Skip to content

Tool Reference#

APHIDS ships with 40+ pre-installed security tools in a Kali Linux-based container.

Port Scanning & Network#

Nmap#

Network discovery and port scanning.

nmap-scan:
  module: nmap
  target: '10.0.0.1'
  args: ['-sV', '-sC', '-T4', '-p-']
  timeout: 3600

Masscan#

High-speed port scanner for large networks.

masscan-scan:
  module: masscan
  target: '10.0.0.0/16'
  args: ['--rate', '10000', '-p1-65535']

Vulnerability Scanning#

Nuclei#

Template-based vulnerability scanner with 8000+ templates.

nuclei-scan:
  module: nuclei
  target_url: 'https://example.com'
  args: []

Nikto#

Web server vulnerability scanner.

nikto-scan:
  module: nikto
  target: 'https://example.com'
  args: []

Wapiti#

Web application vulnerability scanner.

wapiti-scan:
  module: wapiti
  target: 'https://example.com'
  args: []

Web Application Testing#

OWASP ZAP#

Comprehensive web application security scanner.

zap-scan:
  module: zap2
  target_url: 'https://example.com'
  quickscan: 'true'
  args: []

Dalfox#

XSS vulnerability scanner.

dalfox-scan:
  module: dalfox
  target: 'https://example.com'
  args: []

SQLMap#

SQL injection detection and exploitation.

sqlmap-scan:
  module: sqlmap
  target: 'https://example.com/page?id=1'
  args: ['--batch', '--level', '3']

Commix#

Command injection detection.

commix-scan:
  module: commix
  target: 'https://example.com/page?cmd=test'
  args: ['--batch']

Fuzzing & Content Discovery#

FFuF#

Fast web fuzzer.

ffuf-scan:
  module: ffuf
  target: 'https://example.com/FUZZ'
  args: ['-mc', '200,301,302']

Gobuster#

Directory and DNS brute-forcing.

gobuster-dir:
  module: gobuster
  target: 'https://example.com'
  type: dir
  args: ['-k']

Feroxbuster#

Recursive content discovery.

feroxbuster-scan:
  module: feroxbuster
  target: 'https://example.com'
  args: ['-k']

Wfuzz#

Web application fuzzer.

wfuzz-scan:
  module: wfuzz
  target_url: 'https://example.com/FUZZ'
  args: ['--hc', '404']

Katana#

Web crawler and spider.

katana-crawl:
  module: katana
  target_url: 'https://example.com'
  args: ['-d', '3']

Subdomain Enumeration#

Amass#

Attack surface mapping and subdomain enumeration.

amass-enum:
  module: amass
  tld: 'example.com'
  args: ['-passive']

Subfinder#

Fast passive subdomain discovery.

subfinder-enum:
  module: subfinder
  domain: 'example.com'
  args: []

Sublist3r#

Subdomain enumeration using search engines.

sublist3r-enum:
  module: sublist3r
  domain: 'example.com'
  args: []

DNSx#

DNS toolkit for resolution and probing.

dnsx-probe:
  module: dnsx
  domain: 'example.com'
  args: []

GetAllURLs (GAU)#

Fetch known URLs from Wayback Machine, Common Crawl, and more.

gau-urls:
  module: getallurls
  domain: 'example.com'
  args: []

HTTP Analysis#

httpx#

HTTP probing toolkit for live host detection.

httpx-probe:
  module: httpx
  target: 'example.com'
  args: ['-sc', '-td', '-title']

WhatWeb#

Web technology fingerprinting.

whatweb-scan:
  module: whatweb
  target: 'https://example.com'
  args: ['-a', '3']

WAFw00f#

Web Application Firewall detection.

wafw00f-detect:
  module: wafw00f
  target: 'https://example.com'
  args: []

Secret Detection#

Gitleaks#

Scan git repositories and directories for secrets.

gitleaks-scan:
  module: gitleaks
  target_dir: '/workspace'
  args: ['--no-git']

TruffleHog#

High-sensitivity secret detection.

trufflehog-scan:
  module: trufflehog
  target_dir: '/workspace'
  args: []

Static Analysis (SAST)#

Semgrep#

Lightweight static analysis with community rules.

semgrep-scan:
  module: semgrep
  target_dir: '/workspace'
  args: ['--config', 'auto']

Bandit#

Python source code security analysis.

bandit-scan:
  module: bandit
  target_dir: '/workspace'
  args: ['-r', '.']

Dependency & Container Scanning#

Safety#

Python dependency vulnerability scanner.

safety-check:
  module: safety
  target_dir: '/workspace'
  args: []

OWASP Dependency-Check#

Software composition analysis.

depcheck-scan:
  module: dependency_check
  target_dir: '/workspace'
  args: []

Trivy#

Container and filesystem vulnerability scanner.

trivy-scan:
  module: trivy
  target_dir: '/workspace'
  args: []

Grype#

Anchore vulnerability scanner.

grype-scan:
  module: grype
  target_dir: '/workspace'
  args: []

Authentication & API Testing#

Hydra#

Network login brute-forcing.

hydra-scan:
  module: hydra
  target: '10.0.0.1'
  args: ['-l', 'admin', '-P', '/usr/share/wordlists/rockyou.txt', 'ssh']

JWT Tool#

JWT token analysis and manipulation.

jwt-test:
  module: jwt_tool
  target: 'eyJ...'
  args: ['-a']

Protocol Analysis#

TestSSL#

SSL/TLS configuration testing.

testssl-scan:
  module: testssl
  target: 'example.com:443'
  args: []

Smuggler#

HTTP request smuggling detection.

smuggler-scan:
  module: smuggler
  target_url: 'https://example.com'
  args: []

CORScanner#

CORS misconfiguration detection.

cors-scan:
  module: corscanner
  target: 'https://example.com'
  args: []

Recon & OSINT#

ParamSpider#

Parameter discovery from web archives.

paramspider-scan:
  module: paramspider
  target: 'example.com'
  args: []

Arjun#

HTTP parameter discovery.

arjun-scan:
  module: arjun
  target: 'https://example.com'
  args: []

SearchSploit#

Exploit database search.

searchsploit-scan:
  module: searchsploit
  target: 'apache 2.4'
  args: []

Binary Analysis#

Checksec#

Binary security property analysis.

checksec-scan:
  module: checksec
  target: '/path/to/binary'
  args: []

Binwalk#

Firmware analysis and extraction.

binwalk-scan:
  module: binwalk
  target: '/path/to/firmware.bin'
  args: []

CMS#

WPScan#

WordPress vulnerability scanner.

wpscan-scan:
  module: wpscan
  target: 'https://wordpress-site.com'
  args: ['--enumerate', 'vp,vt,u']

Tool Summary#

Tool Category Target Type
nmap Port Scanning IP, hostname, CIDR
masscan Port Scanning IP, CIDR
nuclei Vuln Scanning URL
nikto Vuln Scanning URL
wapiti Vuln Scanning URL
zap2 Web App URL
dalfox XSS URL
sqlmap SQLi URL with params
commix Command Injection URL with params
ffuf Fuzzing URL with FUZZ
gobuster Discovery URL
feroxbuster Discovery URL
wfuzz Fuzzing URL with FUZZ
katana Crawling URL
amass Subdomain Domain (TLD)
subfinder Subdomain Domain
sublist3r Subdomain Domain
dnsx DNS Domain
getallurls URL Enum Domain
httpx HTTP Probe Domain, IP
whatweb Fingerprint URL
wafw00f WAF Detection URL
gitleaks Secrets Directory
trufflehog Secrets Directory
semgrep SAST Directory
bandit SAST (Python) Directory
safety Dependencies Directory
dependency_check SCA Directory
trivy Container/FS Directory
grype Container/FS Directory
hydra Auth Testing IP + service
jwt_tool JWT Testing Token
testssl TLS Testing Host:port
smuggler HTTP Smuggling URL
corscanner CORS URL
paramspider Param Discovery Domain
arjun Param Discovery URL
searchsploit Exploit DB Search term
checksec Binary File path
binwalk Firmware File path
wpscan WordPress URL