FindIt is a security-focused domain reconnaissance and scanning platform designed for penetration testers, security researchers, and red team professionals. The project aims to provide fast, accurate, and scalable reconnaissance through a microservices-based architecture with both Web and CLI interfaces.
This repository is currently under active development.
Development Stage: Active
Stability: Pre-release / Not production-ready
The core architecture and services are being built incrementally. APIs, internal logic, and service boundaries may change as the project evolves.
- Build a modern reconnaissance platform for real-world penetration testing
- Provide high-performance scanning with security-first design
- Support both web-based and command-line workflows
- Follow clean architecture and microservices principles
- Ensure strong protection against common web and API vulnerabilities
- Microservices-based project structure defined
- Clear separation of services (API Gateway, Auth, Recon, Scan)
- Modular and extensible service layout
- Docker-based local development setup (in progress)
- Initial API Gateway service implemented in Go
- Service routing and request handling structure defined
- Middleware structure added for:
- Input validation
- Rate limiting
- Authentication hooks
- Basic service-to-service communication design completed
- Core domain reconnaissance logic designed
- Domain and subdomain enumeration logic implemented (early stage)
- IP resolution and DNS data handling implemented
- Technology detection logic under development
- C++-based high-performance scanning experiments completed and evaluated
- CLI tool concept finalized
- Initial domain scanning logic implemented
- Modular command structure planned for future extensions
- Next.js frontend structure initialized
- Secure API communication design planned
- UI/UX architecture defined for scan dashboards and results
- Security-first approach adopted from the beginning
- Planned protections implemented/under development:
- Input validation
- Output encoding
- Rate limiting
- Secure authentication flow
- Threat models defined for:
- XSS
- SQL Injection
- CSRF
- SSRF
- IDOR
- Denial of Service attacks
- Go (Microservices)
- REST APIs
- WebSockets (planned)
- PostgreSQL (NeonDB)
- Redis (planned)
- Next.js
- Tailwind CSS
- Python / Go (final decision pending)
- Docker
- Docker Compose
- Planned CI/CD pipeline
- Stabilize API Gateway
- Complete Auth Service (JWT, role-based access)
- Finalize Recon Service v1
- Improve scanning accuracy and performance
- Implement secure service-to-service authentication
- CLI MVP with essential recon features
- Web UI MVP with:
- Scan management
- Result visualization
- Export options
- Advanced technology fingerprinting
- Port scanning and service detection
- Certificate and TLS analysis
- Background job processing for large scans
- Vulnerability indicators and misconfiguration detection
- Distributed scanning support
- User-defined scan templates
- Alerting and notification system
- Plugin-based architecture for custom scanners
- Cloud-native deployment support
Documentation is under development and will be expanded as features stabilize.
Planned documentation includes:
- Installation and setup guide
- API documentation
- CLI usage guide
- Architecture overview
- Security design and threat model
The project is still stabilizing. Contributions will be enabled once core services reach a stable state.
For now:
- Issues and suggestions are welcome
- Design discussions are encouraged
License details will be added before the first stable release.
This project is intended strictly for authorized security testing and educational purposes.
Usage against systems without explicit permission is illegal and unethical.
Vyom Jain
[ Security Engineer ]