HORCRUX
Security Reconnaissance & Intelligence
GitHub Get Started
OPEN SOURCE SECURITY TOOL

Security reconnaissance, orchestrated.

HORCRUX turns fragmented reconnaissance data into structured security intelligence — combining network discovery, web enumeration, evidence, findings and AI-assisted analysis into one operator-focused workflow.

Explore HORCRUX View on GitHub ↗
PythonOpen SourceCLIAI-AssistedOperator-Focused

WHAT IS HORCRUX

One reconnaissance workflow.
Structured end to end.

HORCRUX does not replace the tools you trust — it orchestrates them, and keeps every byte of evidence.

01 / DISCOVER

Network and service discovery across TCP and UDP, with protocol-aware follow-up modules.

nmap -Pn -sC -sV
ports → services → versions
router: smb · ldap · ssh · dns

02 / ENUMERATE

Web endpoints, technologies, services and attack surface — every candidate baseline-validated.

ffuf → gobuster → feroxbuster
soft-404 / SPA suppressed
whatweb · httpx · nuclei

03 / CORRELATE

Evidence, findings, vulnerabilities and AI-assisted analysis, ranked into next actions.

searchsploit CVE correlation
confidence + validation states
next → ranked actions

PRODUCT INTERFACE

The operation, at a glance.

Status, phase, services, endpoints, findings, evidence and AI reasoning — one surface. Select a view. DEMO DATA

CAPABILITIES

Built for the full reconnaissance loop.

Six modules, one workspace. Every claim below maps to a real subsystem in the codebase.

01NETWORK DISCOVERY

Nmap-driven TCP and UDP discovery with deterministic parsing — open ports treated as perimeter, never as verdicts.

  • Port discovery — top-100 → full sweep
  • Service enumeration — ssh · smb · ldap · dns · snmp
  • Host intelligence — surface exposure roles

02WEB ENUMERATION

  • Endpoint discovery — ffuf · gobuster · feroxbuster
  • Crawler results — validated paths only
  • Technology identification — whatweb · httpx
  • Web surface analysis — nuclei · nikto

03VULN INTEL

  • Finding correlation — cve · intel
  • Severity analysis — info → critical
  • SearchSploit offline lookup

04EVIDENCE

  • Persistent artifacts — raw/ · responses/
  • Scan outputs — commands.log
  • Structured results — state.json

05AI ANALYSIS

  • Security reasoning — ask
  • Result interpretation
  • Workspace-aware ranking

06ORCHESTRATION

Operation lifecycle across 7 stages and 8 scan profiles (quick · standard · deep · network · web · service · intel · local), with subsystem tracking, progress reporting, and policy controls coordinating every tool.

  • Progress tracking — status · subsystems
  • Policy controls — LAB · AUTHORIZED · READ_ONLY

RECON WORKFLOW

Target to decision, as a pipeline.

Each stage emits real artifacts into the workspace. Figures are demonstration data.

TargetSTAGE 00

10.10.10.10 — scoped, workspace opened DEMO

DiscoverySTAGE 01

3 services observed — full TCP + UDP sweep DEMO

EnumerationSTAGE 02–03

56 endpoints discovered, baseline-validated DEMO

ObservationSTAGE 04

candidates checked against soft-404 / SPA baselines

EvidenceSTAGE 05

14 artifacts collected — raw, bodies, headers DEMO

AI AnalysisSTAGE 06

3 prioritized recommendations with reasoning DEMO

FindingsSTAGE 07

1 validated finding — severity, confidence, proof DEMO

Operator decisionYOU

approve, adjust, or discard — nothing runs silent

TERMINAL

Designed for the terminal first.

Real commands, real output shapes. Copy anything.

horcrux — scan

      

      
    

    

      

        
horcrux — next

        

      

      
    

  






  

    

      
AI INTELLIGENCE

      
Intelligence where it fits. Control where it matters.

      
No magic — reconnaissance data becomes structured context, the model interprets it, the operator decides.

    

    

      

        
R1Recon data
services, software, paths, raw responses

        
R2Structured context
compact evidence snapshot + engagement scope

        
R3Model analysis
routed across groq · openai · anthropic · google

        
R4Security interpretation
normalized response — observation, reasoning

        
R5Proposed action
ranked, scored, with prerequisites

        
R6Operator decision
approve, adjust, or discard

      

      

        
AI ASSISTS WITH

        
    
          
  • Interpreting reconnaissance results
    • 
          
  • Correlating evidence across services
    • 
          
  • Identifying which findings are relevant
    • 
          
  • Prioritizing next reconnaissance steps
    • 
          
  • Workspace-aware reasoning with cached context
    • 
        

        
groq · defaultopenai · gpt-4oanthropic · claudegoogle · gemini

        
Keys stay in the OS keychain, masked. No key, no problem — deterministic offline reasoning takes over.

      

    

  







  

    

      
OPERATOR CONTROL

      
Automation without losing operator control.

      
Reasoning, proposals, policy and execution are separate stages. For authorized assessments, labs and CTFs.

    

    

      
AI analysis
reads verified evidence
→

      
Action proposal
SAFE → AGGRESSIVE
→

      
Policy validation
LAB · AUTHORIZED · READ_ONLY · ANALYSIS_ONLY
→

      
Operator mode
MAP · OPERATOR · AUTOMATION
→

      
Tool execution
logged to commands.log

    

    

      
      
      
    

    

  







  

    

      
ARCHITECTURE

      
Engineered like infrastructure.

      
Four runtime dependencies — typer · rich · pydantic · httpx. Python 3.11+. The diagram mirrors the package layout.

    

    
HORCRUX CLI — scan · ask · report · doctor · settings · ai
        │
        ▼
ORCHESTRATION — 7 stages · 8 profiles · service-to-module router
        │
        ▼
OPERATION STATE — workspaces/<target>/state.json
        │
        ▼
RECON MODULES — network · web (fingerprint/fuzzer/validator/nuclei) · smb · ldap · ssh · dns · snmp
        │
        ▼
EVIDENCE / FINDINGS — raw · responses · headers · severity/confidence/validation
        │
        ▼
AI RUNTIME — tasks: triage · ranking · attack paths · ask · summary
        │
        ▼
PROVIDER ADAPTERS — groq · openai · anthropic · google → normalized response + cache

    
Tool integrations execute where it counts — nmap · httpx · whatweb · ffuf · gobuster · feroxbuster · nuclei · nikto · searchsploit · smbclient · enum4linux-ng · ldapsearch · dig · snmpwalk — and doctor audits 50+ more without ever breaking a run.

  







  

    

      
OPEN SOURCE

      
Inspect the system yourself.

      
HORCRUX is MIT-licensed and designed to be read, extended and operated by security engineers.

      

        View GitHub
        Read the code
      

    

    

      
REPOSITORY — aadithya-vimal/horcrux
horcrux/
├── cli.py — commands + dispatch
├── core/ — orchestrator · policy · doctor
├── modules/ — network · web · services
├── intel/ai/ — groq · openai · anthropic · google
├── reporting/ — markdown engagements
└── ui/ — console · progress · ascii

      
CLI — REAL COMMANDS
$ horcrux scan 10.10.10.10 --deep
$ horcrux doctor
$ horcrux ask "..." --target 10.10.10.10
$ horcrux report 10.10.10.10
console: status · surface · findings
inspect · next · intel · cve · graph

    

  







  

    

      
INSTALLATION

      
From zero to reconnaissance in minutes.

      
Steps taken directly from the project README.

    

    

      
01git clone https://github.com/aadithya-vimal/horcrux.git

      
02cd horcrux && python3 -m venv .venv && source .venv/bin/activate

      
03pip install -r requirements.txt && pip install -e .

      
04horcrux --help

    

  







  

    
HORCRUX

    
Security reconnaissance,
structured for operators.

    
Open the source. Run your first scan. Build the workflow.

    

      View on GitHub
      Get Started
    

    
Open Source·Python·Security Research·Developer Tool