How calculusguy/hollow works
HOLLOW is a Python CLI for probing a target web application, identifying WAF behavior and signatures, then reporting bypass recommendations and optionally testing payload mutations. A Cloudflare detection also triggers subdomain reconnaissance through HackerTarget. The sampled CLI does not expose the README-advertised --evade option, so that capability is not represented as an implemented workflow. Edges are limited to calls and requests visible in the excerpts or documented in the README.
Main entry points: main.py CLI orchestrator · fingerprint.py WAF probing · bypass.py Payload mutations
Components 11
CLI workflow
- CLI orchestrator
main.py - Terminal reporting
main.py
Fingerprinting and evasion
- WAF probing
core/fingerprint.py - Block analysis
core/fingerprint.py - Payload mutations
core/bypass.py - Mutation testing
main.py - Bypass strategies
core/bypass.py
Origin reconnaissance
- Subdomain lookup
core/fingerprint.py
Other components
- Operator
- Target application
- HackerTarget API
Connections 11
- Operator → CLI orchestrator: invokes
README.md - CLI orchestrator → WAF probing: calls
main.py - WAF probing → Target application: sends probes
core/fingerprint.py - WAF probing → Block analysis: analyzes responses
core/fingerprint.py - CLI orchestrator → Payload mutations: requests variants
main.py - CLI orchestrator → Mutation testing: tests variants
main.py - Mutation testing → Target application: sends requests
main.py - CLI orchestrator → Bypass strategies: requests strategies
main.py - CLI orchestrator → Subdomain lookup: calls on Cloudflare
main.py - Subdomain lookup → HackerTarget API: queries
core/fingerprint.py - CLI orchestrator → Terminal reporting: prints results
main.py