A fully passive OSINT reconnaissance tool for domains — zero requests to the target server.
Lumina collects data exclusively from third-party public sources, making it completely safe and undetectable for security researchers, penetration testers, and bug bounty hunters.
| Module | Source | API Key |
|---|---|---|
| Subdomain Enumeration | crt.sh + HackerTarget + AlienVault OTX | ❌ Free |
| Wayback Machine URLs | web.archive.org | ❌ Free |
| GitHub Leaks | GitHub Search API | ✅ Free |
| Shodan Hosts & Ports | Shodan API | ✅ Free |
| Email Harvesting | Hunter.io API | ✅ Free |
| DNS Records | Google DNS (A, MX, NS, TXT, AAAA) | ❌ Free |
| Tech Stack Detection | HTTP headers & HTML analysis | ❌ Free |
| WHOIS Lookup | python-whois | ❌ Free |
| HTML Report | Beautiful dark-theme report | ❌ — |
| JSON Export | Automatic alongside HTML | ❌ — |
git clone https://github.com/surfruit/lumina
cd lumina
pip install -r requirements.txt
cp .env.example .envEdit .env and add your API keys:
GITHUB_TOKEN=your_github_token
SHODAN_API_KEY=your_shodan_api_key
HUNTER_API_KEY=your_hunter_api_key# Basic scan
python main.py -d example.com
# Custom output file
python main.py -d example.com -o results.html
# Skip GitHub search
python main.py -d example.com --skip-github
# Skip Shodan search
python main.py -d example.com --skip-shodan# Build
docker build -t lumina .
# Run — report will be saved to ./reports/
docker run --env-file .env -v $(pwd)/reports:/app/reports lumina -d example.com -o reports/report.html# Edit docker-compose.yml and set your domain, then:
docker-compose run lumina -d example.com -o reports/report.htmlAll API keys are free:
| Service | Purpose | Link |
|---|---|---|
| GitHub | Leaked secrets search | github.com/settings/tokens |
| Shodan | Open ports & hosts | account.shodan.io |
| Hunter.io | Email harvesting | hunter.io/api-keys |
lumina/
├── main.py # CLI entry point
├── modules/
│ ├── subdomains.py # crt.sh + HackerTarget + AlienVault
│ ├── wayback.py # Wayback Machine URLs
│ ├── github_leaks.py # GitHub leaked secrets search
│ ├── shodan.py # Shodan hosts & ports
│ ├── emails.py # Hunter.io email harvesting
│ ├── dns_lookup.py # DNS records (A, MX, NS, TXT, AAAA)
│ ├── tech_detect.py # Technology stack detection
│ └── whois_lookup.py # WHOIS registrar & domain info
├── report/
│ ├── generator.py # HTML + JSON report generator
│ └── template.html # Dark-theme HTML template
├── reports/ # Output directory
├── Dockerfile
├── docker-compose.yml
├── .env.example
├── requirements.txt
├── CONTRIBUTING.md
└── README.md
See CONTRIBUTING.md for full guide. Quick example:
import httpx
async def your_module(domain: str):
results = []
try:
async with httpx.AsyncClient(timeout=15) as client:
# your logic here
pass
except Exception as e:
print(f"[-] Error: {e}")
return results- WHOIS lookup — registrar, creation date, owner info
- JSON export alongside HTML report
- Multiple subdomain sources (HackerTarget, AlienVault OTX)
- Docker support
- VirusTotal integration — malware & reputation check
- Pastebin & GitHub Gist monitoring
- SecurityTrails API support
- Slack / Telegram notifications when scan completes
- Multiple domains scan at once
- Web UI — browser-based interface
- Scan history & comparison
- Scheduled automatic scans
- CVE lookup for detected technologies
💡 Have an idea? Open an issue or contribute via pull request!
This tool is intended for legal use only — authorized security testing, bug bounty programs, and OSINT research. The author is not responsible for any misuse. Always ensure you have permission before scanning any domain.
MIT License — free to use and modify.
Made with ❤️ for the OSINT & security community