openhackai / OpenHack

What it does

• Recon. reads the code, builds a project model
• Hunters. multiple specialized agents look for different vulnerability classes (input validation, access control, data handling, …)
• Feature hunters. deeper passes on specific risk categories (XSS rendering, raw SQL, command exec, etc.)
• Validators. re-read the suspect code to confirm or reject each candidate finding
• Sandbox verification (/verify sandbox) *(Beta. requires Docker)* — spins up your app in a Docker container and attempts to exploit each finding with live HTTP requests. Findings that are successfully exploited get a ✓ mark.