Target (FQDN / IP / CIDR)
        │
        ▼
   hunt.py  ◄── brain.py (AI analysis + multi-provider LLM)
        │         └── agent.py (autonomous ReAct loop)
        │
   ┌────┴────────────────────────────────────┐
   │                                         │
   ▼                                         ▼
recon.sh                               scanner.sh
  │                                       │
  ├── subfinder / assetfinder             ├── SQLi (sqlmap + verifier)
  ├── amass / dnsx                        ├── XSS (dalfox)
  ├── httpx (tech detect)                 ├── SSTI (math-canary probes)
  ├── katana / waybackurls / gau          ├── RCE (Log4Shell, Tomcat, JBoss)
  ├── nuclei (CVE templates)              ├── File upload bypass
  ├── nmap / naabu (port scan)            ├── Cloud exposure (Firebase, K8s, Docker)
  ├── subzy (takeover check)              ├── Framework exposure (Spring, GraphQL)
  └── trufflehog / gitleaks (JS secrets)  └── Race conditions (xargs -P 20)
        │
        ▼
  prioritize.py (CVE risk scoring)
        │
        ▼
   brain.py (AI triage)
        │
        ▼
   reporter.py
     ├── vapt_report.html  (Burp Suite-style, self-contained)
     └── vapt_report.md    (Markdown summary)

hunt.py — VAPT Orchestrator

Target input:
  --target example.com          FQDN
  --target 192.168.1.100        Single IP
  --target 10.0.0.0/24          CIDR range (nmap ping sweep first)

Scan modes:
  --quick                       Faster scan, fewer checks
  --full                        All checks including race conditions
  --autonomous                  AI-driven autonomous assessment
  --scope-lock                  Test exact target only (no subdomain expansion)

Selective phases:
  --recon-only                  Recon only
  --scan-only                   Scan only (requires prior recon)
  --js-scan                     JS analysis + secret extraction
  --param-discover              Parameter discovery (Arjun + ParamSpider)
  --api-fuzz                    API endpoint brute (Kiterunner)
  --secret-hunt                 TruffleHog + GitHound
  --cors-check                  CORS misconfiguration check
  --exploit                     CMS exploit chains (Drupal, WordPress)
  --rce-scan                    RCE: Log4Shell, Tomcat, JBoss, Spring
  --sqlmap                      sqlmap on discovered SQLi candidates
  --jwt-audit                   JWT algorithm confusion + weak secret crack

AI options:
  --no-brain                    Skip AI analysis (tools only)
  --brain-only                  AI analysis on existing recon data
  --brain-next                  Ask AI: what is the highest-impact next action?

Reporting:
  python3 reporter.py <findings_dir> [--client NAME] [--consultant NAME] [--title TITLE] [--target DOMAIN]

Utilities:
  --repair-tools                Auto-install missing tools
  --status                      Show current assessment progress
  --oob-setup                   Configure interactsh OOB token
  --resume SESSION_ID           Resume a previous session

Autopilot API VAPT (autopilot_api_hunt.py):
  --base-url URL                API base URL (required)
  --auth-creds user:pass        Primary account credentials (required)
  --auth-creds-b user:pass      Second account for IDOR/priv esc testing
  --login-url PATH              Login endpoint path (default: sign-in/)
  --frontend-url URL            Frontend URL for JS bundle scraping
  --with-brain                  Enable brain supervisor (local LLM)
  --rate-limit N                Max requests/sec (default: 5)
  --output DIR                  Output directory for findings

Discover endpoints (JS bundle + Django debug + crawl)
  → Brain categorizes endpoints and creates prioritized test plan
  → Loop:
      Execute top-priority phase
      → Brain reviews findings
      → Brain decides: CONTINUE / INJECT / SKIP / PIVOT
      → Modify test queue based on decision
  → Chain building → Brain validation (FP removal) → Report

vikramaditya/
├── hunt.py                  Main orchestrator (infrastructure VAPT)
├── autopilot_api_hunt.py    Brain-supervised API VAPT engine
├── brain.py                 AI analysis engine (Gemma 4, Ollama, MLX, Claude, OpenAI, Grok)
├── agent.py                 Autonomous ReAct agent
├── auth_api_tester.py       Authenticated API broken access control
├── api_idor_scanner.py      Generic REST IDOR scanner
├── business_logic_tester.py Score manipulation, rate limits, pagination
├── oauth_tester.py          OAuth/OIDC security testing
├── auth_utils.py            JWT helper, rate limiter, auth session
├── finding_validator.py     7-Question Gate + never-submit list
├── chain_builder.py         A→B exploit chain discovery
├── scope_checker.py         Deterministic scope enforcement
├── recon.sh                 Subdomain + URL discovery
├── scanner.sh               Vulnerability scanner
├── reporter.py              Report generator (HTML + Markdown + inline PoC)
├── memory/                  Hunt journal, pattern DB, audit log
├── prioritize.py        CVE risk scoring
├── api_audit.py         OpenAPI/REST API auditing
├── cve.py               CVE matcher
├── fuzzer.py            Smart logic fuzzer
├── validate.py          Finding validator (4-gate)
├── intel.py             CVE + advisory intel
├── mindmap.py           Attack surface mapper
├── targets.py           Target management
├── idor.py              IDOR scanner
├── idor_mutator.py      GraphQL mutation IDOR
├── oauth.py             OAuth misconfiguration tester
├── race.py              Race condition tester
├── payloads.py          Payload generator
├── probe.py             HTTP prober
├── browser_recon.js     Browser-side recon (Playwright)
├── evasion.py           WAF bypass helpers
├── zendesk_idor.py      Zendesk-specific IDOR
├── setup.sh             Tool installer
├── sqli_verify.sh       SQLi verification
├── procs.sh             Pipeline process monitor
├── requirements.txt     Python dependencies
├── config.example.json  Configuration template
├── skills/              Skill definitions
├── wordlists/           Custom wordlists
├── recon/               Scan output (gitignored)
├── findings/            Validated findings (gitignored)
└── reports/             Generated reports (gitignored)