🔥 HARD - Penetration Testing Framework

Advanced Multi-Tool Penetration Testing Framework with 1000+ Modules

---

📌 Overview

HARD is a powerful, all-in-one penetration testing framework built for security professionals and ethical hackers. It integrates 1000+ modules from top cybersecurity tools into a single, easy-to-use interface with color-coded output and comprehensive logging.

✨ Features

🔍 Reconnaissance & Scanning

• Port Scanner - Advanced port scanning with service detection (100+ ports)
• Subdomain Enumeration - 500+ wordlist for subdomain discovery
• DNS Enumeration - A, AAAA, MX, NS, TXT, CNAME, SOA, PTR records
• SSL/TLS Analysis - Certificate inspection and cipher analysis
• Technology Detector - Identify web frameworks and CMS
• CVE Scanner - Check for known vulnerabilities in services
• Directory Bruteforce - 100+ common directories and files

🌐 Web Application Testing

• SQL Injection Scanner - 20+ payloads including time-based and union-based
• XSS Vulnerability Scanner - 15+ cross-site scripting payloads
• CSRF Testing - Detect missing CSRF tokens
• File Upload Testing - Test for unrestricted file uploads
• HTTP Header Analysis - Check security headers (HSTS, CSP, X-Frame-Options)
• Cookie Security Analysis - Check Secure and HttpOnly flags
• LFI Scanner - Local File Inclusion vulnerability detection
• Parameter Fuzzing - Fuzz web parameters with various payloads

🔐 Cryptography & Password Cracking

• Hash Generator - MD5, SHA1, SHA256, SHA512, SHA3-256, BLAKE2b
• Password Cracker - Dictionary-based hash cracking
• Base64 Encode/Decode - Quick encoding and decoding
• ROT13 - Simple text transformation
• Caesar Cipher - Shift-based encryption
• JWT Token Analyzer - Decode and analyze JWT tokens
• XOR Encryption - XOR-based encryption/decryption
• Hex Encode/Decode - Hexadecimal conversion

🌩️ Cloud & Container Security

• Cloud Metadata Extraction - AWS, GCP, and Azure metadata
• S3 Bucket Scanner - Detect open/public S3 buckets
• GCP Scanner - Google Cloud Platform vulnerability scanner
• Container Security - Basic container analysis

📡 Network Exploitation

• DoS Attack - Denial of Service simulation
• Packet Sniffer - Basic packet capture (requires scapy)
• ARP Spoofing - ARP cache poisoning (requires scapy)
• DNS Spoofing - DNS response spoofing (requires scapy)
• Network Mapping - Host discovery on local network
• Anonymity Tools - Proxy, VPN, and DNS configuration

🕵️ OSINT & Forensics

• Email OSINT - Email validation and domain checking
• Domain OSINT - WHOIS lookup and DNS enumeration
• Username OSINT - Social media presence detection
• Phone OSINT - Phone number validation and carrier detection
• Memory Forensics - Memory dump analysis (requires Volatility)
• Disk Forensics - Disk image analysis (requires Sleuthkit)
• Log Analysis - Error, warning, and suspicious pattern detection
• GeoIP Lookup - IP geolocation

📱 Mobile Security

• APK Analysis - Permission extraction and vulnerability scanning
• iOS Analysis - IPA file inspection
• Permission Analysis - Dangerous permission detection
• Debuggable Detection - Check for debuggable APKs

📶 Wireless Security

• WiFi Scanner - Network discovery (Windows/Linux)
• Bluetooth Scanner - Device discovery (Linux)
• WiFi Cracking - Basic WPA/WPA2 cracking framework (requires aircrack-ng)

💀 Post-Exploitation

• Persistence Techniques - Windows and Linux persistence methods
• Lateral Movement - Pass-the-hash, RDP hijacking, SSH key theft
• Data Exfiltration - HTTP, DNS, ICMP tunneling
• Privilege Escalation - Kernel exploits, SUID exploitation
• Backdoor Installation - Various backdoor techniques

🛠️ Exploit Development

• CVE Exploit Generator - Pre-built exploits for common CVEs
• Shellcode Generator - Linux and Windows reverse shell shellcode
• Payload Generator - Reverse shell, bind shell, web shells
• Buffer Overflow Tools - Pattern generation and offset calculation

🔧 Reverse Engineering

• File Analysis - File type, size, MD5 hash, entropy calculation
• Binary Analysis - Symbol extraction, file command integration
• String Extraction - Extract human-readable strings
• Suspicious Pattern Detection - Find passwords, keys, and secrets

🎯 Social Engineering

• Phishing Template Generator - Password reset, verification, invoice templates
• Spear Phishing Tools - Targeted phishing email generation
• Social Media OSINT - Username presence detection

📊 Reporting

• JSON Reports - Comprehensive scan results
• Logging System - Detailed activity logs
• Color-Coded Output - Easy-to-read terminal output
• Error Tracking - Separate error, warning, and success logs

🚀 Installation

# Clone the repository
git clone https://github.com/ewwhardik/hard.git
cd HARD

# Install required dependencies
pip install requests dnspython whois

# Optional dependencies for advanced features
pip install scapy  # For packet sniffing and spoofing
pip install androguard  # For APK analysis

# Run the tool
python hard.py
or run.bat

HARD/
├── hard.py              # Main framework file
├── README.md           # Documentation
├── run.bat             # To run the app