Skip to content

Modules

Jump to bottom
Harm-r edited this page Jul 4, 2025 · 3 revisions

This page explains how to use each module.

Katana

GitHub

Katana is a web crawler that is used by Asteroid to gather URLs. Afterward, these URLs are filtered for duplicates and false positives using uro and httpx.

Arguments:

  • -headless: Runs Katana with a headless browser. This helps against bot detection and provides better coverage, but decreased performance.
  • -tl or --time-limit: The time limit for Katana. Format: 10m, 1h, 30s, etc.
  • -H or --headers: Use headers with Katana. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.
  • --dont-scan: Prevents Katana from scanning certain URLs using a regular expression. This is great if you do not want Katana to log you out of your session, or perform destructive actions. Defaults to .*(logout|uitloggen).* to prevent logouts.

Feroxbuster

GitHub

Feroxbuster is used by Asteroid to bruteforce URLs.

Arguments:

  • -w or --wordlist: The wordlist used by Feroxbuster. This is raft-small-words.txt from SecLists by default.
  • -tl or --time-limit: The time limit for Feroxbuster. Format: 10m, 1h, 30s, etc.
  • -d or --depth: The maximum recursive depth for Feroxbuster. Defaults to 10.
  • -C: A list of status codes separated by commas. Feroxbuster will filter URLs with these status codes in its output. Defaults to 500,404,403,401,400.
  • -x or --extensions: A list of extensions for Feroxbuster to append to the words in the wordlist. You can also read these extensions from a file using @ext.txt, where ext.txt contains a list of extensions separated by newlines. Defaults to php,html.
  • -H or --headers: Use headers with Feroxbuster. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.
  • --dont-scan: Prevents Feroxbuster from scanning certain URLs using a regular expression. This is great if you do not want Feroxbuster to log you out of your session, or perform destructive actions. Defaults to .*(logout|uitloggen).* to prevent logouts.

Gau

GitHub

Asteroid uses Gau to passively gather URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl. Afterward, these URLs are filtered for duplicates and false positives using uro and httpx.

Arguments:

  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.

Arjun

GitHub

Arjun is used for parameter mining: it bruteforces GET query parameters for the gathered URLs. It does not run by default, as this can take quite a long time. URLs with static file extensions like .css are filtered out first.

Arguments:

  • -H or --headers: Use headers with Arjun. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.
  • -aw or --arjun-wordlist: Wordlist of parameters to bruteforce. Defaults to params.txt from param-miner.

Directory Listing

This module scans the Feroxbuster output for open directory listings. It does not have any additional arguments.

Sensitive Files

Runs Feroxbuster again, but this time with a separate wordlist for sensitive files by Bo0om.

Arguments:

  • -sfw or --sensitive-files-wordlist: The wordlist used by Feroxbuster for sensitive files discovery. This is fuzz.txt from Bo0om by default.
  • -tl or --time-limit: The time limit for Feroxbuster. Format: 10m, 1h, 30s, etc.
  • -C: A list of status codes separated by commas. Feroxbuster will filter URLs with these status codes in its output. Defaults to 500,404,403,401,400.
  • -H or --headers: Use headers with Feroxbuster. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.
  • --dont-scan: Prevents Feroxbuster from scanning certain URLs using a regular expression. This is great if you do not want Feroxbuster to log you out of your session, or perform destructive actions. Defaults to .*(logout|uitloggen).* to prevent logouts.

Trufflehog

GitHub

This module downloads all gathered URLs with curl and runs Trufflehog on these downloaded files to detect secrets. Download size is limited to 100K by default. As this module can download a lot of files and fill up disk space in some cases, it does not run by default.

Arguments:

  • --cleanup: Deletes all downloaded files afterward.
  • -H or --headers: Use headers with Curl. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.

Extension Inspector

This is a Python implementation of the Nuclei template by ayadim. It detects interesting file extensions in URLs and reports them.

It does not have any additional arguments.

Vulnscan

This module detect used technologies using wappalyzer-next and uses the search_vulns API to search for CVEs for these technologies.

Arguments:

  • -s or --size: maximum number of results per technology. Defaults to 5.

RetireJS

In this module, RetireJS is used to detect vulnerable JavaScript libraries. It uses a Python 3 adaptation from ghostlulzhacks.

It does not have any additional arguments.

Nuclei

Nuclei is one of the main modules of this scanner. It uses Nuclei DAST to detect web application vulnerabilities, and also runs some other basic Nuclei checks. Nuclei is ran 6 times in total:

  1. Nuclei DAST on URLs: Nuclei DAST is ran and the URLs with query parameters using templates from the custom-templates directory. Output is stored in nuclei-urls.txt.
  2. Nuclei DAST on forms: Nuclei DAST is ran on the forms gathered by Katana using templates from the custom-templates directory. Output is stored in nuclei-forms.txt.
  3. Nuclei SSL checks: All Nuclei SSL templates are run on the target domain. Output is stored in nuclei-ssl.txt.
  4. Nuclei header checks: Nuclei checks for missing security headers. Output is stored in nuclei-headers.txt.
  5. Nuclei Cookie checks: The cookies on the target domain are checked with Nuclei for flags like HttpOnly etc. Output is stored in nuclei-cookies.txt.
  6. Nuclei file uploads: Nuclei is used to detect pages with a file upload, which is used later by the File Upload module. Output is stored in nuclei-file-uploads.txtt. Finally, all results from the separate Nuclei runs are merged into nuclei.txt and displayed.

Arguments:

  • -H or --headers: Use headers with Nuclei. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.

File Upload

This is a custom module and still a work-in-progress. Currently, it only works for PHP webservers. It detects a successful file upload vulnerability via HTTP status codes, so it can be prone to false positives.

The module executes the following steps:

  1. Visit the URLs that have a file upload form gathered by Nuclei.
  2. Detect the file upload form.
  3. Use the output wappalyzer-next output from the Vulnscan module to detect the technology of the web server, e.g. PHP.
  4. Try multiple malicious file uploads for that technology.
  5. If the server returns a successful HTTP status code like 200 OK, report a file upload vulnerability.

Arguments:

  • -H or --headers: Use headers with requests. This is great for authenticated scanning with cookies, e.g. -H 'Cookie: <your-cookie>'
  • --proxy: Proxy to use, e.g. http://127.0.0.1:8080 for Burp. Great for debugging. Also works with SOCKS5 proxies.

Clone this wiki locally