Built from scratch. No borrowed engines. Pure Şakaloz.
███████╗ █████╗ ██╗ ██╗ █████╗ ██╗ ██████╗ ███████╗
██╔════╝██╔══██╗██║ ██╔╝██╔══██╗██║ ██╔═══██╗╚══███╔╝
███████╗███████║█████╔╝ ███████║██║ ██║ ██║ ███╔╝
╚════██║██╔══██║██╔═██╗ ██╔══██║██║ ██║ ██║ ███╔╝
███████║██║ ██║██║ ██╗██║ ██║███████╗╚██████╔╝███████╗
╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝ ╚═════╝ ╚══════╝
Use Şakaloz only on systems you own or have explicit written permission to test. Unauthorized scanning is illegal. The authors take no responsibility for misuse.
| Module | What it does |
|---|---|
| 🔌 Network Scanner | Port scanning, banner grabbing, service detection |
| 🌐 Web Scanner | XSS, SQLi, Directory Traversal, Open Redirect, Sensitive paths, Security headers |
| 🔍 CVE Lookup | Real-time CVE search via public API |
| 💥 Exploit Guidance | Step-by-step exploitation instructions for each found vulnerability |
| 📄 Report Generator | Saves full JSON report of all findings |
# No external dependencies required — pure Python 3
git clone https://github.com/Pr0fessorSnApe/Sakaloz.git
cd sakaloz
python sakaloz.py --helppython sakaloz.py --target 192.168.1.1 --url http://192.168.1.1 --allpython sakaloz.py --target 192.168.1.1 --ports 1-65535 --threads 200python sakaloz.py --url "http://testsite.com/page?id=1"python sakaloz.py --cve "Apache 2.4,OpenSSH 7.2,MySQL 5.7"python sakaloz.py --target 192.168.1.1 --url http://site.com --output report.json[*] Scanning 192.168.1.1 ports 1-1024 ...
[+] Port 22/tcp OPEN [SSH]
[+] Port 80/tcp OPEN [HTTP]
Banner: Apache/2.4.29
[+] Port 3306/tcp OPEN [MySQL]
[VULN] Try default creds: root/root, root/(blank)
[*] Testing XSS vulnerabilities...
[VULN] XSS found! Param: q | Payload: <script>alert('XSS')</script>
[*] CVE Lookup: Apache
[VULN] CVE-2021-41773 CVSS:7.5 — Path traversal in Apache 2.4.49
[EXPLOITATION GUIDANCE]
[XSS] — How to go further:
1. Steal session cookies: <script>document.location=...
2. Keylogger injection via XSS payload
sakaloz.py
├── Module 1: Network Scanner
│ ├── Port scanner (multi-threaded)
│ ├── Banner grabbing
│ └── Service vulnerability hints
├── Module 2: Web Scanner
│ ├── XSS detection
│ ├── SQL Injection detection
│ ├── Directory Traversal
│ ├── Open Redirect
│ ├── Sensitive path discovery
│ └── Security header audit
├── Module 3: CVE Lookup
│ └── Real-time search via cve.circl.lu
├── Module 4: Exploit Guidance
│ └── Step-by-step next steps per vulnerability
└── Report Generator
└── JSON output
- Şakaloz v2: HTML report with charts
- Şakaloz v2: Subdomain enumeration
- Şakaloz v2: SSL/TLS misconfiguration checks
- Şakaloz v3: Active brute force module
- Şakaloz v3: Custom payload files
- Şakaloz v3: Shodan API integration
Pr0fessor_Snape
Şakaloz Security Research Built with 🦅 and pure Python.
"A hunter that sees everything."