One Flying Open-source - Open-source recommendation, committed to pushing open-source project technology applications to target users in the first time, reducing the difficulty and cost of open-source authors, open-source teams, and open-source organizations in promoting and promoting open-source projects, and accurately and smoothly transmitting value and sharing win-win!

1. Project Overview

Hunter is a passive vulnerability scanner.

As an integral part of ZTO's DevSecOps closed-loop solution, Hunter plays an important role. By open-sourcing it, we hope to help more enterprises.

ZTO Security is dedicated to supporting the secure development of all business sectors across the ZTO Express Group ecosystem, including express delivery, freight transportation, e-commerce, media, finance, and aviation.

2. Open Source License

Licensed under Apache-2.0

3. Screenshots

Product Preview

Browser Extension Client

Client Configuration

Results of a Single Scan Task

Hunter Personal User Statistics Report

Distributed Plugin Management

Download Client

4. Feature Overview

Overview

Background

An important part of Party A's security development process is security testing before business updates are released. Most companies' product development departments are equipped with one or more quality assurance (QA) engineers responsible for ensuring software quality. However, different professionals specialize in different areas. While QA engineers can handle software functionality defects with ease, their lack of professional knowledge in the security field makes it difficult for them to identify security risks. A common approach to addressing this issue is to have Party A's security personnel conduct regular security inspections of business lines. However, this approach has significant delays, as a considerable amount of time may pass between a business launch and the discovery of security issues. Ideally, security risks should be eliminated before a business goes live. As a result, many companies arrange manual security testing before launching business updates, but this approach is not resource-efficient. Both of the approaches mentioned above have certain drawbacks. A better solution is to integrate automated security scanning into the release process. The overall DevSecOps workflow is as follows:

DevSecOps End-to-End Closed Loop

As a key component of Zhongtong's DevSecOps ecosystem, Hunter plays an extremely important role.

Product Overview

Welcome to the Hunter documentation. Hunter is a passive vulnerability scanner. What exactly is a passive vulnerability scanner?

First, let's understand active vulnerability scanners. The main workflow of a traditional active vulnerability scanner is as follows:

1. A web crawler crawls website endpoints.

2. The crawled endpoints are tested for vulnerabilities.

The approach of using web crawlers to actively crawl website endpoints and perform vulnerability testing is known as active vulnerability scanning.

However, active crawlers often miss many website endpoints. To solve this problem, an approach was developed that captures users' network requests and performs vulnerability testing while users interact with web applications.

This vulnerability detection approach is

known as passive vulnerability scanning.

5. Tech Stack

Product Workflow and Architecture Diagram

Product Architecture Diagram

Workflow Diagram

Source Code Structure

The currently open-source codebase is mainly divided into the following seven modules:

├── HunterClient (Client - Browser Extension)
├── HunterAdminApi (Admin Backend)
├── HunterAdminGui (Admin Frontend)
├── HunterSense (Response Log Platform)
├── HunterCelery (POC Vulnerability Detection Engine)
├── SqlmapCelery (SQL Injection Detection Engine)
├── XsseyeCelery (XSS Detection Engine)