Listen to this Post
Luke (hakluke) Stephens, Founder/CEO at Haksec and HackerContent, has developed several powerful hacking tools for reconnaissance, bug bounty hunting, and web application security. Below are the tools along with their GitHub links:
- hakrawler – A fast web crawler for discovering endpoints and assets.
🔗 https://lnkd.in/gwseKUR -
hakip2host – Finds hostnames associated with IP addresses.
🔗 https://lnkd.in/gNuAWziV -
hakoriginfinder – Bypasses WAFs using the Levenshtein algorithm to uncover origin hosts.
🔗 https://lnkd.in/gB_ptaxD -
haktrails – Command-line client for SecurityTrails (bug bounty recon).
🔗 https://lnkd.in/gJnZk9JM -
hakcheckurls – Checks HTTP response codes for a list of URLs.
🔗 https://lnkd.in/gKvKunFS
6. hakjoke – Fetches jokes from icanhazdadjoke.com.
- hakfindinternaldomains – Identifies hostnames resolving to internal IPs (useful for SSRF).
🔗 https://lnkd.in/gwekaNKV -
haklistgen – Converts unstructured data into brute-force wordlists.
🔗 https://lnkd.in/gKRzCk8R -
hakurlencode – URL encodes/decodes from the command line.
🔗 https://lnkd.in/g6i9XRW6 -
hakcertstream – Monitors new SSL certificate registrations via CLI.
🔗 https://github.com/hakluke/hakcertstream
You Should Know:
Practical Usage of These Tools
1. hakrawler – Fast Web Crawling
echo "https://example.com" | hakrawler -subs -d 2
– Crawls `example.com` including subdomains (-subs) with depth 2 (-d 2).
2. hakip2host – Reverse IP Lookup
hakip2host -ip 8.8.8.8
– Finds all hostnames associated with Google’s DNS (8.8.8.8).
3. hakoriginfinder – Bypassing WAFs
hakoriginfinder -url https://target.com
– Helps identify origin servers behind Cloudflare or other WAFs.
4. haktrails – SecurityTrails CLI
haktrails -domain example.com -subdomains
– Retrieves subdomains of `example.com` via SecurityTrails API.
5. hakcheckurls – HTTP Status Checker
cat urls.txt | hakcheckurls -threads 20
– Checks HTTP responses for URLs in `urls.txt` with 20 threads.
6. hakfindinternaldomains – SSRF Helper
hakfindinternaldomains -list domains.txt
– Detects internal IP resolutions in domains.txt.
7. haklistgen – Wordlist Generator
cat data.txt | haklistgen -min 5 -max 12 > wordlist.txt
– Creates a wordlist from `data.txt` with words between 5-12 chars.
8. hakurlencode – Quick URL Encoding
echo "name=test&value=123" | hakurlencode
– Outputs name%3Dtest%26value%3D123.
9. hakcertstream – SSL Monitoring
hakcertstream -domains "example.com"
– Alerts on new SSL certs for example.com.
What Undercode Say:
These tools are essential for penetration testers, bug bounty hunters, and cybersecurity professionals. Automating reconnaissance with `hakrawler` and `haktrails` can save hours, while `hakoriginfinder` helps bypass security measures. Always use these ethically—unauthorized testing is illegal.
For further learning:
Expected Output:
hakrawler -url https://example.com -subs | tee crawled_urls.txt
References:
Reported By: Hakluke Github – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
