export declare const nmapTool: {
    /**
     * nmap [scan type] [timing] [port range] [script] [-oA output] <target>
     *
     * Key flags (from nmap.org & offseckit.com cheat sheet):
     *   -sS          SYN stealth scan (default, requires root/admin)
     *   -sV          Service/version detection
     *   -O           OS fingerprinting
     *   -sC          Default NSE scripts (equiv. --script=default)
     *   --script     NSE script or category: vuln, safe, default, auth, brute, discovery
     *   --script-args mincvss=7.0   filter CVE results by minimum CVSS score
     *   -p-          All 65535 ports
     *   -F           Fast: top 100 ports
     *   -T0..T5      Timing: T1=sneaky, T2=polite, T3=normal, T4=aggressive, T5=insane
     *   -Pn          Skip host discovery (treat all hosts as online)
     *   -f           Fragment packets (evade some firewalls)
     *   --open       Show only open ports in output
     *   -oA <base>   Output all formats: .nmap .xml .gnmap
     *   -iL <file>   Input target list from file
     *   -sU          UDP scan
     *   -sn          Host discovery only (ping sweep), no port scan
     */
    runNmap: import("ai").Tool<{
        target: string;
        scanType: "full" | "quick" | "udp" | "stealth" | "discovery";
        osDetect: boolean;
        timing: number;
        skipHostDiscovery: boolean;
        scripts?: ("default" | "discovery" | "vuln" | "safe" | "auth" | "brute" | "vulners")[] | undefined;
        minCvss?: number | undefined;
        ports?: string | undefined;
    }, {
        target: string;
        openPorts: {
            port: number;
            service: string | undefined;
        }[];
        cves: {
            cve: string;
            cvss: number;
        }[];
        outputFiles: {
            normal: string;
            xml: string;
            grepable: string;
        };
        raw: string;
    }>;
};
export declare const nucleiTool: {
    /**
     * nuclei [flags]
     *
     * Key flags (from github.com/projectdiscovery/nuclei README):
     *   -u <url>          Single target URL/host
     *   -l <file>         Target list file
     *   -t <dir/file>     Template path (default: ~/.local/nuclei-templates)
     *   -tags <csv>       Filter by tag: cve,exposures,misconfigurations,default-logins,kev,vkev
     *   -severity <csv>   Filter: info,low,medium,high,critical
     *   -exclude-tags     Tags to skip
     *   -rl <int>         Rate limit (requests/sec)
     *   -c <int>          Concurrency
     *   -o <file>         Output file
     *   -json             JSON output
     *   -je <file>        JSON-lines export
     *   -nc               No colour
     *   -silent           Only findings
     *   -update-templates Auto-update community templates
     *
     *   Special tag combos:
     *   -tags kev        CISA Known Exploited Vulnerabilities (1496+ templates)
     *   -tags vkev       Vendor-confirmed KEV
     */
    runNuclei: import("ai").Tool<{
        target: string;
        severity: ("medium" | "info" | "critical" | "high" | "low")[];
        rateLimit: number;
        concurrency: number;
        updateTemplates: boolean;
        tags?: string[] | undefined;
        excludeTags?: string[] | undefined;
    }, {
        target: string;
        findingCount: number;
        bySeverity: Record<string, number>;
        findings: {
            templateId: string;
            name: string;
            severity: string;
            host: string;
            matched: string;
        }[];
        outputFile: string;
        raw: string;
    }>;
};
export declare const subfinderTool: {
    /**
     * subfinder [flags]
     *
     * Key flags (docs.projectdiscovery.io/opensource/subfinder/usage):
     *   -d <domain>        Single domain
     *   -dL <file>         Domain list file
     *   -s <csv>           Specific sources: crtsh,github,virustotal,...
     *   -all               Use all passive sources (slow)
     *   -recursive         Recursive subdomain resolution
     *   -o <file>          Output file
     *   -oJ                JSON lines output
     *   -silent            Subdomains only (clean output for piping)
     *   -t <int>           Goroutines for resolution (default 10)
     *   -rl <int>          Rate limit req/s
     *
     * API keys stored in: ~/.config/subfinder/provider-config.yaml
     * Without keys: crtsh, dnsdumpster, waybackarchive, hackertarget still work.
     */
    runSubfinder: import("ai").Tool<{
        domain: string;
        allSources: boolean;
        recursive: boolean;
        sources?: string[] | undefined;
    }, {
        domain: string;
        subdomainCount: number;
        subdomains: string[];
        outputFile: string;
    }>;
};
export declare const sqlmapTool: {
    /**
     * sqlmap [flags]
     *
     * Key flags (hacktricks.wiki, stationx.net/sqlmap-cheat-sheet):
     *   -u <url>           Target URL with injectable parameter (e.g. "http://site/?id=1")
     *   -r <file>          Load raw HTTP request from file (Burp export)
     *   --data <str>       POST data string
     *   --cookie <str>     Session cookies
     *   -p <param>         Force parameter to test
     *   --dbms <db>        Hint DBMS type: mysql, postgresql, mssql, oracle, sqlite
     *   --level <1-5>      Test depth (1=basic, 5=exhaustive); default 1
     *   --risk <1-3>       Risk level (3 includes heavy queries); default 1
     *   --technique <str>  Injection technique: B=boolean, E=error, U=union, S=stacked, T=time, Q=inline
     *   --batch            Non-interactive (auto-accept defaults)
     *   --threads <n>      Concurrent requests
     *   --random-agent     Random User-Agent
     *   --tamper <csv>     WAF bypass scripts: apostrophemask, randomcase, space2comment...
     *   --dbs              Enumerate databases
     *   --tables           Enumerate tables (-D <db>)
     *   --columns          Enumerate columns (-D <db> -T <table>)
     *   --dump             Dump table data
     *   --current-user     Get DB user
     *   --is-dba           Check if user is DBA
     *   --os-cmd <cmd>     Execute OS command (if stacked injection possible)
     *   --forms            Auto-detect and test forms on the page
     *   --crawl <depth>    Crawl site for injectable params
     */
    runSqlmap: import("ai").Tool<{
        target: string;
        level: number;
        risk: number;
        techniques: string;
        goal: "detect" | "enumerate-dbs" | "enumerate-tables" | "dump" | "os-shell";
        threads: number;
        forms: boolean;
        postData?: string | undefined;
        cookie?: string | undefined;
        dbms?: "sqlite" | "mysql" | "postgresql" | "mssql" | "oracle" | "db2" | undefined;
        database?: string | undefined;
        table?: string | undefined;
        tamper?: string[] | undefined;
    }, {
        target: string;
        goal: "detect" | "enumerate-dbs" | "enumerate-tables" | "dump" | "os-shell";
        isVulnerable: boolean;
        injectableParams: string[];
        outputDir: string;
        raw: string;
    }>;
};
export declare const ffufTool: {
    /**
     * ffuf [flags]
     *
     * Key flags (github.com/ffuf/ffuf):
     *   -u <url>           URL with FUZZ keyword, e.g. http://site/FUZZ or http://FUZZ.site.com
     *   -w <wordlist>      Wordlist path (use - for stdin)
     *   -H <header>        Additional header, e.g. "Host: FUZZ.site.com"
     *   -X <method>        HTTP method (default GET)
     *   -d <data>          POST body
     *   -mc <csv>          Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
     *   -fc <csv>          Filter out status codes
     *   -ms <int>          Match response size
     *   -fs <csv>          Filter out response sizes
     *   -fw <int>          Filter by word count
     *   -fl <int>          Filter by line count
     *   -t <int>           Threads (default 40)
     *   -rate <int>        Rate limit (req/s)
     *   -o <file>          Output file
     *   -of <fmt>          Output format: json, ejson, html, md, csv, ecsv (default json)
     *   -c                 Colorize output
     *   -v                 Verbose (show full URLs)
     *   -s                 Silent (only results)
     *   -recursion         Recursive directory fuzzing
     *   -recursion-depth   Max recursion depth
     *   -e <csv>           Extensions to append: .php,.html,.txt
     *   -ic                Ignore wordlist comments
     *
     * Common wordlists (SecLists):
     *   /usr/share/seclists/Discovery/Web-Content/common.txt
     *   /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
     *   /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
     */
    runFfuf: import("ai").Tool<{
        url: string;
        mode: "directory" | "vhost" | "parameter" | "backup";
        matchCodes: number[];
        threads: number;
        recursive: boolean;
        recursionDepth: number;
        wordlist?: string | undefined;
        extensions?: string[] | undefined;
        filterCodes?: number[] | undefined;
        filterSize?: number[] | undefined;
        rateLimit?: number | undefined;
        cookie?: string | undefined;
    }, {
        url: string;
        mode: "directory" | "vhost" | "parameter" | "backup";
        resultCount: number;
        results: {
            input: string;
            status: number;
            length: number;
            words: number;
        }[];
        outputFile: string;
        raw: string;
    }>;
};
export declare const httpxTool: {
    /**
     * httpx [flags]
     *
     * Key flags (github.com/projectdiscovery/httpx):
     *   -l <file>          Input list of hosts/URLs
     *   -u <url>           Single target
     *   -title             Extract page title
     *   -tech-detect       Technology fingerprinting (Wappalyzer-based)
     *   -status-code       Show HTTP status codes
     *   -content-length    Show content length
     *   -follow-redirects  Follow HTTP redirects
     *   -tls-probe         Probe TLS info (certs, expiry, SANs)
     *   -tls-grab          Grab all TLS data
     *   -web-server        Show web server header
     *   -ip                Resolve and show IPs
     *   -cdn               Detect CDN
     *   -probe             Show probe result
     *   -threads <n>       Concurrent probers
     *   -rate-limit <n>    Max requests/second
     *   -o <file>          Output file
     *   -json              JSON output
     *   -silent            Only show live hosts
     *   -nc                No colour
     */
    runHttpx: import("ai").Tool<{
        targets: string;
        techDetect: boolean;
        tlsProbe: boolean;
        followRedirects: boolean;
        threads: number;
        rateLimit: number;
    }, {
        liveHostCount: number;
        probes: {
            url: string;
            statusCode: number;
            title: string;
            tech: string[];
            webServer: string;
            ip: string;
        }[];
        outputFile: string;
        raw: string;
    }>;
};
export declare const pentestChainTool: {
    /**
     * Orchestrates the full kill chain:
     * 1. Subfinder → passive subdomain discovery
     * 2. httpx     → probe live hosts, fingerprint tech
     * 3. Nmap      → port scan live IPs
     * 4. Nuclei    → template-based vuln scan on live URLs
     *
     * Results at each stage feed into the next.
     */
    runPentestChain: import("ai").Tool<{
        domain: string;
        depth: "standard" | "deep" | "surface";
        includeKev: boolean;
        nmapScripts: boolean;
    }, {
        reportFile: string;
    }>;
};
export declare const pentestTools: {
    /**
     * Orchestrates the full kill chain:
     * 1. Subfinder → passive subdomain discovery
     * 2. httpx     → probe live hosts, fingerprint tech
     * 3. Nmap      → port scan live IPs
     * 4. Nuclei    → template-based vuln scan on live URLs
     *
     * Results at each stage feed into the next.
     */
    runPentestChain: import("ai").Tool<{
        domain: string;
        depth: "standard" | "deep" | "surface";
        includeKev: boolean;
        nmapScripts: boolean;
    }, {
        reportFile: string;
    }>;
    /**
     * httpx [flags]
     *
     * Key flags (github.com/projectdiscovery/httpx):
     *   -l <file>          Input list of hosts/URLs
     *   -u <url>           Single target
     *   -title             Extract page title
     *   -tech-detect       Technology fingerprinting (Wappalyzer-based)
     *   -status-code       Show HTTP status codes
     *   -content-length    Show content length
     *   -follow-redirects  Follow HTTP redirects
     *   -tls-probe         Probe TLS info (certs, expiry, SANs)
     *   -tls-grab          Grab all TLS data
     *   -web-server        Show web server header
     *   -ip                Resolve and show IPs
     *   -cdn               Detect CDN
     *   -probe             Show probe result
     *   -threads <n>       Concurrent probers
     *   -rate-limit <n>    Max requests/second
     *   -o <file>          Output file
     *   -json              JSON output
     *   -silent            Only show live hosts
     *   -nc                No colour
     */
    runHttpx: import("ai").Tool<{
        targets: string;
        techDetect: boolean;
        tlsProbe: boolean;
        followRedirects: boolean;
        threads: number;
        rateLimit: number;
    }, {
        liveHostCount: number;
        probes: {
            url: string;
            statusCode: number;
            title: string;
            tech: string[];
            webServer: string;
            ip: string;
        }[];
        outputFile: string;
        raw: string;
    }>;
    /**
     * ffuf [flags]
     *
     * Key flags (github.com/ffuf/ffuf):
     *   -u <url>           URL with FUZZ keyword, e.g. http://site/FUZZ or http://FUZZ.site.com
     *   -w <wordlist>      Wordlist path (use - for stdin)
     *   -H <header>        Additional header, e.g. "Host: FUZZ.site.com"
     *   -X <method>        HTTP method (default GET)
     *   -d <data>          POST body
     *   -mc <csv>          Match HTTP status codes (default: 200,204,301,302,307,401,403,405,500)
     *   -fc <csv>          Filter out status codes
     *   -ms <int>          Match response size
     *   -fs <csv>          Filter out response sizes
     *   -fw <int>          Filter by word count
     *   -fl <int>          Filter by line count
     *   -t <int>           Threads (default 40)
     *   -rate <int>        Rate limit (req/s)
     *   -o <file>          Output file
     *   -of <fmt>          Output format: json, ejson, html, md, csv, ecsv (default json)
     *   -c                 Colorize output
     *   -v                 Verbose (show full URLs)
     *   -s                 Silent (only results)
     *   -recursion         Recursive directory fuzzing
     *   -recursion-depth   Max recursion depth
     *   -e <csv>           Extensions to append: .php,.html,.txt
     *   -ic                Ignore wordlist comments
     *
     * Common wordlists (SecLists):
     *   /usr/share/seclists/Discovery/Web-Content/common.txt
     *   /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
     *   /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
     */
    runFfuf: import("ai").Tool<{
        url: string;
        mode: "directory" | "vhost" | "parameter" | "backup";
        matchCodes: number[];
        threads: number;
        recursive: boolean;
        recursionDepth: number;
        wordlist?: string | undefined;
        extensions?: string[] | undefined;
        filterCodes?: number[] | undefined;
        filterSize?: number[] | undefined;
        rateLimit?: number | undefined;
        cookie?: string | undefined;
    }, {
        url: string;
        mode: "directory" | "vhost" | "parameter" | "backup";
        resultCount: number;
        results: {
            input: string;
            status: number;
            length: number;
            words: number;
        }[];
        outputFile: string;
        raw: string;
    }>;
    /**
     * sqlmap [flags]
     *
     * Key flags (hacktricks.wiki, stationx.net/sqlmap-cheat-sheet):
     *   -u <url>           Target URL with injectable parameter (e.g. "http://site/?id=1")
     *   -r <file>          Load raw HTTP request from file (Burp export)
     *   --data <str>       POST data string
     *   --cookie <str>     Session cookies
     *   -p <param>         Force parameter to test
     *   --dbms <db>        Hint DBMS type: mysql, postgresql, mssql, oracle, sqlite
     *   --level <1-5>      Test depth (1=basic, 5=exhaustive); default 1
     *   --risk <1-3>       Risk level (3 includes heavy queries); default 1
     *   --technique <str>  Injection technique: B=boolean, E=error, U=union, S=stacked, T=time, Q=inline
     *   --batch            Non-interactive (auto-accept defaults)
     *   --threads <n>      Concurrent requests
     *   --random-agent     Random User-Agent
     *   --tamper <csv>     WAF bypass scripts: apostrophemask, randomcase, space2comment...
     *   --dbs              Enumerate databases
     *   --tables           Enumerate tables (-D <db>)
     *   --columns          Enumerate columns (-D <db> -T <table>)
     *   --dump             Dump table data
     *   --current-user     Get DB user
     *   --is-dba           Check if user is DBA
     *   --os-cmd <cmd>     Execute OS command (if stacked injection possible)
     *   --forms            Auto-detect and test forms on the page
     *   --crawl <depth>    Crawl site for injectable params
     */
    runSqlmap: import("ai").Tool<{
        target: string;
        level: number;
        risk: number;
        techniques: string;
        goal: "detect" | "enumerate-dbs" | "enumerate-tables" | "dump" | "os-shell";
        threads: number;
        forms: boolean;
        postData?: string | undefined;
        cookie?: string | undefined;
        dbms?: "sqlite" | "mysql" | "postgresql" | "mssql" | "oracle" | "db2" | undefined;
        database?: string | undefined;
        table?: string | undefined;
        tamper?: string[] | undefined;
    }, {
        target: string;
        goal: "detect" | "enumerate-dbs" | "enumerate-tables" | "dump" | "os-shell";
        isVulnerable: boolean;
        injectableParams: string[];
        outputDir: string;
        raw: string;
    }>;
    /**
     * subfinder [flags]
     *
     * Key flags (docs.projectdiscovery.io/opensource/subfinder/usage):
     *   -d <domain>        Single domain
     *   -dL <file>         Domain list file
     *   -s <csv>           Specific sources: crtsh,github,virustotal,...
     *   -all               Use all passive sources (slow)
     *   -recursive         Recursive subdomain resolution
     *   -o <file>          Output file
     *   -oJ                JSON lines output
     *   -silent            Subdomains only (clean output for piping)
     *   -t <int>           Goroutines for resolution (default 10)
     *   -rl <int>          Rate limit req/s
     *
     * API keys stored in: ~/.config/subfinder/provider-config.yaml
     * Without keys: crtsh, dnsdumpster, waybackarchive, hackertarget still work.
     */
    runSubfinder: import("ai").Tool<{
        domain: string;
        allSources: boolean;
        recursive: boolean;
        sources?: string[] | undefined;
    }, {
        domain: string;
        subdomainCount: number;
        subdomains: string[];
        outputFile: string;
    }>;
    /**
     * nuclei [flags]
     *
     * Key flags (from github.com/projectdiscovery/nuclei README):
     *   -u <url>          Single target URL/host
     *   -l <file>         Target list file
     *   -t <dir/file>     Template path (default: ~/.local/nuclei-templates)
     *   -tags <csv>       Filter by tag: cve,exposures,misconfigurations,default-logins,kev,vkev
     *   -severity <csv>   Filter: info,low,medium,high,critical
     *   -exclude-tags     Tags to skip
     *   -rl <int>         Rate limit (requests/sec)
     *   -c <int>          Concurrency
     *   -o <file>         Output file
     *   -json             JSON output
     *   -je <file>        JSON-lines export
     *   -nc               No colour
     *   -silent           Only findings
     *   -update-templates Auto-update community templates
     *
     *   Special tag combos:
     *   -tags kev        CISA Known Exploited Vulnerabilities (1496+ templates)
     *   -tags vkev       Vendor-confirmed KEV
     */
    runNuclei: import("ai").Tool<{
        target: string;
        severity: ("medium" | "info" | "critical" | "high" | "low")[];
        rateLimit: number;
        concurrency: number;
        updateTemplates: boolean;
        tags?: string[] | undefined;
        excludeTags?: string[] | undefined;
    }, {
        target: string;
        findingCount: number;
        bySeverity: Record<string, number>;
        findings: {
            templateId: string;
            name: string;
            severity: string;
            host: string;
            matched: string;
        }[];
        outputFile: string;
        raw: string;
    }>;
    /**
     * nmap [scan type] [timing] [port range] [script] [-oA output] <target>
     *
     * Key flags (from nmap.org & offseckit.com cheat sheet):
     *   -sS          SYN stealth scan (default, requires root/admin)
     *   -sV          Service/version detection
     *   -O           OS fingerprinting
     *   -sC          Default NSE scripts (equiv. --script=default)
     *   --script     NSE script or category: vuln, safe, default, auth, brute, discovery
     *   --script-args mincvss=7.0   filter CVE results by minimum CVSS score
     *   -p-          All 65535 ports
     *   -F           Fast: top 100 ports
     *   -T0..T5      Timing: T1=sneaky, T2=polite, T3=normal, T4=aggressive, T5=insane
     *   -Pn          Skip host discovery (treat all hosts as online)
     *   -f           Fragment packets (evade some firewalls)
     *   --open       Show only open ports in output
     *   -oA <base>   Output all formats: .nmap .xml .gnmap
     *   -iL <file>   Input target list from file
     *   -sU          UDP scan
     *   -sn          Host discovery only (ping sweep), no port scan
     */
    runNmap: import("ai").Tool<{
        target: string;
        scanType: "full" | "quick" | "udp" | "stealth" | "discovery";
        osDetect: boolean;
        timing: number;
        skipHostDiscovery: boolean;
        scripts?: ("default" | "discovery" | "vuln" | "safe" | "auth" | "brute" | "vulners")[] | undefined;
        minCvss?: number | undefined;
        ports?: string | undefined;
    }, {
        target: string;
        openPorts: {
            port: number;
            service: string | undefined;
        }[];
        cves: {
            cve: string;
            cvss: number;
        }[];
        outputFiles: {
            normal: string;
            xml: string;
            grepable: string;
        };
        raw: string;
    }>;
};
//# sourceMappingURL=pentest.tool.d.ts.map