Forem: Mmdrza

SpyHunt

Mmdrza — Tue, 30 Dec 2025 23:14:19 +0000

SpyHunt v4.0: A comprehensive Network Scanner & Vulnerability Assessment tool. Automate OSINT, Reconnaissance, and Bug Bounty hunting with advanced scanners (XXE, SSRF, SSTI, SQLi) plus Nuclei & Shodan integration. (Fork from @gotr00t0day)

SpyHunt v4.0 (Security Hardened) - A comprehensive network scanning and vulnerability assessment tool designed for security professionals and penetration testers. This tool performs comprehensive reconnaissance and vulnerability assessment on target networks and web applications, combining multiple scanning techniques with various external tools to provide extensive security intelligence.

🆕 What's New in v4.0

5 New Advanced Vulnerability Scanners

✅ XXE Scanner - XML External Entity injection detection
✅ SSRF Scanner - Server-Side Request Forgery detection
✅ SSTI Scanner - Server-Side Template Injection (Jinja2, Twig, Freemarker, Velocity, ERB, Smarty)
✅ NoSQL Injection Scanner - MongoDB and CouchDB injection detection
✅ CRLF Scanner - HTTP header injection detection

Security Enhancements

✅ Command Injection Protection - Secure command execution prevents shell injection attacks
✅ SSL Verification Control - SSL certificate verification enabled by default (use --insecure to disable)
✅ Structured Logging - All operations logged to spyhunt.log with rotation
✅ Input Validation - Comprehensive validation prevents injection attacks
✅ HTTP Session Management - Connection pooling and automatic retries for better performance

Here's a high-level overview of its functionality

It imports various libraries for network operations, web scraping, and parallel processing.
The script defines a colorful banner and sets up command-line argument parsing for different scanning options.
It includes multiple scanning functions for different purposes:

🆕 Advanced Vulnerability Scanners (v4.0)

XXE (XML External Entity) Injection - File disclosure, SSRF via XXE, AWS metadata exposure
SSRF (Server-Side Request Forgery) - Internal network probing, cloud metadata endpoints, bypass techniques
SSTI (Server-Side Template Injection) - Jinja2, Twig, Freemarker, Velocity, ERB, Smarty detection
NoSQL Injection - MongoDB and CouchDB authentication bypass and injection
CRLF Injection - HTTP header injection, response smuggling, XSS via CRLF

Reconnaissance & Information Gathering

Subdomain enumeration
Technology detection
DNS record scanning
Web crawling and URL extraction
Favicon hash calculation
IP address extraction
Domain information gathering
Shodan integration for additional recon
Network vulnerability analysis
Wayback machine URL retrieval
JavaScript file discovery
Port Scanning & CIDR Notation Scanning

Vulnerability Detection

SQL Injection
XSS (Cross-Site Scripting)
Host header injection testing
CORS misconfiguration
HTTP request smuggling detection
Subdomain Takeover
Open Redirect
Directory Traversal
Local File Inclusion (LFI) scanning with Nuclei
403 Forbidden bypass attempts
Security header analysis
JSON Web Token vulnerabilities
Heap dump analysis
DNS zone transfer

Fuzzing & Brute Forcing

Directory and file brute-forcing
API endpoint fuzzing
Parameter mining
Login form brute-forcing
FTP brute-forcing with proxy support
SMB password spraying

Cloud Security

AWS S3 Bucket Enumeration
Azure resource scanning
GCP Storage scanning

Other Features

Custom Headers
Google dorking
Broken link checking
Auto Recon
JavaScript file scanning for sensitive info
Web Server Detection

The script uses multithreading and multiprocessing to perform scans efficiently.
It includes options to save results to files and customize scan parameters.
The tool integrates with external tools and APIs like Shodan, Nmap, and various web-based services.
It implements various techniques to bypass restrictions and discover vulnerabilities.
The script includes a CIDR notation scanner for port scanning across IP ranges.

INSTALLATION

Quick Installation (Recommended)

Linux / macOS / WSL

Install With CURL

curl -sSL https://raw.githubusercontent.com/Pymmdrza/SpyHunt/main/install.sh | bash

Install With wget

wget -qO- https://raw.githubusercontent.com/Pymmdrza/SpyHunt/main/install.sh | bash

Install With pip

curl -sSL https://raw.githubusercontent.com/Pymmdrza/SpyHunt/main/install.sh | bash -s -- --pip

Install virtual environment

curl -sSL https://raw.githubusercontent.com/Pymmdrza/SpyHunt/main/install.sh | bash -s -- --venv

Windows (Powershell)

Method 1

irm https://raw.githubusercontent.com/Pymmdrza/SpyHunt/refs/heads/main/install.ps1 | iex

Method 2

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Pymmdrza/SpyHunt/refs/heads/main/install.ps1" -OutFile "install.ps1"
.\install.ps1

Method Bypass

Set-ExecutionPolicy Bypass -Scope Process -Force; irm https://raw.githubusercontent.com/Pymmdrza/SpyHunt/refs/heads/main/install.ps1 | iex

Install directly from PyPI using pip:

[!NOTE]
If Not Install pip (root) :
  apt update&&apt upgrade -y&&apt install -y python3-pip

Linux Distributions:

pip3 install spyhunt

Upgrade Package :

pip install --upgrade spyhunt

Install with --break-system-packages without env in root:

sudo pip install spyhunt --break-system-packages

After installation, you can run SpyHunt from anywhere:

spyhunt --help

Manual Installation (Development)

For development or if you want to modify the code:

git clone https://github.com/Pymmdrza/spyhunt.git

cd spyhunt

pip3 install -r requirements.txt

sudo python3 install.py

Note: The install.py script installs external dependencies like nuclei, subfinder, and other tools required for full functionality.

USAGE

After installing via pip, you can use SpyHunt from anywhere:

spyhunt [options]

For detailed help:

spyhunt --help

Command Line Options


usage: spyhunt [-h] [-sv filename.txt | -wl filename.txt] [-th 25] [-s domain.com]
                  [-d domains.txt] [-p domains.txt] [-r domains.txt] [-b domains.txt]
                  [-pspider domain.com] [-w https://domain.com] [-j domain.com]
                  [-wc https://domain.com] [-fi https://domain.com] [-fm https://domain.com]
                  [-na https://domain.com] [-ri IP] [-rim IP] [-sc domain.com]
                  [-ph domain.txt] [-co domains.txt] [-hh domain.com] [-sh domain.com]
                  [-ed domain.com] [-smu domain.com] [-ips domain list] [-dinfo domain list]
                  [-isubs domain list] [-nft domains.txt] [-n domain.com or IP]
                  [-api domain.com] [-sho domain.com] [-fp domain.com] [-db domain.com]
                  [-cidr IP/24] [-ps 80,443,8443] [-pai IP/24]
                  [-xss https://example.com/page?param=value]
                  [-sqli https://example.com/page?param=value] [-shodan KEY]
                  [-webserver domain.com] [-javascript domain.com] [-dp DEPTH] [-je file.txt]
                  [-hibp password] [-pm domain.com] [-ch domain.com] [-or domain.com]
                  [-asn AS55555] [-st subdomains.txt] [-ar domain.com] [-jwt token]
                  [-jwt-modify token] [-heapds heapdump.txt] [-heapts domain.com]
                  [-f_p domain.com] [-nl] [-nc domain.com] [-nct template.yaml] [-v]
                  [-c CONCURRENCY] [-gs] [-e EXTENSIONS] [-x EXCLUDE] [-u]
                  [--shodan-api SHODAN_API] [--proxy PROXY] [--proxy-file PROXY_FILE]
                  [--heapdump HEAPDUMP] [--output-dir OUTPUT_DIR] [-aws domain.com]
                  [-az domain.com] [--s3-scan S3_SCAN] [-gcp domain.com] [-zt domain.com]
                  [-ssrfp domains.txt] [--ipinfo TARGET] [--token TOKEN]
                  [--save-ranges FILENAME] [--forbidden_domains FORBIDDEN_DOMAINS]
                  [--brute-user-pass domain.com] [--username_wordlist domain.com]
                  [--password_wordlist domain.com] [-fs HOST[:PORT]]
                  [--ftp-userlist users.txt] [--ftp-passlist passwords.txt]
                  [--ftp-proxylist proxies.txt] [--smb_scan] [--smb_auto]
                  [--spray-userlist SPRAY_USERLIST] [--spray-passlist SPRAY_PASSLIST]
                  [--spray-password SPRAY_PASSWORD] [--smb-target SMB_TARGET]
                  [--smb-user SMB_USER] [--smb-pass SMB_PASS] [--smb-domain SMB_DOMAIN]

options:
  -h, --help            show this help message and exit
  -sv, --save filename.txt
                        save output to file
  -wl, --wordlist filename.txt
                        wordlist to use
  -th, --threads 25     default 25
  -p, --probe domains.txt
                        probe domains.
  -r, --redirects domains.txt
                        links getting redirected
  -fi, --favicon https://domain.com
                        get favicon hashes
  -fm, --faviconmulti https://domain.com
                        get favicon hashes
  -ri, --reverseip IP   reverse ip lookup
  -rim, --reverseipmulti IP
                        reverse ip lookup for multiple ips
  -sc, --statuscode domain.com
                        statuscode
  -sh, --securityheaders domain.com
                        scan for security headers
  -ed, --enumeratedomain domain.com
                        enumerate domains
  -isubs, --importantsubdomains domain list
                        extract interesting subdomains from a list like dev, admin, test and etc..
  -webserver, --webserver_scan domain.com
                        webserver scan
  -v, --verbose         Increase output verbosity
  -c, --concurrency CONCURRENCY
                        Maximum number of concurrent requests
  --shodan-api SHODAN_API
                        Shodan API key for subdomain enumeration
  --proxy PROXY         Use a proxy (e.g., http://proxy.com:8080)
  --proxy-file PROXY_FILE
                        Load proxies from file
  --heapdump HEAPDUMP   Analyze Java heapdump file
  --output-dir OUTPUT_DIR
                        Output directory
  --forbidden_domains FORBIDDEN_DOMAINS
                        File containing list of domains to scan for forbidden bypass

Update:
  -u, --update          Update the script

Nuclei Scans:
  -nl, --nuclei_lfi     Find Local File Inclusion with nuclei
  -nc, --nuclei domain.com
                        scan nuclei on a target
  -nct, --nuclei_template template.yaml
                        use a nuclei template

Vulnerability:
  🆕 ADVANCED SCANNERS (v4.0):
  --xxe, --xxe_scan https://example.com/api/xml
                        Scan for XXE (XML External Entity) vulnerabilities
  --ssrf, --ssrf_scan https://example.com/api?url=test
                        Scan for SSRF (Server-Side Request Forgery) vulnerabilities
  --ssti, --ssti_scan https://example.com/page?template=test
                        Scan for SSTI (Server-Side Template Injection) vulnerabilities
  --nosqli, --nosql_scan https://example.com/api?id=test
                        Scan for NoSQL injection vulnerabilities
  --crlf, --crlf_scan https://example.com/redirect?url=test
                        Scan for CRLF injection vulnerabilities
  --callback-url http://your-server.com
                        Callback URL for out-of-band vulnerability testing

  STANDARD SCANNERS:
  -b, --brokenlinks domains.txt
                        search for broken links
  -ph, --pathhunt domain.txt
                        check for directory traversal
  -co, --corsmisconfig domains.txt
                        cors misconfiguration
  -hh, --hostheaderinjection domain.com
                        host header injection
  -smu, --smuggler domain.com
                        enumerate domains
  -fp, --forbiddenpass domain.com
                        Bypass 403 forbidden
  -xss, --xss_scan https://example.com/page?param=value
                        scan for XSS vulnerabilities
  -sqli, --sqli_scan https://example.com/page?param=value
                        scan for SQLi vulnerabilities
  -or, --openredirect domain.com
                        open redirect
  -st, --subdomaintakeover subdomains.txt
                        subdomain takeover
  -jwt, --jwt_scan token
                        analyze JWT token for vulnerabilities
  -jwt-modify, --jwt_modify token
                        modify JWT token
  -heapds, --heapdump_file heapdump.txt
                        file for heapdump scan
  -heapts, --heapdump_target domain.com
                        target for heapdump scan
  -zt, --zone-transfer domain.com
                        Test for DNS zone transfer vulnerability
  -ssrfp, --ssrfparams domains.txt
                        Get SSRF parameters from a list of domains

Security Options:
  --insecure            Disable SSL certificate verification (insecure, not recommended)

Crawlers:
  -pspider, --paramspider domain.com
                        extract parameters from a domain
  -w, --waybackurls https://domain.com
                        scan for waybackurls
  -j domain.com         find javascript files
  -wc, --webcrawler https://domain.com
                        scan for urls and js files
  -javascript, --javascript_scan domain.com
                        scan for sensitive info in javascript files
  -dp, --depth DEPTH    Crawling depth (default: 2)
  -je, --javascript_endpoints file.txt
                        extract javascript endpoints
  -hibp, --haveibeenpwned password
                        check if the password has been pwned

Passive Recon:
  -s domain.com         scan for subdomains
  -d, --dns domains.txt
                        scan a list of domains for dns records
  -na, --networkanalyzer https://domain.com
                        net analyzer
  -ips, --ipaddresses domain list
                        get the ips from a list of domains
  -dinfo, --domaininfo domain list
                        get domain information like codes,server,content length
  -sho, --shodan_ domain.com
                        Recon with shodan
  -shodan, --shodan_api KEY
                        shodan api key
  -gs, --google         Google Search

Fuzzing:
  -nft, --not_found domains.txt
                        check for 404 status code
  -api, --api_fuzzer domain.com
                        Look for API endpoints
  -db, --directorybrute domain.com
                        Brute force filenames and directories
  -pm, --param_miner domain.com
                        param miner
  -ch, --custom_headers domain.com
                        custom headers
  -asn, --automoussystemnumber AS55555
                        asn
  -ar, --autorecon domain.com
                        auto recon
  -f_p, --forbidden_pages domain.com
                        forbidden pages
  -e, --extensions EXTENSIONS
                        Comma-separated list of file extensions to scan
  -x, --exclude EXCLUDE
                        Comma-separated list of status codes to exclude

Port Scanning:
  -n, --nmap domain.com or IP
                        Scan a target with nmap
  -cidr, --cidr_notation IP/24
                        Scan an ip range to find assets and services
  -ps, --ports 80,443,8443
                        Port numbers to scan
  -pai, --print_all_ips IP/24
                        Print all ips

Bruteforcing:
  --brute-user-pass domain.com
                        Bruteforcing username and password input fields
  --username_wordlist domain.com
                        Bruteforcing username and password input fields
  --password_wordlist domain.com
                        Bruteforcing username and password input fields

FTP Scanning:
  -fs, --ftp_scan HOST[:PORT]
                        FTP server to scan (e.g., host or host:port)
  --ftp-userlist users.txt
                        Path to a custom username list for FTP bruteforcing
  --ftp-passlist passwords.txt
                        Path to a custom password list for FTP bruteforcing
  --ftp-proxylist proxies.txt
                        Path to a proxy list for FTP bruteforcing (format: socks5://host:port,
                        socks4://host:port, http://host:port, or just IP:PORT for SOCKS5; only working
                        proxies will be used automatically)

Cloud Security:
  -aws, --aws-scan domain.com
                        Scan for exposed AWS resources
  -az, --azure-scan domain.com
                        Scan for exposed Azure resources
  --s3-scan S3_SCAN     Scan for exposed S3 buckets
  -gcp, --gcp-scan domain.com
                        Scan for exposed GCP Storage resources

IP Information:
  --ipinfo TARGET       Get IP info for a company domain/IP
  --token TOKEN         IPinfo API token
  --save-ranges FILENAME
                        Save IP ranges to file

SMB Automated Pentest:
  --smb_scan            Run SMB scan
  --smb_auto            Run automated SMB pentest
  --spray-userlist SPRAY_USERLIST
                        User list for password spraying
  --spray-passlist SPRAY_PASSLIST
                        Password list for password spraying
  --spray-password SPRAY_PASSWORD
                        Single password to test against userlist
  --smb-target SMB_TARGET
                        Target IP or hostname for SMB automation
  --smb-user SMB_USER   Username for credential testing
  --smb-pass SMB_PASS   Password for credential testing
  --smb-domain SMB_DOMAIN
                        Domain for credential testing

EXAMPLE

Scan for subdomains and save the output to a file.

spyhunt -s yahoo.com --save filename.txt

Scan for subdomains but also extract subdomains from shodan

spyhunt -s yahoo.com --shodan API_KEY --save filename.txt

Scan a file of domains to extract subdomains

spyhunt -s domains.txt --save filename.txt

Scan for javascript files

spyhunt -j yahoo.com --depth 4 --save jsfiles.txt -c 20

Scan for dns records

spyhunt -d domains.txt

Scan for FavIcon hashes

spyhunt -fi domain.com

Web Crawler

spyhunt -wc [https://www.domain.com](https://www.domain.com)

Web Crawler with depth

spyhunt -wc [https://www.domain.com](https://www.domain.com) --depth 5

Broken Links

spyhunt -b [https://www.domain.com](https://www.domain.com)

Cors Misconfiguration Scan

spyhunt -co domains.txt

Host Header Injection

spyhunt -hh domains.txt

Host Header Injection With proxy

spyhunt -hh domains.txt --proxy [http://proxy.com:8080](http://proxy.com:8080)

Directory Brute Forcing

spyhunt --directorybrute domain.com --wordlist list.txt --threads 50 -e php,txt,html -x 404,403

Directory Brute Forcing with no extensions

spyhunt --directorybrute domain.com --wordlist list.txt --threads 50 -x 404,403

Scanning a subnet

spyhunt --cidr_notation IP/24 --ports 80,443 --threads 200

Directory Traversal

spyhunt -ph domain.com?id=

sql injection

spyhunt -sqli domain.com?id=1

xss

spyhunt -xss domain.com?id=1

JavaScript file scanning for sensitive info

spyhunt -javascript domain.com

Javascript endpoint fuzzing

spyhunt -javascript_endpoint domains.txt -c 20 --save filename.txt

Modify the headers of the request

spyhunt -ch domain.com

Parameter bruteforcing

spyhunt -pf domain.com

Open Redirect

spyhunt -or domain.com -v -c 50

Haveibeenpwned

spyhunt -hibp password

Subdomain Takeover

spyhunt -st domains.txt --save vuln_subs.txt -c 50

Auto Recon

spyhunt -ar domain.com

JSON Web Token

spyhunt -jwt Token

JSON Web Token Modification

spyhunt -jwt-modify Token

AWS S3 Bucket Enumeration

spyhunt --s3-scan bucket.com

Heap Dump Analysis

spyhunt --heapdump heapdump_file

Spring Boot Actuator Scan

spyhunt --heapdump_target domain.com

Heap Dump Scan with file

spyhunt --heapdump_file heapdump.txt

Cloud Aws Scan

spyhunt --aws_scan domain.com

Cloud Azure Scan

spyhunt --azure_scan domain.com

Checks for 403 forbidden domains and saves it to a file

spyhunt --forbidden_pages domains.txt

Scan a list of domains to bypass 403 forbidden

spyhunt --forbidden_domains domains.txt

Scan google storage

spyhunt --gcp-scan domain.com

Brute Forcing Login Forms With Proxies

spyhunt --brute-user-pass [domain.com/login](https://domain.com/login) --username_wordlist usernames --password_wordlist passwords --proxy-file proxies.txt --verbose

Brute Forcing Login Forms Witout Proxies

spyhunt --brute-user-pass [domain.com/login](https://domain.com/login) --username_wordlist usernames --password_wordlist passwords --verbose

Nuclei Scan

spyhunt --nuclei domain.com --nuclei-template nuclei-templates/cves/CVE-2024-22208.yaml

SSRF Params

spyhunt --ssrfparams links.txt

FTP Scan

spyhunt -fs domain.com

FTP Scan with a port

spyhunt -fs domain.com:2121

FTP Scan with userlist and passlist

spyhunt -fs domain.com --ftp-userlist usernames.txt --ftp-passlist passwords.txt

SMB Automated Pentest (Anonymous, Blank Creds, RID Brute)

spyhunt --smb_auto --smb-target 10.129.228.111

SMB Pentest with Specific Credentials

spyhunt --smb_auto --smb-target 10.129.228.111 --smb-user mhope --smb-pass ""

SMB Pentest with Domain Credentials

spyhunt --smb_auto --smb-target 10.129.228.111 --smb-user mhope --smb-pass "" --smb-domain megabank.local

SMB Password Spraying with User and Password Lists

spyhunt --smb_auto --smb-target 10.129.228.111 --spray-userlist users.txt --spray-passlist passwords.txt

SMB Password Spraying with Single Password

spyhunt --smb_auto --smb-target 10.129.228.111 --spray-userlist users.txt --spray-password "Password1"

SMB Full Pentest (Credentials + Password Spray)

spyhunt --smb_auto --smb-target 10.129.228.111 --smb-user mhope --smb-pass "" --spray-userlist users.txt --spray-password "Welcome1"

🆕 New Advanced Vulnerability Scanners (v4.0)

XXE (XML External Entity) Scanner

Test for XXE vulnerabilities in XML endpoints:

# Basic XXE scan
spyhunt --xxe https://example.com/api/xml

# With custom callback URL for out-of-band detection
spyhunt --xxe https://example.com/api/xml --callback-url http://your-server.com

# Save results to file
spyhunt --xxe https://example.com/api/xml --save xxe_results.json

# With verbose logging
spyhunt --xxe https://example.com/api/xml -v

What it detects:

Classic XXE with callback
Blind XXE
File disclosure (Linux: /etc/passwd, Windows: win.ini)
SSRF via XXE
AWS metadata exposure

SSRF (Server-Side Request Forgery) Scanner

Test for SSRF vulnerabilities:

# Basic SSRF scan
spyhunt --ssrf "https://example.com/api?url=test"

# With callback domain
spyhunt --ssrf "https://example.com/api?url=test" --callback-url http://your-domain.com

# Save results
spyhunt --ssrf "https://example.com/fetch?url=test" --save ssrf_results.json

What it detects:

Internal network access (127.0.0.1, localhost, 0.0.0.0)
Cloud metadata endpoints (AWS, GCP, Azure, DigitalOcean, Oracle)
Bypass techniques (octal, hex, decimal encoding, DNS rebinding)
File disclosure via file:// protocol
Port scanning via SSRF

SSTI (Server-Side Template Injection) Scanner

Test for template injection vulnerabilities:

# Basic SSTI scan
spyhunt --ssti "https://example.com/page?template=test"

# Multiple parameters
spyhunt --ssti "https://example.com/render?name=test&title=hello"

# Save results
spyhunt --ssti "https://example.com/view?template=test" --save ssti_results.json

Template engines detected:

Jinja2 (Python/Flask)
Twig (PHP/Symfony)
Freemarker (Java)
Velocity (Java)
ERB (Ruby/Rails)
Smarty (PHP)

NoSQL Injection Scanner

Test for NoSQL injection in MongoDB and CouchDB:

# Basic NoSQL injection scan
spyhunt --nosqli "https://example.com/api?id=test"

# User authentication endpoint
spyhunt --nosqli "https://example.com/api/login?username=test&password=test"

# Save results
spyhunt --nosqli "https://example.com/api/users?id=test" --save nosql_results.json

What it detects:

Authentication bypass
Operator injection ($ne, $gt, $regex, $where)
Time-based blind injection
JavaScript injection in MongoDB

CRLF Injection Scanner

Test for HTTP header injection vulnerabilities:

# Basic CRLF scan
spyhunt --crlf "https://example.com/redirect?url=test"

# Multiple URL parameters
spyhunt --crlf "https://example.com/page?ref=test&return=home"

# Save results
spyhunt --crlf "https://example.com/goto?url=test" --save crlf_results.json

What it detects:

Set-Cookie header injection
Location header manipulation
HTTP response smuggling
XSS via CRLF injection

Security Features

SSL Verification Control

# SSL verification ON by default (recommended)
spyhunt --xxe https://example.com/api/xml

# Disable SSL verification for testing (not recommended for production)
spyhunt --xxe https://self-signed.local/api/xml --insecure

Logging

All operations are automatically logged to spyhunt.log:

# Enable verbose logging
spyhunt --xxe https://example.com/api/xml --verbose

# View logs in real-time
tail -f spyhunt.log

# Search logs
grep "XXE vulnerability" spyhunt.log

Bug Bounty Workflow Example

# 1. Enumerate subdomains
spyhunt -s target.com --save subdomains.txt

# 2. Probe for live hosts
spyhunt -p subdomains.txt --save live_hosts.txt

# 3. Run comprehensive vulnerability scans
spyhunt --xxe https://api.target.com/xml --save xxe_findings.json
spyhunt --ssrf "https://api.target.com/fetch?url=test" --save ssrf_findings.json
spyhunt --ssti "https://target.com/render?template=test" --save ssti_findings.json
spyhunt --nosqli "https://api.target.com/users?id=test" --save nosql_findings.json
spyhunt --crlf "https://target.com/redirect?url=test" --save crlf_findings.json

# 4. Traditional vulnerability scans
spyhunt --xss "https://target.com/search?q=test"
spyhunt --sqli "https://target.com/product?id=1"
spyhunt -co live_hosts.txt

Documentation

For detailed information:

NEW_FEATURES_README.md - Quick start guide for v4.0 features
INTEGRATION_COMPLETE.md - Complete integration details
SECURITY_ANALYSIS_REPORT.md - Comprehensive security analysis
WHAT_CHANGED.md - Summary of changes from v3.4 to v4.0

Security Notes

Default Security Settings (v4.0)

✅ SSL certificate verification is enabled by default
✅ All operations are logged to spyhunt.log
✅ Command injection protection is active
✅ Input validation prevents injection attacks

Best Practices

Always use SSL verification in production (--insecure only for testing)
Review logs regularly for security events
Save scan results with --save for documentation
Use --verbose for detailed debugging
Test on authorized targets only

Version History

v4.0 (Security Hardened) - October 2025

➕ Added XXE Scanner
➕ Added SSRF Scanner
➕ Added SSTI Scanner
➕ Added NoSQL Injection Scanner
➕ Added CRLF Injection Scanner
🔒 Fixed command injection vulnerabilities
🔒 Added SSL verification control
📝 Added structured logging system
⚡ Added HTTP session management
🛡️ Added input validation framework

Refactored

Libcrypto Pypi - Generate and converting Crypto Wallet Package

Mmdrza — Sun, 02 Nov 2025 15:21:58 +0000

LibCrypto

A professional library for Cryptography and Cryptocurrencies in Python.

This library provides a comprehensive suite of tools for developers working with cryptocurrencies, focusing on key management and address generation with a clean, high-level API.

It has been a while since I published this new library to help and use other programmers who no longer have to get involved in various projects that need such tools, writing long source codes and using different libraries, which ultimately reduces the quality of the project.
In this library, an attempt has been made to make the most widely used and complex process for various cases into the shortest and most optimized standard form that can be used by the user, which has finally become, along with hundreds of different features of this library, the CryptoLib, which you can easily install and use in your source code or in the terminal (CLI).

Key Features

High-Level Wallet API: A simple Wallet class to manage keys and addresses.
Multi-Currency Support: Correctly generate addresses for numerous secp256k1-based cryptocurrencies, including:
- Bitcoin (BTC) - Legacy, SegWit (P2SH & Native)
- Ethereum (ETH)
- Tron (TRX)
- Ripple (XRP)
- Bitcoin Cash (BCH) - CashAddr format
- Litecoin (LTC)
- Dash (DASH)
- Dogecoin (DOGE)
Hierarchical Deterministic (HD) Wallets: Full BIP32 support for generating wallets from a master seed.
BIP39 Mnemonic Support: Generate, validate, and derive seeds from mnemonic phrases.
Key & Format Conversions: Easily convert between WIF, Hex, and Bytes for private and public keys.
Powerful Command-Line Interface: Perform common wallet operations directly from your terminal.

Installation

Install the library using pip:

pip install libcrypto

Quick Start (Library Usage)

from libcrypto import Wallet

key = "Your Private Key (hex | bytes | int | Wif)"
# Initialize the Wallet with the private key
wallet = Wallet(key)

Generated Bitcoin Wallet Addresses from Private Key

# Generate P2PKH, P2SH-P2WPKH, P2WPKH addresses for Bitcoin
p2pkh = wallet.get_address(coin="bitcoin", address_type="p2pkh")
p2wsh = wallet.get_address(coin="bitcoin", address_type="p2sh-p2wpkh")
p2wpkh = wallet.get_address(coin="bitcoin", address_type="p2wpkh")

Generated Ethereum Wallet from Private Key

# Generate ethereum Address
ethereum_address = wallet.get_address(coin="ethereum")

Generated Tron Wallet from Private Key

# Generate Tron Address
tron_address = wallet.get_address(coin="tron")

Generated Ripple Wallet from Private Key (Hex)

# Generate Ripple Address
ripple_address = wallet.get_address(coin="ripple")

Generated Dash Wallet from Private Key

# Generate Dash Address
dash = wallet.get_address(coin="dash")

Generated Dogecoin Wallet from Private Key

# Generate Dogecoin Address
dogecoin_address = wallet.get_address(coin="dogecoin")

Generated Litecoin Addresses From Private Key

# Generate Litecoin Address
litecoin_address = wallet.get_address(coin="litecoin")
# Generate Litecoin Address with specific address types
litecoin_address_p2pkh = wallet.get_address(coin="litecoin", address_type="p2pkh")
litecoin_address_p2wsh = wallet.get_address(coin="litecoin", address_type="p2sh-p2wpkh")
litecoin_address_p2wpkh = wallet.get_address(coin="litecoin", address_type="p2wpkh")

The library is designed to be straightforward. Here is a basic example of generating addresses from an existing private key.

from libcrypto import Wallet

# Initialize a wallet from a WIF private key
wif_key = "L4ZQks37JHUadEqaj2nGB1eaZFcsRZwZGQ7WVYuQiztzg4pqopU6"  # Example
wallet = Wallet(wif_key)

# Generate addresses for different coins
eth_address = wallet.get_address('ethereum')
btc_address = wallet.get_address('bitcoin', address_type='p2wpkh') # Native SegWit
bch_address = wallet.get_address('bitcoin_cash')

print(f"Ethereum Address: {eth_address}")
print(f"Bitcoin (SegWit) Address: {btc_address}")
print(f"Bitcoin Cash Address: {bch_address}")

Generated Bitcoin Compressed and Uncompressed Address Wallet

from libcrypto import PrivateKey

# Key generation
key = PrivateKey(network="bitcoin")
# Generate Public Key (compressed and uncompressed)
public_compressed = key.get_public_key(compressed=True)
public_uncompressed = key.get_public_key(compressed=False)
# Compressed and Uncompressed Addresses
address_compressed = public_compressed.get_address()
address_uncompressed = public_uncompressed.get_address()

Generated Wif Compressed and Uncompressed

from libcrypto import PrivateKey

# Key generation
key = PrivateKey(network="bitcoin")
# Wif compressed and Uncompressed
wif_compressed = key.to_wif(compressed=True)
wif_uncompressed = key.to_wif(compressed=False)

Quick Start (Command-Line Interface)

# version
libcrypto -v

Package Information:

libcrypto info

Wallet & Address Generation

Generate a Wallet: This is the main command for generating new wallets or deriving addresses from existing keys.

libcrypto generate [OPTIONS]

Options:

-p, --private-key TEXT: Derive addresses from an existing private key (WIF or Hex format). If omitted, a new random wallet is generated.
-c, --coin TEXT: Specify a coin to generate addresses for. This option can be used multiple times. Defaults to bitcoin and ethereum.

Generate a new wallet for Bitcoin and Litecoin:

libcrypto generate -c bitcoin -c litecoin

Generate a wallet from an existing private key:

libcrypto generate -p <your-private-key>

Derive addresses for a specific set of coins from a hex key:

libcrypto generate -p <your-hex-key> -c bitcoin -c ethereum -c dash -c tron

Mnemonic Management

The mnemonic subcommand is used for all BIP39 mnemonic phrase operations.
Generate a Mnemonic Phrase

Creates a new, cryptographically secure BIP39 mnemonic phrase.

libcrypto mnemonic generate [OPTIONS]

Options:

-w, --words INTEGER: The number of words in the mnemonic. Can be 12, 15, 18, 21, or 24. [Default: 12]

Example:

libcrypto mnemonic generate --words 24

Validate a Mnemonic Phrase

Checks if a given BIP39 mnemonic phrase is valid according to the checksum rules.

libcrypto mnemonic validate "PHRASE"

Arguments:

PHRASE: The full mnemonic phrase, enclosed in double quotes. [Required]

Example:

libcrypto mnemonic validate "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

Libcrypto Doc | Libcrypto Source | Libcrypto PYPI

[Boost]

Mmdrza — Sat, 08 Feb 2025 00:47:00 +0000

How to Generate Any Wallet with Cryptofuzz

Mmdrza ・ Jan 20

#cryptocurrency #cryptofuzz #wallet #privatekey

How to Generate Any Wallet with Cryptofuzz

Mmdrza — Mon, 20 Jan 2025 18:34:11 +0000

What is Cryptofuzz?

This library is for faster and easier use in the field of cryptography and tools for creating various private keys and mnemonics and converting them into other components required for a cryptocurrency wallet for Bitcoin, Ethereum, Dash, Dogecoin, Litecoin, TON, Tron, Bitcoin Gold and ... several other different currencies.

In the following, I will show you how you can implement and execute the best and most optimized code in Python using this library of private and public keys and mnemonics to convert them into addresses and other security keys for a wallet using the least amount of code.

Install

PIP

install with pip in your terminal

pip install --upgrade cryptofuzz

GIT

install with git in your terminal

git clone https://github.com/Pymmdrza/cryptoFuzz
cd cryptoFuzz
python3 setup.py install

Use

Private Key

Private Key To Bitcoin Wallet

convert private key hex to all address format bitcoin
Generating Bitcoin Addresses with Cryptofuzz

This example demonstrates generating various types of Bitcoin addresses using the cryptofuzz library in Python, utilizing a specific private key. The process results in addresses that support different transaction protocols and optimizations.
Implementing Address Generation

The script below initializes a Bitcoin object and generates four types of addresses: P2PKH, P2SH, P2WPKH, and P2WSH, based on the provided private key.

from cryptofuzz import Bitcoin

btc = Bitcoin()

# private key 
privatekey = "0A97965...A45517"

# Generate P2PKH address
p2pkh = btc.hex_addr(privatekey, 'p2pkh')

# Generate P2SH address
p2sh = btc.hex_addr(privatekey, 'p2sh')

# Generate P2WPKH address
p2wpkh = btc.hex_addr(privatekey, 'p2wpkh')

# Generate P2WSH address
p2wsh = btc.hex_addr(privatekey, 'p2wsh')

type	description	example
`p2pkh`	Pay to Public Key Hash	`1M8Qk46ERsPrEtWLBRSET5NUH2Ck5wwREU`
`p2sh`	Pay to Script Hash	`34omeRgNLiDqbP7BTdVUSGoPBoFKy3BX44`
`p2wpkh`	Pay to Witness Public Key Hash	`bc1qmnyn7x24xj6vraxeeq56dfkxa009tvhgqffstc`
`p2wsh`	Pay to Witness Script Hash	`bc1qgahjmt5vkm8wkv70adwyrvw9qy22cygafc7h9nur9nfk8gj6dc3s3v24wf`

Private Key To Compressed and Uncompressed

use the hex_to_addr method from the Convertor class for compressed and uncompressed addresses:

from cryptofuzz import Convertor

conv = Convertor()

# private key 
privatekey = "0A97965...A45517"

# Compressed Bitcoin Address Wallet
compressed_addr = conv.hex_to_addr(privatekey, True)

# Uncompressed Bitcoin Address Wallet
uncompressed_addr = conv.hex_to_addr(privatekey, False)

Private Key To Ethereum Wallet

convert private key hex to Ethereum address wallet

from cryptofuzz import Ethereum

ETH = Ethereum()

# private key
privatekey = "0A97965...A45517"

# Ethereum Address Wallet
ethereum_address = ETH.hex_addr(privatekey)

Private Key To Dash Wallet

convert private key hex to Dash address wallet

from cryptofuzz import Dash

DASH = Dash()

# private key
privatekey = "0A97965...A45517"

# Dash Address Wallet
dash_address = DASH.hex_addr(privatekey)

Private Key To Dogecoin Wallet

convert private key hex to Dogecoin address wallet

from cryptofuzz import Dogecoin

doge = Dogecoin()

# private key
privatekey = "0A97965...A45517"

# Dogecoin Address Wallet
dogecoin_address = doge.hex_addr(privatekey)

Private Key To Litecoin Wallet

convert private key hex to Litecoin address wallet

from cryptofuzz import Litecoin

LTC = Litecoin()

# private key
privatekey = "0A97965...A45517"

# Litecoin Address Wallet
litecoin_address = LTC.hex_addr(privatekey)

Private Key To Tron Wallet

convert private key hex to Tron address wallet

from cryptofuzz import Tron

TRX = Tron()

# private key
privatekey = "0A97965...A45517"

# Tron Address Wallet
tron_address = TRX.hex_addr(privatekey)

Private Key To Bitcoin Gold Wallet

convert private key hex to Bitcoin Gold address wallet

from cryptofuzz import BitcoinGold

BTG = BitcoinGold()

# private key
privatekey = "0A97965...A45517"

# Bitcoin Gold Address Wallet
bitcoin_gold_address = BTG.hex_addr(privatekey)

Private Key To Zcash Wallet

convert private key hex to Zcash address wallet

from cryptofuzz import Zcash

ZEC = Zcash()

# private key
privatekey = "0A97965...A45517"

# Zcash Address Wallet
zcash_address = ZEC.hex_addr(privatekey)

TON Wallet

basic chain (workchain 0)

from cryptofuzz import Ton
ton = Ton(mainnet=True, workchain=0)

masterchain (workchain -1)

from cryptofuzz import Ton
ton = Ton(mainnet=True, workchain=-1)

from cryptofuzz import Ton
ton = Ton(mainnet=True, workchain=-1)
# or
ton = Ton(mainnet=True, workchain=0) # default

testnet supported mainnet=False

Private Key To TON Address Wallet

convert private key hex to TON address wallet from privatekey_to_address function in Ton class

from cryptofuzz import Ton

TON = Ton()

# private key
privatekey = "0A97965...A45517"

# TON Address Wallet bounceable
bounceable_address = TON.privatekey_to_address(privatekey)
# TON Address Wallet non-bounceable
unbounceable_address = TON.privatekey_to_address(privatekey, False)

Parameters privatekey_to_address: in_privatekey: str, bounceable: bool (default: True)
Returns: str address in Base64 format (urlsafe_b64encode)
Example: baddr = ton.privatekey_to_address('0abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef', True)
Example: uaddr = ton.privatekey_to_address('0abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef', False)

Mnemonic To TON Address Wallet

Convert Mnemonic to User-Friendly TON Address (bounceable, Un-Bounceable)

from cryptofuzz import Ton
ton = Ton(mainnet=True)
# Create mnemonic (Only : *24 words)
mnemonic = ('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon '
            'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about')
# Convert mnemonic to Bounceable TON address
baddr = ton.mnemonic_to_address(mnemonic, True)
# Convert mnemonic to Unbounceable TON address
uaddr = ton.mnemonic_to_address(mnemonic, False)

Parameters mnemonic_to_address: mnemonic: str, bounceable: bool (default: True)
Returns: str address in Base64 format (urlsafe_b64encode)
Example: baddr = ton.mnemonic_to_address('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about', True)
Example: uaddr = ton.mnemonic_to_address('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about', False)

Decimal To TON Address Wallet

Convert Decimal to User-Friendly TON Address (bounceable, Un-Bounceable)

from cryptofuzz import Ton
ton = Ton(mainnet=True)
# Convert decimal to Bounceable TON address
baddr = ton.decimal_to_address(1, True)
# Convert decimal to Unbounceable TON address
uaddr = ton.decimal_to_address(1, False)

Parameters decimal_to_address: decimal: int, bounceable: bool (default: True)
Returns: str address in Base64 format (urlsafe_b64encode)
Example: baddr = ton.decimal_to_address(1, True)
Example: uaddr = ton.decimal_to_address(1, False)
Note: Decimal Value must be less than 2^256 - 1

TON Address To Raw Address

Convert User-Friendly TON Address To Raw Address

from cryptofuzz import Ton
ton = Ton(mainnet=True)
addr = 'EQDlW5BbpUj6J0ApOxTlZ_CHYYR9NlPc3ahYQ8HtVlbQc6AA'
baddr = ton.raw_address(addr)
# output: 0:E55B905BA548FA2740293B14E567F08761847D3653DCDDA85843C1ED5656D073

Parameters raw_address: address: str
Returns: str raw address
Example: baddr = ton.raw_address('EQDlW5BbpUj6J0ApOxTlZ_CHYYR9NlPc3ahYQ8HtVlbQc6AA')
Note: Address Value must be in Base64 format (urlsafe_b64encode)

Mnemonic

Generate Mnemonic

Generate Mnemonic (Only : 12 , 24 words)

from cryptofuzz import Generator

gen = Generator()

# 12 words
mnemonic_12 = gen.generate_mnemonic(12)

# 24 words
mnemonic_24 = gen.generate_mnemonic(24)

Parameters generate_mnemonic: length: int (_default: 12)
Returns: str mnemonic
Example: mnemonic_12 = gen.generate_mnemonic(12)
Example: mnemonic_24 = gen.generate_mnemonic(24)

Mnemonic To Private Key

Convert Mnemonic to Private Key

from cryptofuzz import Convertor

conv = Convertor()

# Mnemonic
mnemonic = ('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon '
            'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about')

# Private Key
privatekey = conv.mne_to_hex(mnemonic)

Parameters mne_to_hex: mnemonic: str
Returns: str private key
Example: privatekey = conv.mne_to_hex(mnemonic)

Mnemonic To Address

Convert Mnemonic to compressed address and uncompressed bitcoin address

from cryptofuzz import Convertor

conv = Convertor()

# Mnemonic
mnemonic = ('abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon '
            'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about')

# compressed address
compressed_address = conv.mne_to_addr(mnemonic)

# uncompressed address
uncompressed_address = conv.mne_to_addr(mnemonic, False)

Parameters mne_to_addr: mnemonic: str, compressed: bool (default: True)
Returns: str address
- compressed address: str compressed address
- uncompressed address: str uncompressed address
- Example: compressed_address = conv.mne_to_addr(mnemonic), uncompressed_address = conv.mne_to_addr(mnemonic, False)

Mnemonic To Seed

from  cryptofuzz import Mnemonic

mne = Mnemonic()

words = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

seed = mne.to_seed(words)

Parameters to_seed: mnemonic: str
Returns: bytes seed

Mnemonic To Root Private Key (Extended Private Key / XPRV)

from cryptofuzz import Convertor

conv = Convertor()

# Mnemonic
mne = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

# Root Private Key
root_private_key = conv.mne_to_xprv(mne)

Parameters mne_to_xprv: mnemonic: str
Returns: str root private key
Example: root_private_key = conv.mne_to_xprv(mne)
Note: Mnemonic must be 12 or 24 words

Mnemonic To Root Public Key (Extended Public Key / XPUB)

from cryptofuzz import Convertor

conv = Convertor()

# Mnemonic
mne = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

# Root Public Key
root_public_key = conv.mne_to_xpub(mne)

Parameters mne_to_xpub: mnemonic: str
Returns: str root public key
Example: root_public_key = conv.mne_to_xpub(mne)
Note: Mnemonic must be 12 or 24 words

Mnemonic To Wallet Import Format (WIF)

convert mnemonic words to wallet import format (WIF) compressed and uncompressed

from cryptofuzz import Convertor

conv = Convertor()

# Mnemonic
mne = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"

# WIF compressed
wif_compressed = conv.mne_to_wif(mne)

# WIF uncompressed
wif_uncompressed = conv.mne_to_wif(mne, False)

Parameters mne_to_wif: mnemonic: str, compress: bool (default: True)
Returns: str WIF
Example: wif_compressed = conv.mne_to_wif(mne), wif_uncompressed = conv.mne_to_wif(mne, False)
Note: Mnemonic must be 12 or 24 words

WIF (Wallet Import Format)

WIF To Private Key

convert WIF to private key (hex)

from cryptofuzz import Convertor

conv = Convertor()

# WIF
wif = '5KQwrPbwdL6PhX7ayB3GEpWUPaK7aRm2MV8NHWl7ZT8g2VTXYG7J'

# Private Key
privatekey = conv.wif_to_hex(wif)

WIF To Address

convert WIF to compressed and uncompressed address

from cryptofuzz import Convertor

conv = Convertor()

# WIF
wif = '5KQwrPbwdL6PhX7ayB3GEpWUPaK7aRm2MV8NHWl7ZT8g2VTXYG7J'

# compressed address
compressed_address = conv.wif_to_addr(wif)

# uncompressed address
uncompressed_address = conv.wif_to_addr(wif, False)

Block

read block data from block file (bitcoin core sync data file's) [ blk00001.dat ]

from cryptofuzz import block
import os

# path block file
path_data = os.path.join("<BITCOIN CORE SYNC BLOCK PATH>")
block_path = os.path.join(path_data, "blk00001.dat")  # first block file sync
# full block data
block_data = block.reader(block_path)

Cryptofuzz Documentation
Python Package PyPi Package
Cryptofuzz PyPi History
Cryptofuzz Description Package