# Hellhound Spider

An autonomous web crawler and attack-surface-management engine for security testing, mapping endpoints, parameters and security issues across traditional and single-page web apps.

Hellhound Spider crawls a web application and produces a structured JSON report of every endpoint, parameter and security surface it can reach, sorted by confidence and grouped by source, ready to feed into attack agents or import into Burp Suite. It runs two crawl engines in parallel: async HTTP workers for speed, and headless Chromium for JavaScript-heavy single-page apps, where it intercepts live XHR and fetch calls including POST bodies and response IDs.

A CTF mode enables sensitive-file scanning, admin-panel checks, OpenAPI/GraphQL discovery, CORS audits and flag extraction in one flag, alongside active CORS vulnerability auditing and automatic query-parameter extraction and validation for every crawled URL.

It installs as a Python package with a system-wide CLI and man page, and is GPL-3.0 licensed.

Website: https://github.com/project-hellhound-org/Hellhound-Spider