The full command list. Run nullhawk <command> --help for a command's options, and
nullhawk help <topic> for longer guidance (e.g. history query syntax). Pro marks a
feature that needs a Pro licence.
Command Does
projectCreate, inspect, and manage projects setupSet up a machine: project, CA, and trust (the first-run path) caManage the interception certificate authority scopeShow and change what the engagement may touch programmeThe engagement's terms and what the target won't accept headerIdentification headers put on your traffic licenseShow the active licence, or activate one versionPrint version and build information
Command Does
proxyRun the intercepting proxy (HTTP/1.x + HTTP/2) sendSend a single request, exactly as written historyBrowse captured traffic repeatResend a request, optionally editing it (structured or raw) wsCaptured WebSocket sessions + the WebSocket repeater decodeEncode/decode through a chain of codecs, or auto-peel layers matchreplaceRewrite proxied traffic with rules sitemapHost → path coverage tree
Command Does
crawlCrawl in-scope targets to widen coverage browseBrowser-driven capture (incl. authenticated / record-login) importImport an OpenAPI/GraphQL description as traffic
Command Does
reconThe whole passive picture in one pass fingerprintName the stack behind each host, with evidence surfaceMap the input surface per endpoint secretsLeaked secrets in captured response bodies externalsCross-origin scripts/styles without Subresource Integrity retireKnown-vulnerable JavaScript libraries jsminerMine JS for secrets and undiscovered endpoints
Command Does
identityManage the identities a project tests as identifiersReview values that might be object identifiers objectDeclare which identifiers are objects, and who owns them authzReplay a request as several identities and compare authz-sweepPro — sweep the whole project for broken access control
Command Does
scan passiveObservations + hypotheses over captured traffic (free) scan activePro — settle hypotheses by sending experimentsdetectorsList the checks this build has, and which send traffic checkUser-defined scan checks (BChecks analog) benchmarkScore the scanner against labelled targets (TP/FP)
Command Does
fuzzSend one request once per payload (unthrottled intruder is Pro ) raceSend one request many times at once (race conditions) sequencerMeasure token unpredictability domxssDrive a browser to find DOM-based XSS discoverPro — find unlinked paths (.git/.env/admin/swagger)xxePro — XML external entity injectionuploadPro — file-upload validationgraphqlPro — GraphQL schema exposurellmPro — prompt-injection probingoobOut-of-band collaborator (serve/mint/poll callbacks) jwtRead a JWT and forge the variants that test verification
Command Does
findingsRead and triage recorded findings pocCompile a finding into runnable steps reportTurn findings into a document (SARIF is Pro ) snapshotPro — record and compare engagement snapshotsrunRun a declarative plan file end to end (CI)
Command Does
extInstall and manage extensions (capability-scoped WASM)