116":109,"_117":-5,"_118":99,"_63":66,"_120":-5},{"_105":127,"_96":128,"_108":109,"_110":129,"_112":130,"_114":127,"_116":109,"_117":-5,"_118":131,"_63":66,"_120":-5},{"_105":127,"_96":133,"_108":109,"_110":134,"_112":135,"_114":127,"_116":109,"_117":-5,"_118":136,"_63":66,"_120":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
50b448a6320b	linux/amd64	4.78 GB
3e274a24e3af	linux/arm64	4.7 GB

mcnamee/huntkit

Tags for mcnamee/huntkit