# calculusguy/hollow architecture

> Architecture diagram of the GitHub repository calculusguy/hollow, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/calculusguy/hollow
- Repository: https://github.com/calculusguy/hollow

## Overview

HOLLOW is a Python CLI for probing a target web application, identifying WAF behavior and signatures, then reporting bypass recommendations and optionally testing payload mutations. A Cloudflare detection also triggers subdomain reconnaissance through HackerTarget. The sampled CLI does not expose the README-advertised `--evade` option, so that capability is not represented as an implemented workflow. Edges are limited to calls and requests visible in the excerpts or documented in the README.

Main entry points: [`main.py`](https://github.com/calculusguy/hollow/blob/main/main.py) (CLI orchestrator), [`core/fingerprint.py`](https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py) (WAF probing), [`core/bypass.py`](https://github.com/calculusguy/hollow/blob/main/core/bypass.py) (Payload mutations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI workflow"]
  node_cli["CLI orchestrator<br/>[main.py]"]
  node_output["Terminal reporting<br/>[main.py]"]
end

subgraph group_analysis["Fingerprinting and evasion"]
  node_fingerprint["WAF probing<br/>[fingerprint.py]"]
  node_behavior["Block analysis<br/>[fingerprint.py]"]
  node_mutations["Payload mutations<br/>[bypass.py]"]
  node_mutation_tests["Mutation testing<br/>[main.py]"]
  node_recommendations["Bypass strategies<br/>[bypass.py]"]
end

subgraph group_recon["Origin reconnaissance"]
  node_origin_lookup["Subdomain lookup<br/>[fingerprint.py]"]
end

node_operator(("Operator"))
node_target(("Target application"))
node_hackertarget(("HackerTarget API"))

node_operator -->|"invokes"| node_cli
node_cli -->|"calls"| node_fingerprint
node_fingerprint -->|"sends probes"| node_target
node_fingerprint -->|"analyzes responses"| node_behavior
node_cli -->|"requests variants"| node_mutations
node_cli -->|"tests variants"| node_mutation_tests
node_mutation_tests -->|"sends requests"| node_target
node_cli -->|"requests strategies"| node_recommendations
node_cli -->|"calls on Cloudflare"| node_origin_lookup
node_origin_lookup -->|"queries"| node_hackertarget
node_cli -->|"prints results"| node_output

click node_cli "https://github.com/calculusguy/hollow/blob/main/main.py"
click node_output "https://github.com/calculusguy/hollow/blob/main/main.py"
click node_fingerprint "https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py"
click node_behavior "https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py"
click node_mutations "https://github.com/calculusguy/hollow/blob/main/core/bypass.py"
click node_mutation_tests "https://github.com/calculusguy/hollow/blob/main/main.py"
click node_recommendations "https://github.com/calculusguy/hollow/blob/main/core/bypass.py"
click node_origin_lookup "https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_output toneBlue
class node_fingerprint,node_behavior,node_mutations,node_mutation_tests,node_recommendations toneAmber
class node_origin_lookup,node_hackertarget toneMint
class node_operator,node_target toneIndigo
```

## Components

### CLI workflow

- [CLI orchestrator](https://github.com/calculusguy/hollow/blob/main/main.py): `main.py`
- [Terminal reporting](https://github.com/calculusguy/hollow/blob/main/main.py): `main.py`

### Fingerprinting and evasion

- [WAF probing](https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py): `core/fingerprint.py`
- [Block analysis](https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py): `core/fingerprint.py`
- [Payload mutations](https://github.com/calculusguy/hollow/blob/main/core/bypass.py): `core/bypass.py`
- [Mutation testing](https://github.com/calculusguy/hollow/blob/main/main.py): `main.py`
- [Bypass strategies](https://github.com/calculusguy/hollow/blob/main/core/bypass.py): `core/bypass.py`

### Origin reconnaissance

- [Subdomain lookup](https://github.com/calculusguy/hollow/blob/main/core/fingerprint.py): `core/fingerprint.py`

### Other components

- **Operator**
- **Target application**
- **HackerTarget API**

## Connections

- Operator → CLI orchestrator: invokes (evidence: `README.md`)
- CLI orchestrator → WAF probing: calls (evidence: `main.py`)
- WAF probing → Target application: sends probes (evidence: `core/fingerprint.py`)
- WAF probing → Block analysis: analyzes responses (evidence: `core/fingerprint.py`)
- CLI orchestrator → Payload mutations: requests variants (evidence: `main.py`)
- CLI orchestrator → Mutation testing: tests variants (evidence: `main.py`)
- Mutation testing → Target application: sends requests (evidence: `main.py`)
- CLI orchestrator → Bypass strategies: requests strategies (evidence: `main.py`)
- CLI orchestrator → Subdomain lookup: calls on Cloudflare (evidence: `main.py`)
- Subdomain lookup → HackerTarget API: queries (evidence: `core/fingerprint.py`)
- CLI orchestrator → Terminal reporting: prints results (evidence: `main.py`)