Modules Overview

APHIDS includes 30+ security testing modules covering reconnaissance, scanning, and vulnerability assessment.

Module Categories

Network Scanning

• Nmap: Port scanning and service detection
• Masscan: Fast port scanning
• Unicornscan: Distributed port scanning

Web Application Testing

• Nikto: Web server scanner
• Wapiti: Web application vulnerability scanner
• WhatWeb: Web technology fingerprinting
• Dirb: Directory brute forcing
• Gobuster: Directory/file enumeration

Subdomain Enumeration

• Amass: Comprehensive subdomain discovery
• Sublist3r: Subdomain enumeration
• Subfinder: Fast subdomain discovery
• Assetfinder: Subdomain finder

Vulnerability Scanning

• Nuclei: Template-based vulnerability scanner
• Nessus: Commercial vulnerability scanner
• OpenVAS: Open-source vulnerability scanner

SSL/TLS Testing

• SSLScan: SSL/TLS scanner
• TestSSL: SSL/TLS testing
• SSLyze: SSL configuration analyzer

Information Gathering

• Shodan: Internet-wide scanning
• Censys: Internet asset discovery
• TheHarvester: OSINT gathering

DNS Tools

• DNSRecon: DNS enumeration
• Fierce: DNS reconnaissance
• DNSEnum: DNS enumeration

Using Modules

In Runbooks

Modules are configured in runbooks:

modules:
  - name: "nmap"
    enabled: true
    args:
      target: "192.168.1.0/24"
      ports: "1-1000"

In Attack Trees

Modules are nodes in attack trees with conditional execution.

Standalone

Some modules can run standalone via CLI.

Module Configuration

Each module has specific configuration options. See individual module documentation for details.

Creating Custom Modules

See Custom Modules for information on extending APHIDS with your own tools.

---

Related: Custom Modules | Runbooks | Attack Trees