hackingtool — Claude Code Plugin

---
name: hackingtool-plugin-claude
description: Claude Code plugin wrapping 183+ pentesting & OSINT tools via ht_run.py with auto backend selection (native/WSL/Docker)
triggers:
  - recon a target domain
  - run pentesting tools
  - osint username lookup
  - scan for vulnerabilities
  - install hackingtool plugin
  - run nmap subfinder nuclei
  - enumerate subdomains and ports
  - find leaked secrets in git repo
---

# hackingtool — Claude Code Plugin

> Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection.

183 pentesting & OSINT tools available to Claude Code via a plugin wrapper around [Z4nzu/hackingtool](https://github.com/Z4nzu/hackingtool). Auto-selects backend: native Bash (Linux/macOS), WSL (Windows), or Docker images.

---

## Install

```bash
/plugin marketplace add AKCODEZ/hackingtool-plugin
/plugin install hackingtool@hackingtool-marketplace

Then just talk to Claude naturally:

"recon example.com"
"hunt the username johndoe across social platforms"
"scan my repo for leaked secrets"
"enumerate subdomains for target.com"

---

Architecture

All tool invocations route through two core modules:

ht_env.py — Backend detection

# Backend priority: Docker > WSL > Native
import ht_env

env = ht_env.detect()
# Returns one of: "native", "wsl", "docker"
# env.run("nmap -sV 192.168.1.1") dispatches correctly

ht_run.py — Tool executor

import subprocess, json

result = subprocess.run(
    ["python3", "ht_run.py", "nmap", "--", "-sV", "192.168.1.1"],
    capture_output=True, text=True
)
output = json.loads(result.stdout)
# output = {"tool": "nmap", "backend": "docker", "stdout": "...", "stderr": "...", "returncode": 0}

CLI usage:

# Run a tool
python3 ht_run.py <tool_id> [-- <tool_args...>]

# Install a tool natively (Linux/WSL)
python3 ht_run.py nmap --install

# List available tool IDs
python3 ht_run.py --list

---

Docker Image Map

The plugin auto-pulls purpose-built images. No manual docker pull needed.

Tool ID	Docker Image
nmap	instrumentisto/nmap
masscan	ilyaglow/masscan
rustscan	rustscan/rustscan
subfinder	projectdiscovery/subfinder
amass	caffix/amass
httpx	projectdiscovery/httpx
nuclei	projectdiscovery/nuclei
katana	projectdiscovery/katana
holehe	megadose/holehe
maigret	soxoj/maigret
spiderfoot	spiderfoot/spiderfoot
theharvester	secsi/theharvester
trufflehog	trufflesecurity/trufflehog
gitleaks	zricethezav/gitleaks
ffuf	secsi/ffuf
gobuster	devopsworks/gobuster
testssl	drwetter/testssl.sh
wafw00f	0xsauby/wafw00f
sqlmap	paoloo/sqlmap
impacket	rflathers/impacket
netexec	byt3bl33d3r/netexec
dnstwist	elceef/dnstwist
(fallback)	kalilinux/kali-rolling

---

Common Usage Patterns

Domain Recon Workflow

import subprocess, json

def ht(tool_id, *args):
    cmd = ["python3", "ht_run.py", tool_id, "--"] + list(args)
    r = subprocess.run(cmd, capture_output=True, text=True)
    return json.loads(r.stdout)

target = "example.com"

# 1. Passive subdomain enumeration
subs = ht("subfinder", "-d", target, "-silent")
print(subs["stdout"])

# 2. HTTP probe live hosts
httpx = ht("httpx", "-l", "-", "-silent")  # pipe subfinder output

# 3. Port scan
ports = ht("nmap", "-sV", "--open", "-T4", target)
print(ports["stdout"])

# 4. Vulnerability scan
vulns = ht("nuclei", "-u", f"https://{target}", "-severity", "critical,high")
print(vulns["stdout"])

OSINT Username Hunt

username = "johndoe"

# Check 3000+ sites
maigret = ht("maigret", username, "--html")
print(maigret["stdout"])

# Check email registration on 120+ sites
email = "[email protected]"
holehe = ht("holehe", email)
print(holehe["stdout"])

Secret Scanning

import os

repo_path = "/path/to/repo"

# TruffleHog — verified secrets with entropy analysis
secrets = ht("trufflehog", "filesystem", repo_path, "--json")

# Gitleaks — fast pattern-based scan
leaks = ht("gitleaks", "detect", "--source", repo_path, "--report-format", "json")

for tool_result in [secrets, leaks]:
    if tool_result["returncode"] != 0:
        print(f"FINDINGS: {tool_result['stdout']}")

SQL Injection Testing

# Automated SQLi detection (only test targets you own/have permission)
target_url = "https://testphp.vulnweb.com/artists.php?artist=1"

result = ht("sqlmap", "-u", target_url, "--batch", "--level=2", "--risk=1")
print(result["stdout"])

DNS Phishing Detection

domain = "paypal.com"

# Find lookalike/typosquat domains
twist = ht("dnstwist", "--registered", domain, "--format", "json")
import json as _json
lookalikes = _json.loads(twist["stdout"])
for entry in lookalikes:
    print(f"{entry['fuzzer']}: {entry['domain']} → {entry.get('dns-a', 'no DNS')}")

---

Backend-Aware Wrapper

# ht_env.py usage — check what backend will be used
import subprocess

def get_backend():
    r = subprocess.run(
        ["python3", "ht_env.py", "--detect"],
        capture_output=True, text=True
    )
    return r.stdout.strip()  # "native" | "wsl" | "docker"

backend = get_backend()
print(f"Using backend: {backend}")

# For sudo-required tools on native/WSL:
# The plugin auto-retries with sudo on permission errors
# No manual sudo handling needed in calling code

---

Tool Categories & IDs

Category	Key Tool IDs
Information Gathering	amass, subfinder, nmap, masscan, rustscan, httpx, spiderfoot, theharvester, maigret, holehe, gitleaks, trufflehog
Web Attack	ffuf, gobuster, sqlmap, nosqlmap, wafw00f, testssl, nuclei, katana
OSINT	maigret, holehe, infoga, redhawk, recondog, reconspider
Wordlist/Passwords	cupp, hashcat, john, haiti
Wireless	wifite, airgeddon, bettercap, wifiphisher
Active Directory	impacket, netexec
Phishing Recon	dnstwist
Anonymity	anonsurf, multitor

---

Tool Flags Reference

Flag	Meaning
sudo	Requires elevated privileges — auto-handled on native/WSL
hw	Requires physical hardware (WiFi adapter, Bluetooth) — Docker cannot satisfy
interactive	Needs a TTY / interactive session — Claude will note this
long	Long-running operation — may take minutes to hours

🟢 = plug-and-play (56 tools) · 🟡 = environment-dependent (127 tools)

---

Install Individual Tools (Native/WSL)

# Install a specific tool to the host system
python3 ht_run.py subfinder --install
python3 ht_run.py nuclei --install
python3 ht_run.py gitleaks --install

# Docker images need no install — pulled automatically on first use

---

Troubleshooting

Docker not found

# Verify Docker is running
docker info

# If not installed: https://docs.docker.com/get-docker/
# Plugin falls back to native/WSL if Docker unavailable

Permission denied on native/WSL tools

# The plugin auto-retries with sudo
# If it still fails, check sudoers config:
sudo visudo
# Add: yourusername ALL=(ALL) NOPASSWD: /usr/bin/nmap

WSL distro not detected

# List available WSL distros
wsl --list --verbose

# Plugin prefers Ubuntu/Kali — install if missing:
wsl --install -d Ubuntu

Tool output is empty

result = ht("subfinder", "-d", "example.com")
if result["returncode"] != 0:
    print("STDERR:", result["stderr"])
    # Check if Docker image pulled correctly:
    # docker run --rm projectdiscovery/subfinder -version

Hardware-dependent tools in Docker

Tools with hw flag (wireless attacks, Bluetooth) cannot run in Docker. They require:

• Physical adapter passthrough to WSL2, or
• Running on bare-metal Linux

Claude will surface this constraint in the response when a hw-flagged tool is invoked.

---

Environment Variables

# Optional: override Docker socket path
export DOCKER_HOST=unix:///var/run/docker.sock

# Optional: force a specific backend
export HT_BACKEND=docker   # "native" | "wsl" | "docker"

# Optional: WSL distro override
export HT_WSL_DISTRO=kali-linux

# Optional: extra docker run flags (e.g. network mode)
export HT_DOCKER_FLAGS="--network host"

---

Responsible Use

• Only run these tools against systems you own or have explicit written permission to test.
• Many tools (nmap, sqlmap, masscan) trigger IDS/IPS alerts and may violate ToS or laws if used against unauthorized targets.
• The --batch flag on sqlmap and similar tools disables interactive prompts — use carefully.
• WiFi attack tools (hw flag) require compliance with local radio/wireless regulations.