Skip to content

v2.2.0

Choose a tag to compare

View all tags
@flavsjr flavsjr released this 08 Oct 02:36
· 11 commits to master since this release
v2.2.0
4f566a1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GynToolkit v2.2.0

Install / upgrade:

pip install -U gyntoolkit

Added

  • Non-interactive, scriptable CLI: gyntoolkit <recon|scan|utils|brute|wordlist> ... prints JSON to stdout and can save a report via -o/--output + -f/--format. No subcommand still opens the interactive menu. Active attacks require --authorize.
  • Recon: DNS zone transfer (AXFR) against each authoritative NS; web content discovery (robots.txt/sitemap/security.txt + built-in path wordlist); full Shodan host lookup via api_keys.shodan (falls back to the key-free InternetDB hint). All reachable from both the menu and the CLI.
  • Brute: native CUPP-style wordlist generator (offline) — case/leet variants, years, common suffixes and term combinations.
  • Export: CSV and Markdown report formats (alongside JSON and HTML).
  • Config: scan.concurrency and api_keys.nvd.

Changed

  • Scan port probing is bounded by scan.concurrency (a full scan no longer spawns 65k tasks at once).
  • CVE lookup is version-aware: parses product + version from the banner and matches by CPE (virtualMatchString), with keyword fallback; NVD calls are rate-limited and deduplicated per banner.
  • Banner grabbing reads a service greeting first and sends a valid Host header.

Fixed

  • HTTP Basic brute force now treats only 2xx as success (was any status except 401/403, so 404/5xx were false positives).
  • Authorization confirmation word is localized (AUTHORIZE/AUTORIZO).
  • http_fingerprint no longer prints InsecureRequestWarning to the UI.

Full changelog: https://github.com/flavsjr/gyntoolkit/blob/master/CHANGELOG.md

Assets 2
Loading