hawk is a Python-based suite that merges reconnaissance, footprinting and selected offensive network tasks into a single command-line workflow for authorized penetration testers and lab environments.
| Tool | medpaf/hawk — all-in-one network, recon and offensive-security utility for Linux written in Python |
| Category | Network reconnaissance and penetration testing suite |
| Primary Use | Consolidating ping, traceroute, port scans, WHOIS, subdomain enumeration and related footprinting tasks into one suite during scoped engagements |
| Safe Use | For authorized penetration tests, security labs and defensive research on networks you own or have written permission to assess; disruptive modules (flooding, deauth, spoofing) belong only in isolated lab ranges |
| Telemetry Note | Its scans produce standard SYN/UDP/ACK probe patterns and DNS/WHOIS lookups that NDR and IDS sensors flag; third-party API calls to IPinfo and Shodan leave account-attributable audit trails |
hawk is the kind of project that surfaces naturally from a working operator's frustration: its author states plainly that the suite was built so different kinds of tasks could be performed from one place instead of jumping between tools. The repository, medpaf/hawk, is a Python project with an MIT license, roughly 329 stars at the time of this writing, and a topic list that reads like a pentesting curriculum — network-scanner, host-discovery, packet-sniffer, subdomain-enumeration, brute-force among them. It targets Linux exclusively, with the README noting it was tested on Kali Linux, Ubuntu and Pop!_OS, and that Windows or macOS runs will emit numerous errors. That platform commitment matters: the offensive modules lean on Linux networking primitives that simply do not translate.
Architecturally, hawk is a single entry point — hawk.py — driven by a flag-style command grammar rather than subcommands in the modern click/argparse idiom. Every capability is invoked with a dash-prefixed token such as -ping, -scan, -whois or -sdenum, followed by positional or named arguments like -host, -p or -prange. This uniform grammar is the suite's real design decision: once you learn one module, the rest follow the same shape, which lowers the cognitive cost of switching tasks mid-engagement. Configuration is centralized in files/conf.py, which the README highlights repeatedly because it holds the API keys for third-party services.
The reconnaissance half of hawk covers what most assessors need in the early phases of an authorized engagement. Basic network diagnostics include -ifconfig, -ping and -traceroute, with the -ifconfig module marked beta. Port scanning supports five modes: TCP SYN (-scansyn, described as a stealth scan), TCP Connect (-scantcp), UDP (-scanudp), TCP ACK (-scanack) and a comprehensive scan (-scan), all of which accept single hosts, host lists, IP ranges via -iprange and port ranges via -prange. Host discovery on a LAN is a single -scanlan invocation, and -getmac resolves the MAC address of live local hosts — the standard layer-2 enumeration step that precedes any switched-network assessment.
The footprinting modules are where hawk earns its consolidation pitch. -grab performs banner grabbing against FTP, web, SSH and SMTP services, retrieving software names and versions that inform later vulnerability mapping. -ns provides DNS checks augmented with geolocation information — but the README discloses that this relies on the IPinfo API and ships a shared API key in files/conf.py, explicitly recommending you replace it with your own. The same disclaimer applies to -vulnscan, which consults the Shodan API. This is an important operational detail for professionals: running these modules with the default keys ties your activity to a shared credential and to someone else's quota, so key rotation is not optional hygiene, it is due diligence.
External footprinting continues with -whois for registration and contact lookups, -sdenum for subdomain enumeration using either the bundled default wordlist or a caller-supplied one via -wordlist, and -dirbust for discovering directories on a web server with the same wordlist override. The README frames subdomain enumeration correctly from a scoping perspective: it reveals which hosts fall inside an assessment's scope and therefore widens the attack surface you are contractually permitted to examine. There is also an automated reconnaissance module marked beta, which hints at chained workflows, though the README does not elaborate on what it orchestrates.
The offensive half of hawk is what demands the most careful handling, and this writeup deliberately stays at the descriptive level. The README lists packet sniffing (-sniff, with monitor-mode preparation available through a dedicated interface module), MAC spoofing, IP spoofing, SYN flooding, deauth attacks and a beta brute-force capability. These are textbook disruption and impersonation techniques; SYN flooding and deauth are denial-of-service vectors, and spoofing modules undermine layer-2 and layer-3 attribution. In an authorized context they have narrow, legitimate uses — MAC randomization for privacy testing, spoofing validation in controlled lab segments, DoS-resistance testing against your own infrastructure — but deploying them against anything you do not own crosses from assessment into attack, with legal consequences in most jurisdictions.
The IP spoofing module carries a curious README caveat: it notes the technique only works against machines with unpatched vulnerabilities, an acknowledgment that randomized source addresses fail against modern TCP sequence randomization and anti-spoofing stack hardening. That admission is analytically useful because it signals the author implemented raw-packet crafting with scapy-style semantics rather than wrapper scripts around system binaries, and it also means the module functions largely as an educational demonstration of why spoofing is rarely viable against current targets. Defenders can read it the same way: it is a reason to verify that ingress/egress filtering (BCP 38) is in place rather than a reason to panic.
Installation is straightforward and follows the two-command pattern the README documents: clone the repository and run sudo sh setup.sh, which handles dependencies across apt, dnf and pacman distributions, then launch with sudo python3 hawk.py. The README candidly advises ignoring error messages during installation, which is a yellow flag for dependency pinning discipline — review setup.sh before running it as root, as you should with any third-party installer. Running the tool as root is described as recommended rather than mandatory, but the sniffing, spoofing and monitor-mode modules will require elevated privileges regardless.
From a defensive-research standpoint, hawk is a useful teaching artifact precisely because it is monolithic. Its telemetry is anything but quiet: SYN and UDP scans generate the classic half-open-connection and ICMP-unreachable patterns that any decent IDS correlates, banner grabbing opens TCP connections that show up in service logs, and the API-backed modules leave per-key query trails at IPinfo and Shodan that can identify the account behind an unauthorized scan. Blue teams replicating adversary reconnaissance in purple-team exercises will find the suite convenient for generating the exact detection opportunities their tooling should be catching.
The roadmap section reveals the author's ambition — WAF detection, DNS enumeration, traffic analysis, XSS scanning, ARP cache poisoning, DNS cache poisoning, OSINT, email spoofing, exploits and automated tasks are all listed as future implementations. Some of those additions would push hawk further into territory where careful, scoped use is non-negotiable. As it stands, the project is an honest, single-author consolidation effort rather than a polished commercial alternative to nmap or a framework like Metasploit; several modules are tagged beta, and the README's own screenshots show a functional but utilitarian console. For authorized professionals who want one Python dependency instead of ten, or for students assembling a lab, hawk is a coherent and MIT-licensed starting point — provided the offensive modules stay pointed at ranges you control.
medpaf/hawk.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.