Scaner

Automated reconnaissance framework for bug bounty and penetration testing. Covers passive and active recon, subdomain enumeration, port scanning, and web fingerprinting.

Features

• Subdomain enumeration via Subfinder, Amass, and DNS brute-force
• HTTP probing and status filtering with httpx
• Port scanning with Nmap (top ports + full scan mode)
• Directory brute-forcing with ffuf and Gobuster
• Historical URL discovery via Wayback Machine and GAU
• JavaScript file analysis for endpoints and secrets
• Nuclei templated vulnerability scanning

Usage

./scaner.sh -d target.com           # Full recon
./scaner.sh -d target.com -m quick  # Quick mode (passive only)
./scaner.sh -d target.com -m full   # Full active recon

Output

Results are saved to output/<target>/:

output/target.com/
├── subdomains.txt       # All discovered subdomains
├── alive.txt            # Live hosts (httpx)
├── ports.txt            # Open ports (Nmap)
├── urls.txt             # Historical URLs
├── js-endpoints.txt     # Endpoints from JS files
└── nuclei-results.txt   # Vulnerability scan results

Requirements

# Install all tools
apt install -y nmap ffuf gobuster
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/owasp-amass/amass/v4/...@master
pip install waybackurls gau

Methodology

1. Passive recon — Subfinder, Amass, crt.sh, Wayback crawl
2. Active probing — httpx status checks, technology fingerprinting
3. Port scanning — Nmap service and version detection
4. Directory brute-force — ffuf with custom wordlists
5. Vuln scanning — Nuclei community templates

---

Built for authorized testing only. Always operate within scope.