Created & Maintained by: MrAmirRezaie
- Overview
- Features
- Architecture
- Technology Stack
- Installation
- Quick Start
- Advanced Usage
- Configuration
- API Reference
- Architecture & Design Patterns
- Contributing
- Troubleshooting
- License
- Disclaimer
mr_h4shtag is an enterprise-grade, AI-driven penetration testing framework designed for comprehensive web application and infrastructure security assessment. Built with modular architecture and state-of-the-art machine learning capabilities, it provides automated vulnerability detection, intelligent exploitation, and detailed security reporting.
The framework combines advanced reconnaissance capabilities with adaptive attack strategies, utilizing offline machine learning models for accurate vulnerability assessment without requiring internet connectivity.
- AI-Driven Scanning: Reinforcement learning and adaptive scenario execution
- Offline ML Models: Advanced vulnerability prediction without internet dependency
- JavaScript Intelligence: Automatic API endpoint extraction from client-side code
- Multi-Architecture Support: REST, GraphQL, WebSocket, AJAX, JSON-RPC, SOAP, gRPC-Web, SSE
- Adaptive Defense Evasion: WAF detection and intelligent payload mutation
- Cloud Integration: Secure cloud storage for models and results
- Real-time Dashboard: Live visualization of scanning progress and threats
- Enterprise Reporting: Customizable HTML, JSON, and PDF reports
- Automated target enumeration
- JavaScript file discovery and analysis
- API endpoint extraction from minified/obfuscated code
- Service worker and manifest detection
- Source map analysis for endpoint discovery
- Subdomain enumeration with intelligent filtering
- Technology stack fingerprinting
- Cross-Site Scripting (XSS)
- SQL Injection (SQLi)
- Cross-Site Request Forgery (CSRF)
- Insecure Direct Object Reference (IDOR)
- Remote Code Execution (RCE)
- Local File Inclusion (LFI/Path Traversal)
- XML External Entity (XXE)
- Server-Side Template Injection (SSTI)
- Open Redirect
- Authentication Bypass
- API Rate Limiting Issues
- GraphQL-specific vulnerabilities
- WebSocket security flaws
- Session Hijacking
- Brute Force vulnerabilities
- CORS misconfiguration
- CSP bypass techniques
- JWT algorithm confusion
- LSTM networks for attack sequence prediction
- CNN for vulnerability pattern recognition
- GAN for payload generation
- Decision trees for vulnerability severity assessment
- Reinforcement learning (Q-learning) for adaptive scanning
- Payload effectiveness prediction
- Response classification
- Vulnerability severity scoring
- CSP security analysis
- JWT token weakness detection
- Endpoint risk assessment
- Adaptive rate limiting evasion
- WAF/IDS detection and bypass
- Custom header injection
- User-agent rotation
- Request timing randomization
- Proxy chain support (HTTP/SOCKS)
- Stealth mode for undetectable scanning
- REST API endpoint discovery
- GraphQL introspection and exploitation
- WebSocket communication analysis
- JSON-RPC method enumeration
- SOAP service discovery
- API documentation parsing (Swagger/OpenAPI)
Frontend Frameworks: React, Vue.js, Angular, Svelte, Ember, Backbone, jQuery, Alpine.js, Knockout
Backend Frameworks: Express.js, Fastify, NestJS, Koa, Spring Boot
Meta-Frameworks: Next.js, Nuxt.js, SvelteKit, Remix, Astro
- Real-time scanning dashboard
- Interactive vulnerability maps
- Attack chain visualization
- Customizable HTML reports
- JSON output for integration
- Executive summaries
- Detailed remediation guidance
- OAuth 2.0 support
- JWT token management
- Basic authentication
- Custom header authentication
- Session cookie handling
- Multi-factor authentication bypass techniques
- RESTful API server
- Command-line interface
- Programmatic Python API
- Webhook integration
- Cloud storage integration (AWS S3, Azure Blob)
┌─────────────────────────────────────────────────────────────┐
│ CLI / API Interface Layer │
│ (cli.py, api_server.py, REST endpoints) │
└──────────────────────┬──────────────────────────────────────┘
│
┌──────────────────────▼──────────────────────────────────────┐
│ Scanning Orchestration Layer │
│ (AIScanner, ScanningPipeline, ThreadPoolExecutor) │
└──────────────────────┬──────────────────────────────────────┘
│
┌──────────────┼──────────────┐
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌─────────────────┐
│ JavaScript │ │ ML Models │ │ Vulnerability │
│ Intelligence│ │ & Analysis │ │ Scanners │
│ Module │ │ │ │ │
│ │ │ - Payload │ │ - XSS, SQLi │
│ - Parser │ │ Predictor │ │ - CSRF, RCE │
│ - Crawler │ │ - Response │ │ - IDOR, LFI │
│ - Formatter │ │ Classifier │ │ - XXE, SSTI │
│ Support │ │ - Scorer │ │ - ... (20+) │
└──────────────┘ │ │ └─────────────────┘
│ - CSP/JWT │
│ Validators │
└──────────────┘
│
▼
┌──────────────────────────────────────────────────────────────┐
│ Reconnaissance & Enumeration Layer │
│ (Crawler, Service Enumeration, Payload Manager) │
└──────────────────────┬───────────────────────────────────────┘
│
┌──────────────────────▼──────────────────────────────────────┐
│ Infrastructure & Utilities Layer │
│ (Database, Logger, Config, Auth, Network Utils) │
└─────────────────────────────────────────────────────────────┘
│
┌──────────────┼──────────────┐
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Local File │ │ Cloud │ │ Real-time │
│ System │ │ Storage │ │ Dashboard │
│ │ │ │ │ │
│ Database.db │ │ AWS S3 │ │ Web Server │
│ Payloads │ │ Azure Blob │ │ Websockets │
│ Results │ │ Models │ │ Updates │
└──────────────┘ └──────────────┘ └──────────────┘
mr_h4shtag/
├── cli.py # Command-line interface
├── main.py # Entry point
├── core/
│ ├── __init__.py
│ ├── auth.py # Authentication handlers
│ ├── config.py # Configuration management
│ ├── database.py # Database operations
│ ├── logger.py # Logging system
│ └── safe.py # Security utilities
├── modules/
│ ├── api_server.py # Flask REST API server
│ ├── cloud_storage.py # Cloud integration
│ ├── crawler.py # Web crawler
│ ├── integrations.py # Third-party integrations
│ ├── payloads.py # Payload management
│ ├── reporting.py # Report generation
│ ├── threat_intel.py # Threat intelligence
│ ├── training.py # ML training pipeline
│ ├── visualization.py # Dashboard visualization
│ ├── ml_models.py # Offline ML models
│ ├── js_parser.py # JS endpoint extraction
│ ├── format_architecture_support.py # Multi-format support
│ ├── enhanced_scanner_integration.py # Unified scanning
│ ├── enhanced_js_crawler.py # Advanced JS crawling
│ ├── defensive/
│ │ └── waf.py # WAF detection & bypass
│ ├── exploitation/
│ │ └── exploit.py # Exploit execution
│ └── scanners/
│ ├── ai_scanner.py # Main AI orchestration
│ ├── xss.py # XSS vulnerability scanner
│ ├── sqli.py # SQL injection scanner
│ ├── csrf.py # CSRF scanner
│ ├── rce.py # RCE scanner
│ ├── idor.py # IDOR scanner
│ ├── lfi.py # LFI/Path traversal scanner
│ ├── xxe.py # XXE scanner
│ ├── ssti.py # SSTI scanner
│ ├── redirect.py # Open redirect scanner
│ ├── auth_bypass.py # Auth bypass scanner
│ ├── file_upload.py # File upload scanner
│ ├── session_hijack.py # Session hijacking scanner
│ ├── brute_force.py # Brute force scanner
│ ├── misconfig.py # Misconfiguration scanner
│ ├── cors.py # CORS scanner
│ ├── api_rate_limit.py # API rate limiting scanner
│ ├── graphql.py # GraphQL scanner
│ ├── websocket.py # WebSocket scanner
│ └── subdomain.py # Subdomain enumeration
├── utils/
│ ├── network.py # Network utilities
│ └── parser.py # Response parsing
├── scripts/
│ └── analyze.py # Data analysis
└── pentest_results/ # Output directory
└── scan_results.json
- Singleton Pattern: Logger, Config, Database manager
- Factory Pattern: Scanner creation, model instantiation
- Strategy Pattern: Evasion techniques, payload generation
- Observer Pattern: Event-driven dashboard updates
- Decorator Pattern: Response processing pipeline
- Chain of Responsibility: Vulnerability chain detection
- Producer-Consumer Pattern: Threaded scanning operations
- Adapter Pattern: Format and architecture support
| Component | Technology | Version | Purpose |
|---|---|---|---|
| Language | Python | 3.8+ | Core framework |
| Web Framework | Flask | 2.0+ | REST API server |
| HTTP Client | Requests | 2.28+ | HTTP operations |
| Async | Concurrent Futures | Built-in | Threading & parallelization |
| JSON Processing | json | Built-in | Data serialization |
| Configuration | YAML/JSON | Custom | Config management |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| Numeric Computing | NumPy | 1.21+ | Array operations |
| Data Analysis | Pandas | 1.3+ | Data processing |
| ML Core | Scikit-learn | 0.24+ | ML algorithms |
| Neural Networks | TensorFlow/PyTorch | Optional | Deep learning |
| Pattern Matching | Regex | Built-in | String analysis |
| NLP | NLTK | 3.6+ | Natural language processing |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| Browser Automation | Selenium | 3.141+ | Dynamic crawling |
| HTML Parsing | BeautifulSoup | 4.9+ | DOM parsing |
| CSS Parsing | cssutils | 2.4+ | Stylesheet analysis |
| JavaScript Parsing | js2py | Custom | JS code analysis |
| Protocol Support | WebSocket-client | 1.0+ | WebSocket testing |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| AWS Integration | Boto3 | 1.20+ | S3 operations |
| Azure Integration | Azure SDK | 1.0+ | Blob storage |
| Database | SQLite3 | 3.35+ | Local storage |
| Encryption | Cryptography | 3.4+ | Secure storage |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| Dashboard | Flask + WebSocket | 2.0+ | Real-time UI |
| Terminal Colors | Colorama | 0.4+ | CLI formatting |
| PDF Generation | ReportLab | 3.6+ | PDF reports |
| Data Visualization | Plotly/Matplotlib | Latest | Charts & graphs |
| HTML Templates | Jinja2 | 3.0+ | Report templates |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| Testing | Pytest | 6.2+ | Unit testing |
| Mocking | Mock | Built-in | Test mocking |
| Code Quality | Pylint/Flake8 | Latest | Code analysis |
| Type Checking | Mypy | 0.9+ | Type validation |
| Documentation | Sphinx | 4.0+ | Doc generation |
| Component | Technology | Version | Purpose |
|---|---|---|---|
| SSL/TLS | ssl | Built-in | Secure connections |
| Hashing | hashlib | Built-in | Hash operations |
| Encoding | base64 | Built-in | Data encoding |
| Random | secrets | Built-in | Secure randomization |
| JWT | PyJWT | 2.0+ | Token validation |
- Python 3.8 or higher
- pip (Python package manager)
- 2GB RAM minimum (4GB+ recommended)
- 500MB disk space
- Internet connection (for initial setup only)
- Linux/macOS/Windows (all supported)
git clone https://github.com/MrAmirRezaie/mr_h4shtag.git
cd mr_h4shtag# Linux/macOS
python3 -m venv venv
source venv/bin/activate
# Windows
python -m venv venv
venv\Scripts\activatepip install --upgrade pip
pip install -r requirements.txt# Copy example config
cp config.example.json config.json
# Edit configuration
nano config.json # or your preferred editorpython scripts/analyze.py --initpython main.py --helpIf you see the banner and help text, installation is successful! ✅
# Scan a single target
python main.py https://example.com
# Scan multiple targets
python main.py https://example.com,https://test.com
# Define output directory
python main.py https://example.com -o results/
# Set number of threads
python main.py https://example.com -t 20# Web-only scan
python main.py https://example.com --web
# Deep crawling
python main.py https://example.com --deep
# Stealth mode (slow, avoids detection)
python main.py https://example.com --stealth
# With proxy
python main.py https://example.com --proxy http://127.0.0.1:8080# AI red team scenario
python main.py https://example.com --ai red
# Black box assessment
python main.py https://example.com --ai black
# With explanation
python main.py https://example.com --ai red --explain
# Training mode (improves AI over time)
python main.py https://example.com --ai red --train# Extract API endpoints from JavaScript
python main.py https://example.com --extract-js
# Enable ML-based analysis
python main.py https://example.com --extract-js --ml-scan
# Detect architectures and frameworks
python main.py https://example.com --extract-js --detect-arch --detect-frameworks
# Export as Swagger specification
python main.py https://example.com --extract-js --export-format swagger# Start REST API server on port 5001
python main.py https://dummy.com --ai api
# Server is now running at http://localhost:5001
# Documentation: http://localhost:5001/docs# Scan only for XSS vulnerabilities
python main.py https://example.com --vuln xss
# Multiple vulnerability types
python main.py https://example.com --vuln "xss,sqli,csrf"
# High-risk vulnerabilities only
python main.py https://example.com --risk 3# Basic authentication
python main.py https://example.com --auth user:password
# Session cookie
python main.py https://example.com --cookie "session_id=abc123"
# OAuth configuration
python main.py https://example.com --auth-config oauth_config.json
# Custom headers
python main.py https://example.com --headers '{"X-API-Key": "secret"}'# With custom payload patterns
python main.py https://example.com --js-patterns custom_patterns.json
# ML-enhanced payload prediction
python main.py https://example.com --ml-scan --batch-ml 500
# Rate limiting control
python main.py https://example.com -r 100 # 100 requests/second# Custom HTML template
python main.py https://example.com --report-template custom_template.html
# All output formats
python main.py https://example.com --export-format json,csv,swagger,htmlpython main.py https://example.com \
--full \
--deep \
--ai red \
--explain \
--extract-js \
--ml-scan \
--detect-arch \
--detect-frameworks \
--all-formats \
--scan-profiles \
--threads 20 \
--rate 100 \
--timeout 30 \
-o pentest_results_2026/{
"general": {
"version": "3.2.0",
"output_dir": "pentest_results",
"default_threads": 10,
"default_rate": 5,
"default_timeout": 10
},
"ml_models": {
"enabled": true,
"cache_dir": "data/ml_cache",
"batch_size": 100,
"confidence_threshold": 0.7
},
"javascript": {
"parser_enabled": true,
"extraction_enabled": true,
"supported_frameworks": [
"react", "vue", "angular", "next", "nuxt", "svelte"
]
},
"scanning": {
"stealth_mode": false,
"adaptive_evasion": true,
"waf_detection": true,
"concurrent_scanning": true
},
"cloud": {
"aws_enabled": false,
"aws_bucket": "your-bucket",
"azure_enabled": false,
"azure_container": "your-container"
},
"reporting": {
"formats": ["json", "html", "csv"],
"detailed_exploit_chains": true,
"include_recommendations": true
}
}# Proxy settings
export HTTP_PROXY="http://proxy.example.com:8080"
export HTTPS_PROXY="https://proxy.example.com:8080"
# API credentials
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"
# Logging level
export LOG_LEVEL="INFO" # DEBUG, INFO, WARNING, ERRORfrom core.logger import Logger
from core.database import DatabaseManager
from modules.scanners.ai_scanner import AIScanner
from modules.ml_models import OfflineMLModels
from modules.js_parser import JavaScriptParser
from utils.network import NetworkUtils
# Initialize components
session = NetworkUtils.setup_session()
db = DatabaseManager('payloads.db')
# Create scanner
scanner = AIScanner(
session=session,
db_manager=db,
targets=['https://example.com'],
stealth_mode=False,
scenario='red', # red, black, gray, white, blue, all
explain=True
)
# Run scan
vulnerabilities = scanner.scan(pages=[], forms=[])
# Process results
for vuln in vulnerabilities:
print(f"Found {vuln['vulnerability']} with severity {vuln['severity']}")
print(f"Description: {vuln['description']}")
print(f"URL: {vuln['url']}")Base URL: http://localhost:5001
curl -X POST http://localhost:5001/scan \
-H "Content-Type: application/json" \
-d '{
"targets": ["https://example.com"],
"scenario": "red",
"stealth_mode": false,
"explain": true
}'curl http://localhost:5001/scan/status/<scan_id>curl http://localhost:5001/scan/results/<scan_id>Input URL
│
├─→ URL Validation & Normalization
│
├─→ Tech Stack Fingerprinting
│ ├─ Server identification
│ ├─ Framework detection
│ └─ Version enumeration
│
├─→ Reconnaissance Phase
│ ├─ Subdomain enumeration
│ ├─ Port scanning
│ ├─ Service discovery
│ └─ JavaScript analysis
│
├─→ Vulnerability Scanning
│ ├─ Payload generation
│ ├─ Request mutation
│ ├─ Response analysis
│ └─ Confidence scoring
│
├─→ ML-Based Risk Assessment
│ ├─ Payload effectiveness
│ ├─ Vulnerability severity
│ └─ Exploit feasibility
│
├─→ Exploit Chaining Analysis
│ ├─ Vulnerability correlation
│ ├─ Attack path generation
│ └─ Impact assessment
│
└─→ Report Generation
├─ Vulnerability details
├─ Remediation guidance
└─ Risk metrics
Aggressive scanning with:
- Maximum payload coverage
- Exploit chaining enabled
- WAF bypass techniques
- Extended timeout windows
Blind testing approach:
- No source code assumptions
- Maximum reconnaissance
- Trial-and-error exploitation
- Conservative risk assessment
Balanced approach:
- Moderate thoroughness
- Limited source code insight
- Efficient payload selection
- Optimized execution
Code-aware testing:
- Leverages source code access
- Targeted vulnerability hunting
- Minimal unnecessary requests
- Focused exploitation
Input Features (Endpoint Analysis)
│
├─→ Feature Extraction Layer
│ ├─ Endpoint characteristics
│ ├─ Parameter analysis
│ └─ Context extraction
│
├─→ Neural Network Processing
│ ├─ LSTM network (sequence analysis)
│ ├─ CNN network (pattern recognition)
│ ├─ Decision trees (severity scoring)
│ └─ Q-learning (strategy optimization)
│
├─→ Confidence Scoring
│ ├─ Vulnerability likelihood
│ ├─ Exploit feasibility
│ └─ Risk assessment
│
└─→ Adaptive Payload Selection
├─ High-confidence payloads first
├─ Evasion technique selection
└─ Rate limiting adjustment
-
Payload Predictor (Neural Network)
- Inputs: Endpoint URL, HTTP method, parameters
- Outputs: Effectiveness score (0.0-1.0)
- Training: Historical payload success data
-
Response Classifier (SVM)
- Inputs: HTTP response status, headers, body
- Outputs: Classification (vulnerable/patched/protected/error)
- Classes: 4 vulnerability states
-
Vulnerability Scorer (Decision Tree)
- Inputs: CVSS metrics, exploit difficulty, impact potential
- Outputs: Severity score (1.0-10.0)
- Criteria: CVSS v3.1 standard
-
CSP Analyzer (Pattern Matcher)
- Inputs: CSP header content
- Outputs: Bypass likelihood, vulnerable directives
- Patterns: 20+ known bypass techniques
-
JWT Validator (Token Analyzer)
- Inputs: JWT token
- Outputs: Vulnerabilities (algorithm confusion, weak secrets)
- Checks: Algorithm validation, signature verification
- Only test systems you are authorized to test
- Follow responsible disclosure practices
- Report findings through proper channels
- Provide adequate time for patching (90 days minimum)
- Maintain confidentiality of security data
- Use in isolated lab environments
- Implement egress filtering
- Use VPN for remote testing
- Encrypt sensitive data
- Sanitize output files before sharing
- Audit all scanning activities
- Implement proper access controls
- All scan results are stored locally by default
- Cloud integration is optional and encrypted
- Sensitive data (credentials, keys) never logged
- Database encryption supported
- GDPR-compliant data handling
# Solution: Check target is accessible
ping example.com
curl https://example.com -v
# Verify proxy settings if using proxy
echo $HTTP_PROXY# Use stealth mode
python main.py https://example.com --stealth
# Increase request delay
python main.py https://example.com --rate 1
# Rotate user agents
python main.py https://example.com --stealth --headers '{"User-Agent": "Mozilla/5.0"}'# Reduce thread count
python main.py https://example.com -t 5
# Reduce batch size for ML
python main.py https://example.com --batch-ml 10# Enable debugging
export LOG_LEVEL="DEBUG"
python main.py https://example.com --extract-js
# Check if JavaScript is obfuscated
# Use --js-patterns with custom patterns if needed# Enable verbose logging
export LOG_LEVEL="DEBUG"
# Run with explanation enabled
python main.py https://example.com --explain
# Save detailed logs
python main.py https://example.com -o debug_results/ 2>&1 | tee scan.log- ADVANCED_FEATURES.md - Detailed feature documentation
- QUICK_START.md - Quick start guide with examples
- IMPLEMENTATION_SUMMARY.md - Technical implementation details
- INTEGRATION_GUIDE.md - Integration checklist
- FEATURE_CHECKLIST.md - Complete feature verification
- API_REFERENCE.md - REST API documentation
We welcome contributions from the security community!
- Fork the repository
- Create a feature branch (
git checkout -b feature/AmazingFeature) - Make your changes following our code style
- Write tests for new functionality
- Update documentation as needed
- Commit with clear messages (
git commit -m 'Add amazing feature') - Push to branch (
git push origin feature/AmazingFeature) - Open a Pull Request with detailed description
- Follow PEP 8 guidelines
- Use type hints for all functions
- Write comprehensive docstrings
- Keep functions small and focused
- Implement proper error handling
# Run unit tests
pytest tests/
# With coverage
pytest --cov=modules tests/
# Specific test file
pytest tests/test_xss_scanner.py -v- Check if issue already exists
- Provide detailed reproduction steps
- Include system information (OS, Python version)
- Attach logs and error messages
- Use issue templates provided
Developed and Maintained by: MrAmirRezaie
- Security Research Team
- Community Contributors
- Security Testing Community
IMPORTANT: READ CAREFULLY BEFORE USING THIS SOFTWARE
1.1 Ownership This software, including all source code, documentation, and associated materials ("Software"), is the exclusive property of MrAmirRezaie and is protected by copyright law.
1.2 License Grant MrAmirRezaie grants you a limited, non-exclusive, non-transferable, revocable license to use the Software solely for authorized security testing and penetration testing purposes, subject to the terms and conditions of this License.
2.1 You SHALL NOT:
- Modify, reverse engineer, decompile, or disassemble the Software
- Create derivative works based on the Software
- Remove or alter any proprietary notices, labels, or marks
- Use the Software for any commercial purpose without written permission
- Distribute, sublicense, lease, rent, sell, or otherwise transfer the Software
- Use the Software to develop competing products or services
- Use the Software for security testing on systems you do not own or have explicit written authorization to test
- Access the Software to build similar or competing products/services
- Use the Software in any manner that violates applicable laws or regulations
2.2 Unauthorized Uses Prohibited: The Software is strictly prohibited for use in:
- Unauthorized access to computer systems
- Development of malware or hacking tools
- Industrial espionage or corporate espionage
- Unauthorized destruction of data
- Any illegal activities
- Violation of privacy rights
- Testing on production systems without authorization
- Systems owned by third parties without proper authorization
3.1 No Distribution You may NOT:
- Copy or reproduce the Software except for backup purposes
- Distribute the Software to any third party
- Post the Software on any public or private network
- Make the Software available for download
- Share code or binaries with others
- Transfer the Software to other devices
3.2 Permitted Backup You may create one backup copy for archival purposes only, provided that all proprietary notices are maintained.
4.1 Copyright All rights, title, and interest in the Software and its components are and remain the property of MrAmirRezaie. The Software is copyrighted and protected by copyright laws and international copyright treaties.
4.2 Patents & Trade Secrets The Software may contain patented technology and proprietary trade secrets. These remain the exclusive property of MrAmirRezaie.
4.3 Third-Party Components The Software may include third-party components licensed separately. Your use of these components is governed by their respective licenses.
5.1 Authorization Requirement You may only use the Software against:
- Systems you own and operate
- Systems where you have received explicit written authorization from the system owner
- Test environments specifically created for security testing
- Authorized security research environments
5.2 Proof of Authorization You agree to maintain documentation of authorization for all systems tested and provide this documentation upon request.
5.3 Compliance with Laws Your use of the Software must comply with all applicable federal, state, and international laws, including but not limited to:
- Computer Fraud and Abuse Act (CFAA)
- Digital Millennium Copyright Act (DMCA)
- General Data Protection Regulation (GDPR)
- California Consumer Privacy Act (CCPA)
- Similar laws in your jurisdiction
6.1 AS-IS BASIS The Software is provided "AS IS" without warranty of any kind, express, implied, or statutory, including but not limited to warranties of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
6.2 No Guarantees MrAmirRezaie does NOT guarantee:
- Uninterrupted operation of the Software
- Absence of errors or defects
- Specific results or outcomes
- Compatibility with all systems
- Performance metrics or standards
6.3 User Responsibility You assume all risks associated with the use of the Software, including but not limited to:
- Data loss or corruption
- System damage or downtime
- Unauthorized access
- Legal liability
- Loss of business or profits
7.1 NO LIABILITY FOR DAMAGES IN NO EVENT SHALL MRAMIREZAIE BE LIABLE FOR:
- Direct, indirect, incidental, special, consequential, or punitive damages
- Loss of data, revenue, profits, or business opportunities
- Interruption of service or business
- Loss of goodwill or reputation
- ANY OTHER DAMAGE, REGARDLESS OF THE CAUSE OR LEGAL THEORY
7.2 Limitation Cap The total liability of MrAmirRezaie under this License shall not exceed the amount paid by you for the Software (if any).
7.3 No Refunds No refunds or credits are provided for any reason, including dissatisfaction with the Software.
8.1 Termination Rights MrAmirRezaie may terminate this License immediately without notice if you:
- Violate any provision of this License
- Use the Software for unauthorized purposes
- Violate applicable laws using the Software
- Fail to comply with authorization requirements
8.2 Effect of Termination Upon termination, you must:
- Immediately cease all use of the Software
- Delete all copies in your possession
- Destroy all backup copies
- Provide written confirmation of compliance
8.3 Surviving Provisions Sections 4, 6, 7, 8.2, and 10 survive termination of this License.
9.1 Your Indemnification You agree to indemnify, defend, and hold harmless MrAmirRezaie and its officers, directors, employees, and agents from:
- Any claims, damages, or losses arising from your use of the Software
- Violations of this License or applicable laws
- Unauthorized access using the Software
- Intellectual property infringement claims
- Third-party claims of any kind related to your use
9.2 Defense Obligation You agree to defend MrAmirRezaie against any claims using counsel of MrAmirRezaie's choosing.
10.1 Governing Law This License is governed by and construed in accordance with the laws of [Your Jurisdiction], without regard to its conflict of law provisions.
10.2 Jurisdiction & Venue You consent to the exclusive jurisdiction and venue of courts located in [Your Jurisdiction] for any disputes arising from this License.
10.3 Entire Agreement This License constitutes the entire agreement between you and MrAmirRezaie regarding the use of the Software and supersedes all prior agreements, understandings, and negotiations.
10.4 Severability If any provision is deemed invalid or unenforceable, the remaining provisions continue in full force and effect.
10.5 No Waiver MrAmirRezaie's failure to enforce any provision does not constitute a waiver of that provision.
10.6 Amendments MrAmirRezaie may modify this License at any time. Continued use of the Software constitutes acceptance of amendments.
10.7 No License Grant to Patents This License grants you no rights to any patents held by MrAmirRezaie or third parties.
10.8 Export Compliance You agree to comply with all applicable export laws and regulations, including encryption exportation restrictions.
11.1 Your Responsibility You are solely responsible for:
- Obtaining all necessary authorizations before testing any systems
- Complying with all applicable laws and regulations
- Maintaining confidentiality of testing results
- Protecting the Software from unauthorized access
- Implementing appropriate security measures
11.2 Liability for Violations MrAmirRezaie is not liable for any legal consequences resulting from your misuse of the Software.
12.1 Acceptance By downloading, installing, copying, or using the Software, you acknowledge that you have:
- Read this entire License Agreement
- Fully understand all terms and conditions
- Agree to be bound by all provisions
- Understand the restrictions and limitations
- Accept full responsibility for your use
12.2 Non-Acceptance If you do not accept these terms, you must not use the Software and must delete all copies immediately.
THIS SOFTWARE IS PROVIDED FOR AUTHORIZED SECURITY TESTING ONLY
- "You" or "Your": Any individual or organization using this Software
- "Authorized": Having explicit written permission from the system owner
- "System Owner": The individual or organization with legal authority over the target system
- "Unauthorized Access": Accessing any system without authorization
1. Legal Risk Using this Software to test systems without authorization is ILLEGAL in most jurisdictions and violates the Computer Fraud and Abuse Act (CFAA) in the United States and similar laws worldwide. Violations can result in:
- Criminal prosecution
- Imprisonment
- Civil lawsuits
- Significant financial penalties
- Permanent criminal record
2. No Legal Advice This Software and its documentation do not constitute legal advice. Consult with a qualified attorney regarding the legality of security testing in your jurisdiction and specific circumstances.
3. Your Sole Responsibility It is YOUR SOLE RESPONSIBILITY to:
- Obtain proper authorization before testing any systems
- Comply with all applicable laws and regulations
- Understand the legal implications of your actions
- Maintain required documentation
- Implement appropriate protections
4. No Warranty MrAmirRezaie provides NO WARRANTY that the Software will:
- Work as intended
- Not cause harm or damage
- Be compatible with your systems
- Meet your expectations
5. Assumption of Risk By using this Software, you ASSUME ALL RISK of:
- Legal consequences
- System damage
- Data loss
- Business interruption
- Any other negative outcomes
6. No Liability MrAmirRezaie SHALL NOT BE LIABLE for any consequences, damages, or losses arising from your use of the Software, including but not limited to:
- Legal penalties
- Criminal prosecution
- Civil judgments
- System compromises
- Data breaches
- Financial losses
- Any indirect or consequential damages
7. Ethical Obligations Users must adhere to strict ethical standards:
- Be honest about testing scope
- Respect privacy and confidentiality
- Report findings responsibly
- Avoid causing unnecessary damage
- Follow responsible disclosure practices
- The Software may process sensitive data
- You are responsible for protecting this data
- Comply with GDPR, CCPA, and similar regulations
- Maintain confidentiality of findings
- Implement appropriate data protection measures
This Software may interact with third-party systems. Third-party terms, conditions, and privacy policies apply to such interactions. MrAmirRezaie is not responsible for third-party content, services, or policies.
- MrAmirRezaie may modify the Software at any time
- Updates may change functionality or behavior
- Continued use constitutes acceptance of changes
- Some changes may require new authorizations
- Issues: Use GitHub Issues for bug reports
- Discussions: Use GitHub Discussions for general questions
- Security Issues: Report privately to [security contact info]
- Commercial Licenses: Contact MrAmirRezaie for enterprise licensing
- GitHub: https://github.com/MrAmirRezaie/mr_h4shtag
- Documentation: See included markdown files
- Security Community: Follow responsible disclosure practices
mr_h4shtag is a powerful penetration testing framework designed for professional security assessments. It combines advanced reconnaissance, intelligent vulnerability detection, machine learning-based risk assessment, and comprehensive reporting.
Key Strengths:
- AI-driven adaptive scanning
- Offline ML models for accurate predictions
- Comprehensive JavaScript analysis
- Multi-architecture support
- Enterprise-grade reporting
Remember:
- Only test systems you're authorized to test
- Comply with all applicable laws
- Follow responsible disclosure practices
- Maintain confidentiality of findings
- Use ethically and responsibly
© 2026 MrAmirRezaie. All rights reserved.
For licensing inquiries, contact: [contact information]
Last Updated: February 15, 2026
Version: 3.2.0
Maintainer: MrAmirRezaie
This framework is provided for authorized security testing only. Users are solely responsible for complying with all applicable laws and regulations.