Check which external pentesting tools are installed and available.

Returns a catalog of all supported tools with their installation status, paths, and versions. Useful for diagnosing missing dependencies before starting a pentest engagement.

Validate whether a target is allowed for scanning.

Checks the target against:

1. Input validation (IP, hostname, CIDR, URL format)

2. The configured allowlist (tengu.toml [targets].allowed_hosts)

3. The blocklist (tengu.toml [targets].blocked_hosts + built-in defaults)

Returns validation status and any restrictions that apply.

Scan a target for open ports, services, and versions using Nmap.

IMPORTANT: Available parameters are: target, ports, scan_type, timing, os_detection, scripts, timeout. There is NO 'flags' parameter — use scan_type for scan technique and scripts for NSE scripts.

Args: target: IP address, hostname, CIDR range, or URL to scan. ports: Port specification (e.g. "80", "22-443", "22,80,443", "1-65535"). scan_type: Scan technique — syn (stealthy), connect (no root), udp, version (service detection), ping (host discovery), fast (top 100). timing: Nmap timing template T0 (paranoid) to T5 (insane). Default: T3. os_detection: Enable OS fingerprinting (-O). Requires root/sudo. scripts: Comma-separated nmap script names (e.g. "http-title,ssl-cert"). timeout: Override default scan timeout in seconds.

Returns: Structured scan results with hosts, ports, services, and raw nmap output.

Note: - SYN scan (-sS) requires root/sudo privileges. - OS detection (-O) requires root/sudo privileges. - Target must be in tengu.toml [targets].allowed_hosts.

Scan a network range for open ports at high speed using Masscan.

Masscan is significantly faster than Nmap for large networks but produces less detailed results (no service detection). Ideal for initial port discovery across large IP ranges.

Args: target: IP address, hostname, or CIDR range (e.g. "192.168.1.0/24"). ports: Port specification (e.g. "80", "22-443", "22,80,443"). rate: Packets per second. Keep low (< 10000) for stealth. Warning: High rates may trigger IDS/IPS alerts or crash routers. timeout: Override default scan timeout in seconds.

Returns: Structured results with discovered open ports per host.

Note: - Masscan requires root/sudo privileges to send raw packets. - Use lower rates (100-1000) for stability and stealth. - Target must be in tengu.toml [targets].allowed_hosts.

Enumerate subdomains passively using Subfinder.

Queries multiple passive sources (certificate transparency logs, DNS datasets, APIs) to discover subdomains without directly probing the target.

Args: domain: Target domain (e.g. "example.com"). sources: Optional list of specific sources to query (e.g. ["crtsh", "hackertarget", "censys"]). Leave empty to use all configured sources. timeout: Override default timeout in seconds.

Returns: List of discovered subdomains with metadata.

Note: - Passive enumeration only — does not send requests to the target domain. - Some sources require API keys configured in ~/.config/subfinder/config.yaml. - Target domain must match an entry in tengu.toml [targets].allowed_hosts.

Query DNS records for a domain.

Performs DNS lookups for the specified record types using dnspython. No external process is spawned — this is a pure-Python DNS client.

Args: domain: Target domain to query (e.g. "example.com"). record_types: List of DNS record types to query. Defaults to all common types: A, AAAA, MX, NS, TXT, CNAME, SOA. nameserver: Optional custom DNS resolver IP (e.g. "8.8.8.8"). Defaults to system resolver.

Returns: DNS records grouped by type with values and TTLs.

Perform a WHOIS lookup for a domain or IP address.

Queries WHOIS databases to retrieve registration information including registrar, creation/expiry dates, nameservers, and contact details.

Args: target: Domain name (e.g. "example.com") or IP address.

Returns: WHOIS registration data including registrar, dates, nameservers, and contacts.

Note: - Uses python-whois library (no subprocess, no shell injection risk). - Some registrars rate-limit WHOIS queries — be mindful of frequency. - Target must be in tengu.toml [targets].allowed_hosts.

Enumerate subdomains and map attack surface using Amass.

Args: domain: Target domain to enumerate (e.g. example.com). mode: Enumeration mode — passive (no direct interaction), active (DNS brute-force + zone walk). timeout: Override default scan timeout in seconds.

Returns: Structured results with discovered subdomains, IPs, and ASN info.

Note: - Active mode sends DNS queries directly to target's nameservers. - Target must be in tengu.toml [targets].allowed_hosts.

Perform DNS reconnaissance using DNSRecon.

Supports zone transfers, DNS brute-force, PTR lookups, and standard record enumeration.

Args: domain: Target domain to enumerate. scan_type: Scan type — std (standard records), brt (brute-force), axfr (zone transfer), rvl (reverse lookup), goo (Google enumeration). timeout: Override default timeout in seconds.

Returns: DNS records, zone transfer results, and raw output.

Note: - Zone transfer (axfr) may fail if target nameservers are properly configured. - Target must be in tengu.toml [targets].allowed_hosts.

Check for subdomain takeover vulnerabilities using Subjack.

Identifies dangling DNS records pointing to unclaimed third-party services (GitHub Pages, S3, Heroku, Netlify, Azure, etc.).

Args: domain: Target domain to check (e.g. example.com). subdomains_file: Path to file with subdomain list (one per line). If not provided, uses common wordlist. threads: Number of concurrent threads (default 20, max 100). timeout: Override default timeout in seconds.

Returns: List of potentially vulnerable subdomains with CNAME targets and service names.

Note: - A finding means the CNAME points to an unclaimed resource. - Manual verification required before claiming/reporting. - Target must be in tengu.toml [targets].allowed_hosts.

Capture web screenshots for visual documentation using Gowitness.

Useful for documenting web interfaces, login pages, and web-based findings in penetration test reports.

Args: target: URL (single mode) or path to URL list file (file mode) or CIDR (scan mode). mode: Screenshot mode — single (one URL), file (URL list), scan (CIDR range), nmap (nmap XML). output_dir: Directory to save screenshots (default /tmp/gowitness). timeout: Override default timeout in seconds.

Returns: Screenshot results with file paths, titles, status codes, and technologies detected.

Note: - Requires Chrome/Chromium installed on the system. - Screenshots are saved locally to output_dir. - Target must be in tengu.toml [targets].allowed_hosts.

Mirror a website locally for offline analysis using HTTrack.

Downloads the full website (HTML, JS, CSS, images) to a local directory, preserving structure for offline inspection. Useful for:

• Forensic snapshots of a target's web surface

• Offline search for hardcoded secrets, API keys, dev comments

• Mapping application structure without active interaction

Args: target: URL of the site to mirror (e.g. http://example.com). depth: Crawl depth (1–5). Default 2. Capped at 5 to prevent runaway crawls. output_dir: Local directory to save the mirror (default /tmp/httrack). max_size: Maximum download size in MB (default 100, max 500). include_assets: Whether to download CSS/JS/images (default True). timeout: Override default scan timeout in seconds.

Returns: Mirror results with download stats, file type breakdown, and interesting findings.

Note: - HTTrack must be installed on the system (apt install httrack / brew install httrack). - Target must be in tengu.toml [targets].allowed_hosts. - Set depth=1 for a shallow mirror of the top-level page only.

Crawl a web application to discover endpoints and URLs using Katana.

Katana is a modern, fast web crawler by ProjectDiscovery that supports JavaScript rendering, form submission, and scope-aware crawling.

Args: target: Target URL to crawl (e.g. "https://example.com"). depth: Maximum crawl depth (default 3, max 10). concurrency: Number of concurrent requests (default 10, max 50). js_crawl: Enable JavaScript crawling for SPA applications. timeout: Override scan timeout in seconds.

Returns: Discovered URLs, endpoints, and technology indicators.

Note: - Target must be in tengu.toml [targets].allowed_hosts.

Probe HTTP services on a host or URL list using ProjectDiscovery httpx.

httpx performs fast HTTP probing with optional technology detection, status code enumeration, and title extraction. Useful for quickly triaging large host lists after subdomain enumeration.

Args: target: Target URL or host to probe (e.g. "https://example.com"). threads: Number of concurrent threads (default 50, max 200). detect_tech: Enable technology detection (default True). timeout: Override scan timeout in seconds.

Returns: HTTP probe results with status codes, titles, and detected technologies.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - Uses ProjectDiscovery httpx CLI tool (not the Python httpx library).

Enumerate SNMP information from a network device using snmpwalk.

SNMP (Simple Network Management Protocol) exposes device configuration, interface info, routing tables, and system information on routers, switches, printers, and other network devices.

Args: target: Target IP address or hostname. community: SNMP community string (default "public"). version: SNMP version — "1", "2c" (default), or "3". oid: OID to walk (default "." for entire MIB). timeout: Override scan timeout in seconds.

Returns: SNMP walk results with OID-value pairs and system information.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - SNMP version 3 requires additional authentication parameters.

Perform ultra-fast port scanning using RustScan.

RustScan can scan all 65535 ports in seconds by using async I/O, then passes discovered open ports to Nmap for service detection.

Args: target: Target IP address or hostname. ports: Port specification (e.g. "80,443" or "1-65535"). batch_size: Number of ports to scan per batch (default 1500, max 65535). timeout: Override scan timeout in seconds.

Returns: Discovered open ports and basic service information.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - High batch_size values may trigger IDS/IPS alerts.

Scan a target for vulnerabilities using Nuclei template engine.

Nuclei uses YAML templates to detect vulnerabilities, misconfigurations, exposed panels, CVEs, and more across web applications and network services.

Args: target: URL or host to scan (e.g. "https://example.com"). templates: Specific template paths or directories to use (e.g. ["cves/", "misconfiguration/", "exposures/"]). Defaults to all community templates. severity: Filter by severity levels. Defaults to configured levels (medium, high, critical). tags: Filter templates by tags (e.g. ["sqli", "xss", "oast"]). exclude_tags: Tags to exclude (e.g. ["dos", "fuzz"]). rate_limit: Maximum requests per second. Default: 150. timeout: Override scan timeout in seconds.

Returns: List of findings with template ID, name, severity, matched URL, and evidence.

Scan a web server for vulnerabilities using Nikto.

Nikto checks for outdated server software, dangerous files/programs, default credentials, and server misconfigurations.

Args: target: URL or host to scan. tuning: Nikto tuning options to control scan types: 0=File Upload, 1=Interesting File, 2=Misconfiguration, 3=Information Disclosure, 4=Injection, 5=Remote File Retrieval, 6=Denial of Service, 7=Remote File Retrieval (server), 8=Command Execution, 9=SQL Injection, a=Authentication Bypass, b=Software Identification, c=Remote Source Inclusion, x=Reverse Tuning. Default "x6" = everything except DoS. ssl: Force SSL mode. port: Target port (auto-detected from URL if not specified). timeout: Override scan timeout in seconds.

Returns: List of vulnerability findings with descriptions and references.

Fuzz directories, files, and endpoints using FFUF.

Uses a wordlist to discover hidden files, directories, APIs, and endpoints that are not linked from the application's public pages.

The URL must contain the placeholder 'FUZZ' where substitution occurs. If 'FUZZ' is not in the URL, it is automatically appended to the path.

Args: url: Target URL with optional FUZZ placeholder (e.g. "https://example.com/FUZZ" or "https://example.com/api/FUZZ.php"). wordlist: Path to wordlist file. Defaults to the configured default. method: HTTP method to use. filter_codes: HTTP response codes to exclude from results (e.g. [404, 403] to hide not-found and forbidden). match_codes: Only show responses with these codes (e.g. [200, 301, 302]). extensions: File extensions to append to each word (e.g. [".php", ".html", ".bak"]). threads: Number of concurrent threads. Default: 40. rate: Requests per second limit (0 = unlimited). headers: Additional HTTP headers (e.g. {"Cookie": "session=abc123"}). timeout: Override scan timeout in seconds.

Returns: Discovered paths/endpoints with response codes, sizes, and redirect targets.

Analyze HTTP security headers for a web application.

Checks for the presence and correctness of critical security headers and flags information disclosure headers that should be removed.

Args: url: Target URL to analyze. follow_redirects: Follow HTTP redirects to the final destination. timeout_seconds: HTTP request timeout in seconds.

Returns: Security header analysis with scores, grades, and recommendations.

Note: - Uses httpx directly (no subprocess). Pure Python implementation. - Performs a single GET request to the target URL.

Test a URL for CORS (Cross-Origin Resource Sharing) misconfigurations.

Sends requests with various Origin headers to detect if the server blindly reflects origins, allows null origins, or permits arbitrary cross-origin requests with credentials.

Common CORS vulnerabilities detected:

• Origin reflection (server echoes back any Origin header)

• Null origin acceptance (dangerous with sandboxed iframes)

• Subdomain wildcard bypass (e.g. evil.target.com accepted)

• Credentials with wildcard (Access-Control-Allow-Credentials: true + *)

• Trusted origin misconfiguration (pre-domain spoofing)

Args: url: Target URL to test. custom_origins: Additional origin values to test. timeout_seconds: HTTP request timeout in seconds.

Returns: CORS test results with identified vulnerabilities and evidence.

Analyze SSL/TLS configuration of a host using sslyze.

Checks for:

• Supported protocol versions (SSLv2/3, TLS 1.0-1.3)

• Weak/deprecated cipher suites

• Certificate validity and expiration

• Known vulnerabilities (Heartbleed, ROBOT, POODLE, DROWN, BEAST)

• Certificate chain trust issues

• OCSP stapling support

• Forward secrecy support

Args: host: Target hostname or IP address. port: Target port. Default: 443. timeout: Scan timeout in seconds.

Returns: Comprehensive SSL/TLS analysis with grade, vulnerabilities, and recommendations.

Note: - Uses sslyze Python library directly (no subprocess). - May take 30-60 seconds to complete a full analysis.

Brute-force directories, files, and virtual hosts using Gobuster.

Args: target: Target URL (e.g. https://example.com). mode: Gobuster mode — dir (directory/file), vhost (virtual hosts), dns (subdomains). wordlist: Path to wordlist file. extensions: Comma-separated file extensions to check (e.g. "php,html,txt"). threads: Number of concurrent threads (default 10, max 50). status_codes: Comma-separated HTTP status codes to show (default: 200,204,301,302,307,401,403). timeout: Override default timeout in seconds.

Returns: Discovered paths/vhosts with status codes and content lengths.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - Rate limiting applies — use threads <= 10 for stealth.

Scan a WordPress site for vulnerabilities, plugins, themes, and users using WPScan.

Args: url: WordPress site URL (e.g. https://example.com). enumerate: Enumeration options — vp (vulnerable plugins), vt (vulnerable themes), u (users), ap (all plugins), at (all themes), cb (config backups), dbe (db exports). api_token: WPScan API token for vulnerability database lookups (optional but recommended). threads: Number of concurrent threads (default 5, max 20). timeout: Override default timeout in seconds.

Returns: WordPress version, vulnerable plugins/themes, user enumeration, and security issues.

Note: - Free WPScan API token at https://wpscan.com provides 75 daily requests. - Target must be in tengu.toml [targets].allowed_hosts.

Comprehensive SSL/TLS analysis using testssl.sh.

Complements sslyze with additional checks including BEAST, BREACH, CRIME, LUCKY13, POODLE, HEARTBLEED, CCS injection, ROBOT, and more.

Args: host: Target hostname or IP address. port: Target port (default 443). severity_threshold: Minimum severity to report — INFO, LOW, MEDIUM, HIGH, CRITICAL. timeout: Override default timeout in seconds.

Returns: SSL/TLS findings including protocol support, cipher strength, and known vulnerabilities.

Note: - testssl.sh executable or testssl must be in PATH. - Target must be in tengu.toml [targets].allowed_hosts.

Detect Web Application Firewalls (WAF) protecting a target using WafW00f.

Identifies WAF products (Cloudflare, AWS WAF, ModSecurity, etc.) before active scanning to avoid false negatives and detection.

Args: target: Target URL to check (e.g. "https://example.com"). detect_all: If True, try to detect all WAFs instead of stopping at first match. timeout: Override scan timeout in seconds.

Returns: WAF detection results with product names, confidence, and detection evidence.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - Run this before active scans to understand defensive posture.

Perform recursive content discovery using Feroxbuster.

IMPORTANT: The URL parameter is named 'target' (not 'url'). Pass the full URL with scheme: target="https://example.com".

Unlike Gobuster or FFuf, Feroxbuster recursively discovers directories, automatically crawling into discovered paths to find nested content.

Args: target: Target URL to scan (e.g. "https://example.com"). MUST be named 'target' (not 'url'). wordlist: Path to wordlist file. extensions: Comma-separated file extensions (e.g. "php,html,txt"). threads: Number of concurrent threads (default 50, max 100). depth: Maximum recursion depth (default 4, max 10). timeout: Override scan timeout in seconds.

Returns: Discovered URLs with status codes, content lengths, and word counts.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - Feroxbuster recurses by default — use depth to control scope.

Gather OSINT data (emails, subdomains, IPs) using theHarvester.

Queries multiple public data sources without directly interacting with the target.

Args: domain: Target domain to investigate. sources: Comma-separated data sources. Available: bing, google, crtsh, certspotter, dnsdumpster, hackertarget, rapiddns, sublist3r, shodan (needs API key). limit: Maximum number of results per source. timeout: Override default timeout in seconds.

Returns: Emails, subdomains, IP addresses, and hosts discovered from OSINT sources.

Note: - Passive OSINT — does NOT interact directly with the target. - Target must be in tengu.toml [targets].allowed_hosts.

Query Shodan for exposed services, vulnerabilities, and device information.

Args: target: IP address or domain to look up (for host queries). query_type: Query type — host (single IP lookup), search (Shodan search query). query: Shodan search query string (for search mode, e.g. "apache country:BR"). limit: Maximum number of search results to return.

Returns: Host information, open ports, detected vulnerabilities, and banner data.

Note: - Requires TENGU_SHODAN_API_KEY environment variable or shodan_api_key in tengu.toml. - Passive OSINT — queries Shodan's database, does NOT interact with target directly. - Target must be in tengu.toml [targets].allowed_hosts.

Detect web technologies, CMS, frameworks, and WAF using WhatWeb.

Args: target: Target URL to fingerprint (e.g. https://example.com). aggression: Aggression level 1-4 (1=passive/stealthy, 3=aggressive, 4=heavy). timeout: Override default timeout in seconds.

Returns: Detected technologies, plugins, versions, and confidence levels.

Note: - Aggression level 1 sends a single request (safe for production). - Aggression 3+ sends many requests and may trigger WAF/IDS alerts. - Target must be in tengu.toml [targets].allowed_hosts.

Detect typosquatting and phishing domains using dnstwist.

Generates permutations of a domain name (homoglyphs, additions, deletions, substitutions) and checks which ones are registered, helping identify potential phishing or brand abuse domains.

Args: domain: Target domain to check (e.g. "example.com"). threads: Number of DNS query threads (default 10). registered_only: Only return registered/live domains (default True). check_mx: Check MX records to identify phishing-ready domains. timeout: Override scan timeout in seconds.

Returns: List of suspicious domain permutations with registration status.

Note: - Target domain must be in tengu.toml [targets].allowed_hosts. - Passive OSINT — only sends DNS queries, no HTTP requests.

Test a URL for SQL injection vulnerabilities using SQLMap.

SQLMap automates the detection and exploitation of SQL injection flaws. This tool requires explicit authorization — SQL injection testing can cause database errors and potential data exposure.

IMPORTANT: The target URL parameter is named 'url', not 'target'. Always call this tool as: sqlmap_scan(url="http://...", ...)

Args: url: Full target URL including query string to test. MUST be named 'url' (not 'target'). Example: "http://example.com/search?q=test" method: HTTP method: GET or POST. data: POST data string (e.g. "username=admin&password=test"). parameter: Specific parameter to test (e.g. "q" or "username"). If empty, tests all parameters. headers: Additional HTTP headers as a dict (e.g. {"Authorization": "Bearer token"}). Useful for testing authenticated endpoints. level: Detection aggressiveness level (1-5). Default: 1 (safe). Levels 3+ significantly increase request count. risk: Risk of tests (1-3). Default: 1 (safe). Risk 2+ includes boolean-based tests; Risk 3 includes heavy OR-based tests. dbms: Force specific DBMS (e.g. "mysql", "postgresql", "mssql"). Leave empty for auto-detection. technique: SQLi technique(s) to test: B(oolean-blind), E(rror-based), U(nion-query), S(tacked-queries), T(ime-blind), Q(inline-queries). Can be combined: "BT" = boolean + time-blind. Default: all techniques. prefix: Injection prefix string to close the original SQL expression (e.g. "'))" for LIKE expressions like LIKE '%q%')). Crucial for complex injection points that sqlmap can't auto-detect. suffix: Injection suffix string appended after payload (e.g. "--"). tamper: Tamper script name(s) to bypass WAF/filters (e.g. "space2comment", "between,randomcase"). batch: Run in non-interactive batch mode (recommended: True). dump: Dump contents of affected database tables (requires confirmed injection). enum_tables: Enumerate database tables (--tables flag). enum_users: Enumerate database users (--users flag). enum_dbs: Enumerate available databases (--dbs flag). sql_query: Execute a custom SQL SELECT query via the injection point (e.g. "SELECT email,password FROM Users"). Useful when --tables/--dump fail due to JSON response filtering. timeout: Override scan timeout in seconds.

Returns: SQL injection test results including vulnerable parameters, DBMS info, and optionally dumped data or enumerated tables/users/databases.

Note: - Level > 2 or Risk > 2 requires careful consideration — may cause errors. - Target must be in tengu.toml [targets].allowed_hosts. - This tool requires explicit human authorization for exploitation. - dump/enum_* flags require a confirmed injection point.

Test for Cross-Site Scripting (XSS) vulnerabilities using Dalfox.

IMPORTANT: The target parameter is named 'url' (not 'target'). Always call as: xss_scan(url="https://example.com/search?q=test")

Dalfox is a powerful XSS scanner that detects reflected, stored, and DOM-based XSS vulnerabilities using pattern analysis and DOM parsing.

Args: url: Target URL to test (e.g. "https://example.com/search?q=test"). MUST be named 'url' (not 'target'). parameter: Specific parameter to focus testing on. If empty, tests all parameters found in the URL. cookie: Session cookie for authenticated testing (e.g. "session=abc123; csrf_token=xyz"). header: Additional HTTP header (e.g. "Authorization: Bearer token"). method: HTTP method to use: GET or POST. Default: GET. data: POST body data for testing POST endpoints (e.g. "q=FUZZ&other=value" — use FUZZ as the injection placeholder, or leave as plain value and dalfox will find injection points). timeout: Override scan timeout in seconds.

Returns: XSS test results with vulnerable parameters, payload types, and evidence.

Test a URL for OS command injection vulnerabilities using Commix.

IMPORTANT: The target parameter is named 'url' (not 'target'). Always call as: commix_scan(url="https://example.com/ping?host=test")

Commix (command injection exploiter) automates the detection of OS command injection flaws in web applications. Requires explicit authorization.

Args: url: Target URL to test (e.g. "https://example.com/ping?host=test"). MUST be named 'url' (not 'target'). method: HTTP method: GET or POST. data: POST data string (e.g. "param=value"). level: Detection level (1-3). Default: 1. timeout: Override scan timeout in seconds.

Returns: Command injection test results with vulnerable parameters and evidence.

Note: - This tool requires explicit authorization from the target owner. - Target must be in tengu.toml [targets].allowed_hosts.

Scan a URL for CRLF injection vulnerabilities using CRLFuzz.

CRLF injection (HTTP Response Splitting) allows attackers to inject arbitrary HTTP headers or split HTTP responses, potentially leading to XSS, cache poisoning, or session fixation.

Args: url: Target URL to scan (e.g. "https://example.com/redirect?url=test"). threads: Number of concurrent threads (default 25, max 50). timeout: Override scan timeout in seconds.

Returns: CRLF injection scan results with vulnerable URLs and evidence.

Note: - Target must be in tengu.toml [targets].allowed_hosts.

Search for Metasploit modules matching a query.

Args: query: Search terms (e.g. "eternalblue", "log4j", "CVE-2021-44228"). module_type: Filter by module type: 'exploit', 'auxiliary', 'post', 'payload', 'encoder', 'evasion', or 'all'.

Returns: List of matching Metasploit modules with name, rank, and description.

Get detailed information about a specific Metasploit module.

Args: module_path: Full module path (e.g. "exploit/windows/smb/ms17_010_eternalblue").

Returns: Module details including options, targets, CVE references, and description.

Execute a Metasploit module with configured options.

WARNING: This is a destructive operation that may exploit vulnerabilities on the target system. Requires explicit authorization and human confirmation.

Args: module_path: Full module path (e.g. "exploit/windows/smb/ms17_010_eternalblue"). options: Module-level options as key-value pairs (e.g. {"RHOSTS": "192.168.1.10"}). target_index: Module target index (0 = default target). payload: Payload to use (e.g. "cmd/unix/reverse_bash", "generic/shell_reverse_tcp"). Leave empty to let Metasploit choose the default payload for the target. payload_options: Payload-level options (e.g. {"LHOST": "192.168.1.100", "LPORT": "4444"}). These are set on the payload object, not the module.

Returns: Execution result with session information if exploitation succeeded.

Note: REQUIRES HUMAN CONFIRMATION. This tool will initiate an actual exploit attempt against the target system. Only execute with explicit authorization.

List all active Metasploit sessions (shells, meterpreter).

Returns: Active sessions with type, target host, and session ID.

Execute a command on an active Metasploit session (shell or Meterpreter).

WARNING: This is a destructive operation that executes commands on a compromised system. Requires explicit authorization.

Args: session_id: Active session ID (e.g. "1", "2"). Only digits are accepted. command: Command to execute (e.g. "id", "whoami", "cat /etc/shadow"). timeout: Maximum seconds to wait for output (default: 30).

Returns: Command output with session type and session ID.

Search the ExploitDB offline database using SearchSploit.

Queries the local ExploitDB database for exploits matching the search terms. Useful for quickly finding public exploits for identified software versions.

Args: query: Search terms (e.g. "Apache 2.4.49", "WordPress 5.8", "CVE-2021-44228"). exact_match: Only return results that exactly match all search terms. exclude_dos: Exclude Denial of Service exploits from results (recommended). type_filter: Filter by exploit type: 'webapps', 'remote', 'local', 'dos', 'shellcode', or '' for all.

Returns: List of matching exploits with path, type, and platform information.

Perform a credential brute force attack using Hydra.

WARNING: This is a destructive operation that may trigger account lockouts, IDS/IPS alerts, and log entries on the target system. Only use with explicit written authorization from the target system owner.

Args: target: Target IP or hostname. service: Service protocol to attack (e.g. "ssh", "ftp", "http-post-form"). userlist: Path to username list file. passlist: Path to password list file. port: Override default port for the service. threads: Number of parallel attack threads (default: 16, max: 64). stop_on_success: Stop after finding the first valid credential pair. timeout: Override scan timeout in seconds.

Returns: List of discovered valid credentials.

Note: - Requires explicit human authorization before execution. - Consider rate limiting to avoid lockouts. - Target must be in tengu.toml [targets].allowed_hosts.

Attempt to crack a hash using a dictionary attack.

Uses John the Ripper or Hashcat to perform a wordlist-based attack against the provided hash value.

IMPORTANT: The hash parameter is named 'hash_value', not 'hash'. Always call this tool as: hash_crack(hash_value="...", ...)

Args: hash_value: The hash to crack. MUST be named 'hash_value' (not 'hash'). Example: "0192023a7bbd73250516f069df18b500" hash_type: Hash format hint for the cracker (e.g. "md5", "sha1", "bcrypt"). Leave empty for auto-detection. wordlist: Path to wordlist file. Defaults to configured default. tool_preference: Preferred cracking tool: 'john', 'hashcat', or 'auto'. 'auto' tries john first, then hashcat. timeout: Override timeout in seconds.

Returns: Cracking result with plaintext if found.

Note: - Only use for authorized password recovery or testing purposes. - Dictionary attacks may not succeed against strong passwords. - For GPU-accelerated cracking, hashcat is strongly preferred.

Identify the algorithm used to produce a hash value.

Uses pattern matching to determine the likely hash type(s) based on length, character set, and structural patterns.

IMPORTANT: The hash parameter is named 'hash_value', not 'hash'. Always call this tool as: hash_identify(hash_value="...", ...)

Args: hash_value: The hash string to identify. MUST be named 'hash_value' (not 'hash'). Example: "0192023a7bbd73250516f069df18b500"

Returns: List of possible hash types with confidence scores and hashcat mode numbers.

Generate a custom wordlist by crawling a website with CeWL.

CeWL spiders a target website and collects unique words from the content, creating organization-specific wordlists for password attacks.

Args: url: Target URL to crawl. depth: Spider depth (default 2, max 5). min_word_length: Minimum word length to include (default 6). include_emails: Also extract email addresses from the site. output_file: Path to save the generated wordlist. timeout: Override default timeout in seconds.

Returns: Path to generated wordlist, word count, and sample words.

Note: - Be cautious with depth — higher values generate more traffic. - Target must be in tengu.toml [targets].allowed_hosts.

Spider/crawl a web application using OWASP ZAP.

Discovers all links and application URLs by crawling the target application. This is typically the first step before an active scan.

Args: url: Target URL to start spidering from. max_depth: Maximum crawl depth. Default: 5. wait_for_completion: Wait for the spider to finish before returning. timeout: Override scan timeout in seconds.

Returns: Spider results with discovered URLs and status.

Note: - Requires OWASP ZAP to be running with API enabled. - Set ZAP_BASE_URL and ZAP_API_KEY environment variables.

Run an active vulnerability scan using OWASP ZAP.

Active scanning sends crafted requests to identify vulnerabilities. This is an intrusive operation — it will send potentially malicious payloads to the target application.

Args: url: Target URL to scan (should be spidered first). policy: ZAP scan policy name. Leave empty for the default policy. timeout: Override scan timeout in seconds.

Returns: Active scan status with number of alerts found.

Retrieve vulnerability alerts from OWASP ZAP.

Fetches the list of vulnerabilities found during active/passive scanning.

Args: url: Filter alerts for a specific URL (optional). risk_level: Filter by risk: 'High', 'Medium', 'Low', 'Informational'. max_alerts: Maximum number of alerts to return.

Returns: List of ZAP alerts with risk level, description, solution, and evidence.

Correlate multiple findings to identify attack chains and compound risks.

Analyzes findings from multiple tools to identify patterns, attack chains, and compound risks that are more severe than individual findings suggest.

Args: findings: List of Finding objects (as dicts) from any Tengu tool. Each finding should have: severity, owasp_category, cve_ids, tool.

Returns: Correlation analysis with identified attack chains, risk score, and prioritized remediation recommendations.

Calculate a comprehensive risk score based on CVSS scores and engagement context.

Args: findings: List of findings from any Tengu tool. context: Optional engagement context that affects risk multipliers (e.g. "external-facing e-commerce", "internal HR system").

Returns: Risk scorecard with overall score, breakdown, and risk matrix data.

Fetch complete details for a specific CVE from NVD and CVE.org.

Returns CVSS scores (v2/v3.1/v4.0), CWE mappings, affected products, references, and cross-references to known exploits.

Args: cve_id: CVE identifier in the format CVE-YYYY-NNNNN (e.g. "CVE-2024-1234").

Returns: Full CVE details including CVSS vector, severity, affected products, and exploit availability indicators.

Search CVEs by keyword, product, CPE, or severity.

IMPORTANT: The search term parameter is named 'keyword' (not 'query'). Call as: cve_search(keyword="apache log4j")

Queries the NVD database for matching CVEs. Results are cached locally for 24 hours to respect API rate limits.

Args: keyword: Search term (e.g. "apache log4j", "OpenSSL", "nginx 1.18"). MUST be named 'keyword' (not 'query'). cpe_name: CPE 2.3 identifier (e.g. "cpe:2.3:a:apache:log4j:2.14.0:::::::*"). severity: Filter by CVSS severity: LOW, MEDIUM, HIGH, CRITICAL. days_back: Only return CVEs published in the last N days. max_results: Maximum number of results to return (max: 100).

Returns: List of matching CVEs with severity, CVSS score, and description.

Generate a professional penetration test report.

Creates a comprehensive security assessment report from collected findings, formatted according to industry standards (PTES, OWASP).

Args: client_name: Name of the client organization. engagement_type: Type of test: 'blackbox', 'greybox', or 'whitebox'. scope: List of in-scope targets (IPs, domains, URLs). exclusions: List of explicitly excluded targets. engagement_dates: Testing period (e.g. "2026-02-15 to 2026-02-28"). findings: List of finding dicts from Tengu tools. executive_summary: Executive summary text (can be LLM-generated). conclusion: Report conclusion text. report_type: 'full', 'executive', 'technical', 'finding', or 'risk_matrix'. output_format: 'markdown', 'html', or 'pdf'. output_path: File path to save the report. If empty, returns content inline. tools_used: List of tool names used during the engagement.

Returns: Generated report content and metadata.

Scan for leaked secrets and credentials using TruffleHog.

Args: target: Git repository URL (for git/github mode) or local directory path (for filesystem mode). scan_type: Scan type — git (repo URL), filesystem (local path), github (GitHub org/user). branch: Branch to scan (optional, defaults to all branches). timeout: Override default timeout.

Returns: List of secret findings with detector type, verification status, and source location.

Scan a repository or directory for secrets and credentials using Gitleaks.

Args: target: Local path to a Git repository or directory to scan. scan_type: Scan mode — detect (full repo history), protect (pre-commit staged changes), dir (scan directory without git history). report_format: Output format — json, csv, sarif. timeout: Override default timeout.

Returns: List of secret findings with rule ID, file, commit, description, and partially-redacted secret.

Note: - Target path must be under an allowed directory (/usr/share, /opt, $HOME, /tmp). - Use detect for comprehensive historical scans. - Use protect as a pre-commit hook to catch secrets before they are committed.

Scan container images, filesystems, or repositories for vulnerabilities using Trivy.

Args: target: Docker image name (for image), local path (for fs/config/sbom), or repo URL (for repo). scan_type: Scan target type — image (Docker image), fs (filesystem), repo (git repo), config (IaC misconfigurations), sbom (SBOM analysis). severity: Comma-separated severity filter (e.g. "HIGH,CRITICAL" or "MEDIUM,HIGH,CRITICAL"). timeout: Override default timeout.

Returns: Structured vulnerability report with total counts by severity and top findings.

Note: - For image scans, the image must be pullable or already present locally. - Severity filter accepts: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL.

Perform a cloud security audit using ScoutSuite.

Args: provider: Cloud provider to audit — aws, azure, gcp, alibaba. profile: AWS named profile (for aws provider). Uses default credentials if empty. project: GCP project ID (for gcp provider). subscription: Azure subscription ID (for azure provider). report_dir: Directory to write the ScoutSuite report to. timeout: Override default timeout.

Returns: Summary of cloud security findings by service and severity from the ScoutSuite report.

Note: - Requires cloud provider credentials configured in the environment (AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, AZURE_CLIENT_ID, etc.). - ScoutSuite writes its full report to report_dir/scoutsuite-report/. - Long-running tool — cloud audits typically take 5-30 minutes depending on account size.

Perform a cloud security audit using Prowler.

Prowler checks cloud provider configurations against security best practices and compliance frameworks (CIS, NIST, SOC2, ISO 27001, etc.).

Args: provider: Cloud provider to audit — aws, azure, gcp. profile: AWS named profile (for aws provider). Uses default credentials if empty. project: GCP project ID (for gcp provider). subscription: Azure subscription ID (for azure provider). report_dir: Directory to write Prowler reports. timeout: Override scan timeout in seconds.

Returns: Summary of cloud security findings by severity.

Note: - Requires cloud provider credentials configured in the environment. - Long-running — cloud audits typically take 5-30 minutes.

Discover hidden HTTP parameters in web endpoints using Arjun.

Args: url: Target URL to test for hidden parameters. method: HTTP method to use — GET, POST, JSON, XML. wordlist: Path to a custom parameter wordlist file (optional). timeout: Override default timeout.

Returns: List of discovered parameters, the method used, and the tested URL.

Note: - Target URL must be in tengu.toml [targets].allowed_hosts. - Arjun sends many requests — use with care on rate-limited endpoints. - JSON and XML modes test parameters in the request body.

Perform automated GraphQL security checks using direct HTTP requests.

Checks performed:

• Introspection enabled (schema disclosure)

• Query batching enabled (potential DoS amplification)

• Depth limit enforcement (unbounded query depth)

• Field suggestion leak (information disclosure via error messages)

Args: url: GraphQL endpoint URL (e.g. https://example.com/graphql). check_introspection: Whether to test for introspection (schema exposure). authenticated: If True, include the Authorization header in requests. auth_header: Authorization header value (e.g. "Bearer "). timeout: HTTP request timeout in seconds (not the tool timeout).

Returns: Dict with each check result, overall is_vulnerable flag, and recommendations.

Note: - Target URL must be in tengu.toml [targets].allowed_hosts. - No subprocess is used — all checks are pure Python httpx requests. - Does not perform mutation or data modification of any kind.

Enumerate SMB/NetBIOS information using enum4linux-ng.

Args: target: Target IP or hostname running SMB (port 139/445). username: Optional username for authenticated enumeration. password: Optional password (will be redacted in logs). timeout: Override default timeout.

Returns: Users, groups, shares, and password policy from the target.

Note: - Requires SMB access (port 139 or 445). - Target must be in tengu.toml [targets].allowed_hosts.

Enumerate network services and AD using NetExec (successor to CrackMapExec).

Args: target: Target IP, hostname, or CIDR range. protocol: Protocol to use — smb, ldap, winrm, ssh, rdp, ftp, mssql, wmi. username: Username for authentication (optional). password: Password for authentication (redacted in logs). domain: Active Directory domain name. modules: List of NetExec modules to run (e.g. ["spider_plus", "enum_av"]). timeout: Override default timeout.

Returns: Authentication results, discovered hosts, shares, users, and module output.

Perform Kerberoasting using Impacket GetUserSPNs.

Requests TGS tickets for service accounts with SPNs registered in Active Directory. The resulting hashes can be cracked offline with hashcat (-m 13100) or john.

Args: target: Domain Controller IP address. domain: Active Directory domain name (e.g. corp.local). username: Valid domain username for authentication. password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). Alternative to password. timeout: Override default timeout.

Returns: Kerberoastable service accounts, SPNs, and TGS hashes for offline cracking.

WARNING: - Kerberoasting is detectable by modern EDR and SIEM solutions. - Requires valid domain credentials. - Target must be in tengu.toml [targets].allowed_hosts.

Dump SAM, NTDS, and LSA secrets from a Windows target using Impacket secretsdump.

Extracts credential hashes from the SAM database (local accounts), NTDS.dit (domain accounts), and LSA secrets (service account passwords, cached credentials).

Args: target: Target IP address or hostname. domain: Domain name (use "." for local accounts). username: Username for authentication. password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). Alternative to password. timeout: Override scan timeout in seconds.

Returns: Extracted credential hashes organized by type (SAM, NTDS, LSA secrets).

WARNING: - This is a destructive/intrusive operation detectable by EDR solutions. - Requires admin credentials on the target system. - Target must be in tengu.toml [targets].allowed_hosts. - Requires explicit human authorization.

Execute a command remotely on a Windows host via SMB using Impacket psexec.

psexec uploads a service binary to the target via SMB admin shares, creates and starts a Windows service, and executes the specified command.

Args: target: Target IP address or hostname. domain: Domain name (use "." for local accounts). username: Username for authentication. command: Command to execute on the remote host (e.g. "whoami"). password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). Alternative to password. timeout: Override scan timeout in seconds.

Returns: Command execution result with output.

WARNING: - This is a destructive operation that creates a service on the target. - Highly detectable — creates Windows Event IDs 7045, 4688. - Requires admin credentials and SMB access (port 445). - Requires explicit human authorization.

Execute a command remotely on a Windows host via WMI using Impacket wmiexec.

wmiexec uses Windows Management Instrumentation (WMI) for remote execution, which is stealthier than psexec as it does not create a service.

Args: target: Target IP address or hostname. domain: Domain name (use "." for local accounts). username: Username for authentication. command: Command to execute on the remote host. password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). Alternative to password. timeout: Override scan timeout in seconds.

Returns: Command execution result with output.

WARNING: - Requires admin credentials and WMI access (port 135/445). - Generates Windows Event ID 4688 and WMI activity logs. - Requires explicit human authorization.

Browse and interact with SMB shares using Impacket smbclient.

Enumerates available shares and optionally lists files within a specific share.

Args: target: Target IP address or hostname. domain: Domain name (use "." for local accounts). username: Username for authentication. action: Action to perform — "list_shares" (default) or "list_files". share: Share name for list_files action (e.g. "C$", "ADMIN$", "IPC$"). password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). Alternative to password. timeout: Override scan timeout in seconds.

Returns: SMB shares list or file listing within a specified share.

Note: - Target must be in tengu.toml [targets].allowed_hosts. - Requires valid credentials with appropriate share permissions.

Collect Active Directory data for BloodHound attack path analysis.

bloodhound-python enumerates users, groups, computers, GPOs, and trust relationships in an AD domain to map attack paths to Domain Admin.

Args: target: Domain Controller IP address. domain: Active Directory domain name (e.g. corp.local). username: Valid domain username for authentication. password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). collection_method: Data to collect — Default, All, DCOnly, Group, Session. output_dir: Directory to write collected JSON/ZIP files. timeout: Override scan timeout in seconds.

Returns: Collection summary with file locations and AD object counts.

WARNING: - BloodHound collection is detectable by modern EDR and SIEM solutions. - Generates significant LDAP traffic against the domain controller. - Requires valid domain credentials. - Target must be in tengu.toml [targets].allowed_hosts.

Capture NTLM credential hashes via LLMNR/NBT-NS poisoning using Responder.

Responder listens for LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) broadcasts and responds with poisoned answers, causing Windows hosts to authenticate to our listener.

Args: interface: Network interface to listen on (e.g. "eth0", "wlan0"). analyze_only: If True, run in analyze mode (no poisoning) — passive observation. capture_duration: How many seconds to run Responder (default 60, max 3600). timeout: Override global scan timeout.

Returns: Captured NTLM hashes and connection attempts.

WARNING: - This is an active man-in-the-middle attack on the local network. - Requires root/sudo privileges and a wired/wireless network interface. - Detectable by network intrusion detection systems. - Requires explicit human authorization and network owner permission. - This tool POISONS network name resolution — use analyze_only=True for passive observation.

Enumerate SMB shares and permissions using smbmap.

smbmap lists available SMB shares on a target host with their access permissions (READ/WRITE/NO ACCESS) for the provided credentials. Optionally performs recursive listing of share contents.

Args: target: Target IP address or hostname. domain: Domain name (default "WORKGROUP" for local). username: Username for authentication (empty for null session). password: Password for authentication (redacted in logs). hashes: NTLM hash for pass-the-hash (format: LM:NT). recursive: Recursively list share contents. share: Specific share to list recursively. timeout: Override scan timeout in seconds.

Returns: SMB shares with access permissions and optional file listing.

Note: - Target must be in tengu.toml [targets].allowed_hosts.

Passively scan for wireless networks using aircrack-ng suite.

Uses airodump-ng to passively capture wireless network information without transmitting any packets (monitor mode required).

Args: interface: Wireless interface in monitor mode (e.g. wlan0mon, wlan0). scan_time: Duration in seconds to capture (default 30). timeout: Override default timeout.

Returns: Discovered access points with BSSID, SSID, channel, encryption, and signal strength.

WARNING: - Requires wireless interface in monitor mode: sudo airmon-ng start wlan0 - Requires root/sudo privileges. - Only use on networks you own or have explicit written authorization to test. - This tool captures wireless frames — ensure legal authorization first. - Target must be a wireless interface, not a remote host.

Scan Infrastructure as Code for security misconfigurations using Checkov.

Supports Terraform, Kubernetes, Dockerfile, CloudFormation, ARM, Bicep, GitHub Actions, and more.

Args: path: Path to IaC directory or file to scan. framework: Framework type — all, terraform, kubernetes, dockerfile, cloudformation, arm, bicep, github_actions, helm, kustomize. check_ids: Comma-separated check IDs to run (e.g. "CKV_AWS_1,CKV_AWS_2"). skip_check_ids: Comma-separated check IDs to skip. timeout: Override default timeout in seconds.

Returns: Security findings grouped by severity with resource IDs, check names, and remediation.

Note: - Scans local files only — no network access required. - No allowlist check needed (local path, not a network target).

Clone a website and capture credentials submitted via the phishing page.

WARNING: This is a destructive operation intended for authorized phishing simulations and social engineering security assessments ONLY. Requires explicit human confirmation before execution.

Uses SET's Website Attack Vectors → Credential Harvester → Site Cloner module via seautomate. The tool clones the specified URL and starts a local HTTP server that captures form submissions (credentials) and redirects victims to the legitimate site.

Args: target_url: URL of the site to clone (must be in tengu.toml allowlist). lhost: Local IP address that will host the cloned page and receive captured credentials (the POST-back address embedded in the cloned form). listen_port: Local TCP port for the credential capture server (default: 80). timeout: Execution timeout in seconds (default: from config).

Returns: Dict with tool name, target_url, lhost, listen_port, returncode, output (truncated to 5000 chars), errors (truncated to 2000 chars), and success flag.

Note: REQUIRES HUMAN CONFIRMATION. This tool starts an active phishing server. Only execute with explicit written authorization from the target organization.

Generate a QR code pointing to a malicious URL for physical social engineering.

Uses SET's QRCode Generator Attack Vector via seautomate. The generated QR code can be printed and placed physically (badge lanyards, posters, signs) as part of a physical social engineering assessment to test user awareness.

Args: url: The URL to encode in the QR code (must be in tengu.toml allowlist). timeout: Execution timeout in seconds (default: from config).

Returns: Dict with tool name, url, returncode, output (truncated), errors, and success flag. The QR code image is written to SET's output directory.

Generate a social engineering payload for use in authorized campaigns.

WARNING: This is a destructive operation that generates executable payloads intended for authorized penetration tests and red team engagements ONLY. Requires explicit human confirmation before execution.

Uses SET's "Create a Payload and Listener" module via seautomate to generate a payload that, when executed by a target, will establish a reverse connection to the operator's listener.

Supported payload types: - powershell_alphanumeric: PowerShell shellcode injector (alphanumeric) - powershell_reverse: PowerShell reverse shell - hta: HTML Application (HTA) attack

Args: payload_type: Type of payload to generate. One of: powershell_alphanumeric, powershell_reverse, hta. lhost: Attacker's IP address that the payload will connect back to. lport: TCP port on lhost that the listener will bind to. timeout: Execution timeout in seconds (default: from config).

Returns: Dict with tool name, payload_type, lhost, lport, returncode, output (truncated to 5000 chars), errors (truncated to 2000 chars), and success flag.

Note: REQUIRES HUMAN CONFIRMATION. Generates executable attack payloads. Only execute with explicit written authorization from the target organization.

Check Tor connectivity and retrieve exit node IP and country.

Returns: Dictionary with tor_connected, exit_ip, exit_country, real_ip fields.

Request a new Tor circuit via the control port (NEWNYM signal).

Args: control_port: Tor control port (default 9051) control_password: Tor control password (from torrc)

Returns: Dictionary with success status and message.

Check current anonymity level — IP exposure, DNS leaks, proxy headers.

Returns: Dictionary with real_ip_exposed, dns_leak_detected, anonymity_level, and recommendations.

Validate a proxy server: check reachability, latency, exit IP and anonymity level.

Args: proxy_url: Proxy URL (e.g. socks5://127.0.0.1:9050 or http://proxy:3128)

Returns: Dictionary with reachable, latency_ms, exit_ip, anonymity_level, supports_https.

Rotate identity: request new Tor circuit and rotate User-Agent.

Args: tor_control_port: Tor control port (default 9051) tor_control_password: Tor control password

Returns: Dictionary with tor_rotated, new_user_agent, status.