xanhunt

A lightweight debian-based docker image that contains all the tools you need to do bugbounty.

Getting started

Add the following functions to your shell profile (supports bash and zsh):

function xanhunt() {
	XANHUNT_INSTANCE=$(sudo docker container ls --all --filter=ancestor='xanhacks/xanhunt' --format "{{.ID}}")
	if [[ -z "$XANHUNT_INSTANCE" ]]; then
		    XANHUNT_INSTANCE=$(sudo docker run -d -it --rm -v "$HOME/.xanhunt/:/root/shared/" --hostname xanhunt xanhacks/xanhunt zsh)
	fi

	sudo docker exec -it "$XANHUNT_INSTANCE" zsh
}

function xanhunt-exit() {
	XANHUNT_INSTANCE=$(sudo docker container ls --all --filter=ancestor='xanhacks/xanhunt' --format "{{.ID}}")
	if [[ -n "$XANHUNT_INSTANCE" ]]; then
		    sudo docker stop "$XANHUNT_INSTANCE"
	fi
}

function xanhunt-update() {
	sudo docker pull 'xanhacks/xanhunt:latest'
}

Pull the latest docker image from DockerHub:

$ xanhunt-update

Start or attach to the existing xanhunt instance:

# start a new xanhunt instance
$ xanhunt
➜  ~ id
uid=0(root) gid=0(root) groups=0(root)

# attach to the currently running xanhunt instance
$ xanhunt
➜  ~ 

Exit the xanhunt instance:

$ xanhunt-exit
532417ce0056

Tools

Recon (URLs and domains):

• OWASP/Amass
• OJ/gobuster
• lc/gau
• epi052/feroxbuster
• projectdiscovery/katana
• projectdiscovery/subfinder

Recon (infrastructure scanning):

• robertdavidgraham/masscan
• nmap/nmap
• projectdiscovery/asnmap

Recon (tech detection):

• projectdiscovery/httpx
• sensepost/gowitness

Scanning:

• projectdiscovery/nuclei
• sqlmapproject/sqlmap
• immunIT/drupwn
• wpscanteam/wpscan

Fuzzing:

• xmendez/wfuzz
• ffuf/ffuf

Others (reporting, cleaning, ...):

• projectdiscovery/notify
• tomnomnom/unfurl
• tomnomnom/hacks/inscope

and some famous linux packages like: python, ruby, vim, neovim, jq, htop, ...

Configuration

• ohmyzsh
• zsh history (in progress)
• neovim
• raft wordlists