-
Notifications
You must be signed in to change notification settings - Fork 0
Home
A comprehensive, custom-built suite of 47 security research and OSINT (Open Source Intelligence) tools for educational purposes. All tools are standalone Python scripts with no external tool wrappers.
# List all available tools
python3 main.py
# Get help for a specific tool
python3 main.py <tool> --help
# Example: scan ports
python3 main.py port-scan example.com
# Example: find subdomains
python3 main.py subdomain example.compip install requests beautifulsoup4 colorama Pillow dnspython11 tools support local LLM integration via Ollama for smarter analysis and payload generation.
# First: install Ollama and pull a model
# Then: add --ollama-model to any supported tool
python3 main.py admin example.com --ollama-model llama3.2
python3 main.py dir-bust example.com --ollama-model llama3.2
python3 main.py fuzz example.com/page?id=1 --ollama-model llama3.2
python3 main.py redirects example.com --ollama-model llama3.2
python3 main.py robots example.com --ollama-model llama3.2
python3 main.py shodan example.com --ollama-model llama3.2See wiki/tools/ollama-integration.md for details.
Tools to gather information about a target.
| Tool | Description |
|---|---|
| subdomain | Discover subdomains via brute force |
| dns | DNS enumeration and record discovery |
| certsearch | Certificate Transparency log search |
| reverseip | Find domains on same IP |
| whois | WHOIS domain/IP lookups |
| asn | ASN and network range lookup |
| geoip | IP geolocation |
| cve | CVE vulnerability search |
| github | GitHub OSINT (users, repos, code) |
| username | Username search across 100+ platforms |
| breach | Data breach checker |
| cloud | Cloud service enumeration |
| smtp | SMTP server enumeration |
| shodan | Shodan.io device and service search |
| mac-address | MAC address vendor/OUI lookup |
Tools to analyze websites and web technologies.
| Tool | Description |
|---|---|
| tech | Detect web technologies (CMS, frameworks, CDN, etc.) |
| headers | HTTP security header analysis |
| ssl | SSL/TLS certificate inspection |
| waf | WAF detection (30+ signatures) |
| crawl | Recursive website crawler |
| links | Link extraction and health check |
| Email address extraction | |
| sociallinks | Social media link extraction |
| forms | HTML form security analysis |
| js | JavaScript endpoint/secret extraction |
| wayback | Wayback Machine historical URLs |
| dork | Google dork query generator |
| robots | Robots.txt and sitemap.xml recon analyzer |
| favicon | Favicon hash calculator for Shodan |
| redirects | HTTP redirect chain analyzer |
Tools to identify security vulnerabilities.
| Tool | Description |
|---|---|
| port-scan | TCP port scanner with banner grab |
| dir-bust | Directory/file brute force |
| fuzz | URL and parameter fuzzing |
| httpmethods | HTTP method enumeration |
| cors | CORS misconfiguration checker |
| sqli | SQL injection scanner |
| xss | XSS vulnerability scanner |
| admin | Admin panel finder |
| openredirect | Open redirect checker |
| Tool | Description |
|---|---|
| metadata | File metadata/EXIF extraction |
| link | Link analysis |
Find admin panels and login pages.
Scans 100+ common admin panel paths and checks for login indicators.
python3 main.py admin https://example.com
ASN, network range, and ISP information lookup.
Uses ip-api.com and bgpview.io to resolve ASN details.
python3 main.py asn 8.8.8.8
python3 main.py asn AS15169
python3 main.py asn example.com
Data breach checker.
Check emails against the HIBP API and passwords against known breaches.
python3 main.py breach email@example.com
python3 main.py breach mypassword --type password
Certificate Transparency log search.
Queries crt.sh and CertSpotter for SSL certificate records to discover subdomains.
python3 main.py certsearch example.com
python3 main.py certsearch example.com --all
Cloud service enumeration.
Tests bucket names across AWS S3, Azure Blob, GCP Storage, Firebase, Heroku, Netlify, Vercel, and 10+ other cloud platforms.
python3 main.py cloud example.com
CORS misconfiguration checker.
Tests 10+ origin variations (null, subdomain, different domain, prefix, suffix, etc.) to find overly permissive CORS policies.
python3 main.py cors https://api.example.com
Recursive web crawler.
Crawls a website up to a specified depth, building a URL tree.
python3 main.py crawl https://example.com --depth 3 --max-urls 200
CVE vulnerability search.
Queries CIRCL and NVD databases for known vulnerabilities matching a keyword.
python3 main.py cve log4j
python3 main.py cve wordpress --limit 50
Directory and file brute force.
Tests 1000+ common web paths. Optionally appends common extensions (.php, .asp, etc.).
python3 main.py dir-bust https://example.com
python3 main.py dir-bust https://example.com --extensions
python3 main.py dir-bust https://example.com -w /path/to/wordlist.txt
DNS enumeration.
Resolves A, AAAA, MX, NS, TXT, CNAME, SOA records. Optionally attempts zone transfer.
python3 main.py dns example.com
python3 main.py dns example.com --zone-transfer
Google dork generator.
Generates organized Google search queries across 12 categories (Admin panels, Logs, Config files, Database, etc.).
python3 main.py dork
python3 main.py dork --domain example.com
python3 main.py dork --category "Login"
Email address extractor.
Extracts email addresses from web pages using regex patterns.
python3 main.py email https://example.com
python3 main.py email https://example.com --crawl --depth 2
HTML form security analysis.
Analyzes forms for password fields over HTTP, missing CSRF tokens, autocomplete enabled, and more.
python3 main.py forms https://example.com/login
Favicon hash calculator.
Downloads a site's favicon and computes its mmh3 hash for Shodan-based device identification.
python3 main.py favicon example.com
URL fuzzing tool.
Tests URL parameters with fuzz payloads including XSS, SQLi, path traversal, and more.
python3 main.py fuzz https://example.com/page?id=1
python3 main.py fuzz https://example.com/page --params id,page,user
IP geolocation.
Resolves IP address or domain to geographic location with map visualization.
python3 main.py geoip 8.8.8.8
python3 main.py geoip example.com
python3 main.py geoip me
GitHub OSINT.
Query GitHub for user profiles, repository info, or code search.
python3 main.py github john --mode user
python3 main.py github tensorflow --mode repo
python3 main.py github "api key" --mode search
HTTP security header analyzer.
Checks for 20+ security headers and rates security posture.
python3 main.py headers example.com
HTTP method enumeration.
Tests 9 HTTP methods (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE, CONNECT) and flags dangerous ones.
python3 main.py httpmethods https://example.com
JavaScript scraper.
Extracts API endpoints, routes, secrets, and hardcoded strings from JavaScript files.
python3 main.py js https://example.com
python3 main.py js https://example.com --threads 30
Link extractor.
Extracts all links from a web page and optionally checks their HTTP status.
python3 main.py links https://example.com
python3 main.py links https://example.com --check
MAC address vendor lookup.
Looks up the vendor/OUI for a MAC address using macvendors.com API and a local OUI database.
python3 main.py mac-address 00:11:22:33:44:55
Metadata extractor.
Extracts metadata/EXIF from images, PDFs, office documents, and audio files.
python3 main.py metadata /path/to/file.jpg
python3 main.py metadata /path/to/directory/
Open redirect checker.
Tests URL parameters for open redirect vulnerabilities using 12 payload types.
python3 main.py openredirect https://example.com/page?url=http://evil.com
python3 main.py openredirect https://example.com
TCP port scanner.
Scans common ports with banner grabbing and multi-threading.
python3 main.py port-scan example.com
python3 main.py port-scan 192.168.1.1 --ports 1-1000
python3 main.py port-scan example.com --ports 22,80,443,3306
Redirect chain tracker.
Traces the full HTTP redirect chain with security analysis, detecting loops, HTTPS→HTTP downgrades, and open redirects.
python3 main.py redirects example.com
python3 main.py redirects example.com --ollama-model llama3.2
Reverse IP lookup.
Finds all domains hosted on the same IP address using multiple sources.
python3 main.py reverseip example.com
python3 main.py reverseip 8.8.8.8
Robots.txt & sitemap analyzer.
Fetches and analyzes robots.txt and sitemap.xml for hidden resources, disallowed paths, and recon opportunities.
python3 main.py robots example.com
python3 main.py robots example.com --ollama-model llama3.2
Shodan.io search.
Searches Shodan for devices, services, and open ports. Supports host lookup and search query modes.
python3 main.py shodan example.com
python3 main.py shodan --query "apache 2.4.49 country:US"
python3 main.py shodan example.com --ollama-model llama3.2
SMTP enumeration.
Resolves MX records, connects to SMTP servers, enumerates supported commands, and checks for open relay.
python3 main.py smtp example.com
python3 main.py smtp example.com --port 587
Social media link extractor.
Finds links to 40+ social media platforms in a website's HTML.
python3 main.py sociallinks https://example.com
SQL injection scanner.
Tests URL parameters with 14 SQL injection payloads and checks responses for error patterns.
python3 main.py sqli https://example.com/page?id=1
SSL/TLS checker.
Inspects SSL certificate details including issuer, validity, SANs, and cipher info.
python3 main.py ssl example.com
python3 main.py ssl example.com --port 8443
Subdomain finder.
Brute-forces subdomains using a built-in list of 1000+ common subdomains.
python3 main.py subdomain example.com
python3 main.py subdomain example.com -w /path/to/wordlist.txt
Technology detector.
Identifies 100+ web technologies including CMS, frameworks, CDN, WAF, analytics, JS libraries, and databases.
python3 main.py tech example.com
Username search.
Searches for a username across 100+ social media and web platforms (sherlock-style).
python3 main.py username john
python3 main.py username john --platforms github,twitter,reddit
WAF detector.
Detects 30+ Web Application Firewalls and reverse proxies by analyzing response headers/cookies and probing with malicious payloads.
python3 main.py waf https://example.com
Wayback Machine scraper.
Fetches historical snapshots of a domain from the Wayback Machine.
python3 main.py wayback example.com
python3 main.py wayback example.com --limit 200
WHOIS lookup.
Performs WHOIS queries for domain registration or IP address information.
python3 main.py whois example.com
python3 main.py whois 8.8.8.8
XSS scanner.
Tests URL parameters and forms with 12 XSS payloads and checks for reflection in responses.
python3 main.py xss https://example.com/page?q=test
Every tool follows the same interface:
class ToolName:
name = "tool-name" # CLI subcommand name
description = "Short description"
@staticmethod
def run(target, **kwargs):
# Perform operations
# Print output via utils.output helpers
return {"result": data}Located in utils/output.py, these provide colorized terminal output:
| Function | Color | Usage |
|---|---|---|
section(title) |
Cyan | Section headers |
info(text) |
Blue | Informational messages |
success(text) |
Green | Positive findings |
warning(text) |
Yellow | Warnings/flagging |
error(text) |
Red | Errors |
result(label, value) |
White/Yellow | Key-value results |
table(headers, rows) |
White | Tabular data |
These tools are provided for educational purposes only. Unauthorized scanning, probing, or attacking of systems you do not own or have explicit written permission to test is illegal and unethical. Users are solely responsible for complying with all applicable laws.