ANANSI CLI

             ;                  &              
           ;;                    ;&            
          ;;;                    ;;;           
     ;    ;;;                    ;;;    ;      
     ;;;  ;;;        ;   ;;      ;;;   ;;;     
     ;;;;  ;;;;   ;;; && ;;;   ;;;;   ;;;;     
      ;;;;   ;;;; ;;;;;;;;;; ;;;;    ;;;;      
        ;;;;;;;;; ;;;;;;;;;;;;;;;; ;;;;;;;;;    
            &;;;;;;;;;;;;$x;;;;;;;;;;;;         
           ;;;;;;;;;;&&&+++&&&;;;;;;;;;;;       
     ;;;;;;;;;  ;;;&&+&&&&&+&&;;;  ;;;;;;;;;;  
     ;;;&    ;; ;;;&+&&&&&&&+&&;;; ;;    &;;;  
     ;;;   ;;;;  ;;;&&+&&&&&&+&;;; ;;;;   ;;;  
     ;;;   ;;;   ;;;;&&++&++++&&;;  ;;;   ;;;  
      ;;   ;;;    ;;;;;;;;;;;&&&&;  ;;;   ;;   
      ;;   ;;;      ;;;;;;;;;;;;;;  ;;;   ;;   
       ;   ;;;        ;;;;;;;;;;    ;;;   ;    
           &;;           ;;;;       ;;&        
             ;;           ;;       ;;;          
               ;                 ;

ANANSI CLI

Attack Surface Intelligence Engine — Terminal Edition

Built by QYVORA OffSec — Tamale, Ghana

anansi target.com
anansi scan target.com
anansi target.com --verbose
anansi target.com --deep
anansi target.com -o json > results.json
anansi target.com --modules discovery,tls,takeover

Only scan targets you own or have explicit written permission to test.

What it does

ANANSI CLI is a terminal-first attack surface recon tool for pentesters and bug bounty hunters. Give it a domain — it runs a full ten-phase intelligence and exploitation pipeline and prints raw technical output you can act on immediately.

By default, ANANSI filters out the noise and only displays found assets (e.g., live subdomains, active HTTP/HTTPS hosts, successful TLS certificates, missing security headers on live URLs, exposed paths, and confirmed takeovers). This keeps your terminal clean. If you want to see all attempted checks, including dead subdomains, failed connections, and unchecked endpoints, simply enable the verbose flag (-v/--verbose).

Phase	Module	What it finds
01	DISCOVERY	Subdomains via crt.sh CT logs + DNS brute-force wordlist
02	PROBE	Live HTTP/HTTPS hosts — status codes, servers, redirect chains, titles
03	TLS	Certificate expiry, SANs, protocol version, cipher, self-signed detection
04	HEADERS	Missing security headers, CORS misconfigurations
05	PATHS	Exposed files — `.env`, `.git`, configs, admin panels, backups, API docs
06	TECH-STACK	Deep audit of detected platforms — version detection, WordPress plugins/themes, XML-RPC, user enumeration, config backups, known-vulnerable version matching
07	TAKEOVER	Dangling CNAMEs pointing to unclaimed cloud services
08	OSINT	Emails, phone numbers, employees, WHOIS registrant data
09	CHAIN	Assembles findings into multi-step exploit paths (low → high → critical) with per-step exploitation techniques
10	EXPLOIT	Actively proves exploitable findings against the authorized target with live HTTP request/response evidence

Performance & Architecture

Native Go DNS Resolver: Bypasses slow cgo-blocked system lookups using pure Go goroutines.
Shared Connection Pool: A single process-wide HTTP transport with keep-alives is reused across every phase and every module, so TCP + TLS handshakes happen once per host instead of once per request.
TTL DNS Cache: Resolved subdomains are cached for 60s, so recursive/mutation/TLS-SAN phases never re-query the resolver for the same name.
Fixed Worker Pools: Paths, discovery, probe, and techstack all run on fixed worker pools (one goroutine per --threads, jobs pulled from a channel). No goroutine-per-job churn — even an 8,000+ rule path sweep stays at stable concurrency.
Concurrent Probing: HTTP Probes, TLS analyses, and Security Header checks are fully parallelized.
Smart Takeover Filtering: Targets only subdomains with verified dead CNAME records.
Parallel Exposed Path Probing: Custom 404 baselines fetched concurrently; the deep-audit module adds a soft-404 baseline so catch-all servers don't produce false positives.
Version reuse: the tech-stack module reads CMS versions from generator meta tags and static-asset query strings already present in the homepage body, and discovers WordPress plugins from the same body — minimising extra requests.
robots.txt mining: every live host's robots.txt Allow/Disallow entries are turned into extra path probes, surfacing intentionally-hidden directories for one extra request per host.

Tech-Stack Deep Audit

When a host is fingerprinted as WordPress, Drupal, Joomla, Magento, Ghost, Moodle, MediaWiki, Laravel, or another platform, ANANSI descends that stack instead of stopping at the surface:

Version detection — generator meta tags, /wp-links-opml.php, /feed/, /CHANGELOG.txt, joomla.xml, /magento_version, MediaWiki /api.php siteinfo, Moodle /login/index.php, and static-asset ?ver= strings.
WordPress plugin/theme enumeration — plugins are discovered from the homepage body and their stable versions read from readme.txt; Drupal modules, Joomla components, and MediaWiki extensions are enumerated the same way.
Stack-specific probes — /xmlrpc.php, /?author=1 and REST user enumeration, debug.log, config backups (wp-config.php.bak, settings.php.bak, configuration.php.bak), Magento app/etc/env.php, Ghost admin API, Laravel Telescope/Horizon/Ignition RCE (CVE-2021-3129), MediaWiki LocalSettings.php, directory listings, login/admin panels.
Known-vulnerable version matching — detected versions are matched against a curated, CVE-backed table (internal/assets/wordlists/tech/vulns.txt) covering WordPress core, Drupal (Drupalgeddon), Joomla, Magento, Ghost, MediaWiki, Moodle, and high-value WordPress plugins such as Elementor, WP File Manager, Duplicator, Contact Form 7, Revolution Slider, and WooCommerce.

Add your own fingerprints, path rules, and version ranges by editing the files under internal/assets/wordlists/tech/.

Exploit Chain Analysis

Instead of a flat list of findings, the CHAIN phase (Phase 09) groups every discovered vulnerability into multi-step exploit paths that escalate from a low-severity foothold to full compromise:

30 vulnerability classes — RCE, SQL injection, XSS, SSRF, path traversal, auth bypass, privilege escalation, default credentials, exposed admin interfaces, deserialization, file upload, subdomain takeover, and more — each with a recommended exploitation technique (internal/assets/wordlists/chain/classes.txt).
Kill-path templates — curated narratives such as Full Compromise (Info Disclosure → Credentials → Auth Bypass → Privilege Escalation → RCE), WebShell Upload, SSRF Pivot, and Data Exfiltration (internal/assets/wordlists/chain/chains.txt).
Generic escalation — any host with two or more distinct classes gets a ranked path ordered from the least to the most severe finding.
Ranked output — chains are scored and sorted by severity, length, and score, capped to keep reports readable. The top chain also appears in the summary and in the HTML/Markdown/JSON report formats.

anansi target.com --modules discovery,probe,tls,headers,paths,tech,takeover,osint,chain

Exploit Phase

Phase 10 (EXPLOIT) is the framework-native PoC layer. It takes the findings produced by earlier phases and actively proves them against the authorized target with live HTTP requests, capturing request/response pairs as evidence:

Six built-in modules — web/http-trace (TRACE echo), web/http-methods (unexpected method acceptance), web/path-traversal (documented traversal), web/open-redirect (server-side redirect confirmation), web/reflected-input (self-reflection in the response), and web/directory-listing (auto-index disclosure). Module eligibility is derived from the finding's vulnerability class, so each finding only ever matches its compatible modules.
Lifecycle and state machine — each run moves through selected → validated → executing → exploited/exploit_failed and then cleanup → evidence_captured; exploited/evidence_captured are the success terminal states. Unsupported findings resolve to not-exploitable so nothing is silently dropped. States are back-propagated onto the report's findings (exploitable, exploited, exploit_failed).
Honest-by-default — a finding is only exploited when the module's check actually succeeded; exploit_failed is returned (not a silent skip) when the check could not be confirmed.
Safety gates — no process spawning, no payload delivery; every module is a self-terminating HTTP request to the authorized target. High-risk modules are disabled unless --authorized is given. --dry-run runs the full lifecycle up to the execution boundary and reports what would run.
Events — exploit lifecycle events (exploit.selected, exploit.started, exploit.completed, exploit.failed, exploit.validated, exploit.cleanup, exploit.dry-run, exploit.skipped) and evidence.captured are emitted on the shared JSONL stream with the same schema as every QYVORA framework.
CLI — anansi exploit <url> --module web/path-traversal --authorized runs a single module; the full exploit phase also runs at the end of a complete scan, and the console offers an exploit module context with use, validate, status, set, and AUTHORIZED commands.

anansi target.com --authorized                    # full pipeline incl. EXPLOIT
anansi exploit https://target.com/admin -m web/path-traversal --authorized
anansi target.com --dry-run                       # plan the exploit phase

Install

Option 1 — One-liner (recommended)

Auto-detects your OS, CPU architecture, and shell. Downloads the checksum-verified prebuilt binary, or falls back to building from source if you're offline. No user choices required.

curl -fsSL https://raw.githubusercontent.com/QYVORA/qyvora-anansi/main/install.sh | bash

The installer:

Detects your OS (Linux / macOS / Windows Git-Bash) and architecture (amd64 / arm64)
Downloads the matching binary from GitHub Releases and verifies its SHA-256 against the published checksums.txt (supply-chain protection)
Falls back to building from source (needs Go) if the download is unavailable
Installs to ~/.local/bin (no sudo needed) and adds it to your shell config
On Linux, installs the app icon + desktop entry so anansi appears with its logo in the app menu
On Windows (GitBash), installs to ~/bin; use the PowerShell installer instead for the Start Menu shortcut + icon
Confirms the install by printing the version

Option 1b — Windows (PowerShell, recommended)

Installs the checksum-verified binary under %LOCALAPPDATA%\Programs\anansi\bin, adds it to your user PATH, installs the anansi start-menu icon, and creates a Start Menu shortcut so anansi appears with its logo in your app list:

irm https://raw.githubusercontent.com/QYVORA/qyvora-anansi/main/install.ps1 | iex

You can pin $env:ANANSI_VERSION (e.g. v1.0.0) or $env:ANANSI_PREFIX (e.g. D:\Tools) to control the version or install location.

Option 2 — Manual binary download (no Go required)

# Linux x86_64
curl -L https://github.com/QYVORA/qyvora-anansi/releases/latest/download/anansi-linux-amd64 -o anansi
chmod +x anansi
sudo mv anansi /usr/local/bin/

# Linux arm64 (Raspberry Pi, etc.)
curl -L https://github.com/QYVORA/qyvora-anansi/releases/latest/download/anansi-linux-arm64 -o anansi
chmod +x anansi
sudo mv anansi /usr/local/bin/

# macOS (Apple Silicon)
curl -L https://github.com/QYVORA/qyvora-anansi/releases/latest/download/anansi-macos-arm64 -o anansi
chmod +x anansi
sudo mv anansi /usr/local/bin/

# macOS (Intel)
curl -L https://github.com/QYVORA/qyvora-anansi/releases/latest/download/anansi-macos-amd64 -o anansi
chmod +x anansi
sudo mv anansi /usr/local/bin/

Verify the download's integrity against the published checksums:

sha256sum -c <(curl -fsSL https://github.com/QYVORA/qyvora-anansi/releases/latest/download/checksums.txt) --ignore-missing

Option 3 — Build from source (automated)

Requirements: Go 1.26+ (the version pinned by go.mod) and active internet connection.

git clone https://github.com/QYVORA/qyvora-anansi qyvora-anansi
cd qyvora-anansi
./install.sh

The binary has zero runtime dependencies.

Option 4 — Install from a source checkout (logo + app menu)

Installs the app icon and a .desktop entry so anansi shows up in your app menu with its logo (same layout as a regular install):

make install-user     # ~/.local/bin + ~/.local/share  (no sudo)
sudo make install     # /usr/local/bin + /usr/local/share (system-wide)

Uninstall with make uninstall-user (user) or sudo make uninstall.

Updating

Stay current with a single command:

anansi updates        # `anansi update` works as an alias

The command:

Reads the installed version — the same value anansi version reports.
Queries the official QYVORA GitHub releases (github.com/QYVORA/qyvora-anansi/releases); no other source is ever contacted.
Compares versions semantically (v1.10.0 > v1.9.0) and reports whether an update exists.
Downloads the release artifact built for your OS and CPU architecture (anansi-linux-amd64, anansi-macos-arm64, anansi-windows-amd64.exe, …).
Verifies its SHA-256 against the checksums.txt manifest published with the release; installation never proceeds on a mismatch.
Swaps the new binary in atomically, preserving the original file permissions.
Cleans up all temporary files and confirms the new version.

Notes:

No Go toolchain, Git, or source checkout is required — official prebuilt binaries are the update channel.
If the binary lives somewhere like /usr/local/bin that your user cannot write to, the updater stops with clear guidance instead of escalating on its own. Re-run with the appropriate permissions or reinstall into ~/.local/bin.
Downgrades are refused: an installed version newer than the latest release is left alone.
Offline or GitHub unreachable? The command fails cleanly; your installed binary stays exactly as it was.

Use -o json for machine-readable output.

Verify (one command)

Run every check — lint, static analysis, race-detector tests, and a build — in a single shot:

make verify

This is equivalent to:

golangci-lint run ./...
go vet ./...
go test -race ./... -count=1 -timeout 120s
go build -o anansi .

A passing make verify means: no lint issues, no vet issues, no data races, all tests (including the security tests below) pass, and the binary builds cleanly.

Usage

# Clean scan — only show found assets (default)
anansi target.com

# Recursive subdomain brute-force on resolved subdomains
anansi target.com -r

# Verbose scan — show all found and not-found outputs
anansi target.com -v

# Subdomain mutation scan
anansi target.com -m

# Scan alternative ports (default: 80,443)
anansi target.com -p 80,443,8080,8443

# Rate limit with delay in milliseconds
anansi target.com --delay 100

# Deep scan — larger wordlist, extended path rules
anansi target.com --deep

# Run specific modules
anansi target.com --modules discovery,probe,takeover

# Custom per-request timeout (default: 5s)
anansi target.com --timeout 10

# Configure concurrent thread pool (default: 50)
anansi target.com --threads 100

# JSON output
anansi target.com -o json > results.json
anansi target.com -o json | jq '.Findings[] | select(.Severity == "CRITICAL")'

# Markdown output
anansi target.com -o markdown > recon.md

# HTML output — premium dark mode report
anansi target.com -o html > report.html

All one-line commands above keep working exactly as documented. Running anansi with no arguments drops you into an interactive Metasploit-style console (with a startup banner on a real terminal):

$ anansi

  [ANANSI ASCII-ART BANNER]          (green)

  Attack Surface Intelligence Engine
  QYVORA OffSec — https://qyvora.netlify.app
  Built in Tamale, Ghana

  [>] v dev
  type 'help' for the command list, 'options' to view scan options.

▮ rhosts none  ·  module none                      v dev
anansiλ > set RHOSTS target.com
  [*] RHOSTS => target.com
▮ rhosts target.com  ·  module none                v dev
anansiλ > set THREADS 200
  [*] THREADS => 200
anansi > run
...
anansiλ > use paths
  [*] Using module paths
▮ rhosts target.com  ·  module paths               v dev
anansiλ[paths] > info
anansiλ[paths] > back
  [-] Module deselected.
anansiλ > exit

A live status strip above the prompt tracks the current RHOSTS and module context, and the prompt carries the selected module (anansiλ[paths] >).

CLI flags passed without a target are inherited by the console as initial options, so anansi --deep --threads 250 starts the REPL with those values already set.

The console provides arrow-key history, tab completion, and persistent history (~/.anansi_history). Piped input also works, so you can script sessions (piped sessions skip the startup banner):

printf 'set RHOSTS target.com\nrun\nexit\n' | anansi

Console commands:

Command	Description
`scan <target>`	Run a full scan against `<target>` (also available as the CLI subcommand `anansi scan <target>`)
`run [target]`	Run a scan; falls back to `RHOSTS`, honors the selected module
`set <opt> <value>`	Set a scan option (e.g. `set THREADS 200`)
`unset <opt>`	Restore an option's default value
`options` / `show options`	Show the current option values
`use <module>`	Select a module context (`discovery`, `probe`, `tls`, `headers`, `paths`, `tech`, `takeover`, `osint`, `chain`)
`back`	Deselect the current module
`info`	Show module or option information
`search <text>`	Search modules and options
`banner`	Print the ANANSI banner
`history`	Show command history
`version`	Show version information
`exit` / `quit`	Leave the console

Flags

Flag	Shorthand	Default	Description
`--recursive`	`-r`	false	Enable recursive subdomain brute-forcing on resolved subdomains
`--verbose`	`-v`	false	Enable verbose output (shows all found and not found/failed assets)
`--mutate`	`-m`	false	Enable subdomain mutation brute-forcing based on resolved prefixes
`--ports`	`-p`	80,443	Alternative ports to probe (comma-separated list)
`--delay`		0	Delay between requests in milliseconds for rate limiting
`--deep`		false	Larger subdomain wordlist + more path probing rules
`-o, --output`	`-o`	terminal	Output format: `terminal` \| `json` \| `markdown` \| `html`
`--timeout`		5	Per-request timeout in seconds
`--threads`	`-t`	100	Number of concurrent threads to use for scanning
`--stealth`		false	Enable stealth mode: random User-Agent, jitter, skip crt.sh, reduce noise
`--modules`		all	Comma-separated list of modules to run

Module names for `--modules`

discovery probe tls headers paths tech takeover osint chain

Output

  [ANANSI attack-surface spider art]
  Attack Surface Intelligence Engine — QYVORA // qyvora.netlify.app
  Built in Go
[+] PHASE 01: DISCOVERY   subdomain enumeration + DNS resolution
sources: crt.sh=12  wordlist=3  san=2
api.target.com    104.21.44.12   crt.sh    LIVE
dev.target.com    104.21.44.13   crt.sh    LIVE
old.target.com    —              wordlist  DEAD
CNAME → target.herokuapp.com
[+] PHASE 05: PATHS   exposed endpoint + file detection
[CRITICAL] Exposed .env File
ASSET:     https://api.target.com/.env
FIX:       Restrict or remove /.env from public access.
[+] PHASE 07: TAKEOVER   dangling CNAME detection
[CRITICAL] Subdomain Takeover — Heroku
ASSET:     old.target.com
FIX:       Remove the dangling CNAME or claim the Heroku resource.
SUMMARY
target      target.com
duration    1m43s
subdomains  17 discovered, 11 live
risk score  74/100
findings    CRIT:3  HIGH:7  MED:4  LOW:6  INFO:2

Project structure

anansi-cli/
├── main.go                      # Entry point
├── go.mod                       # Go module + dependencies
├── cmd/
│   ├── root.go                  # CLI command, flags, phase orchestration
│   └── console.go               # Interactive Metasploit-style console
└── internal/
    ├── output/
    │   ├── types.go             # Shared data structures
    │   └── terminal.go          # Terminal/JSON/HTML/Markdown renderer
    ├── discovery/
    │   └── discovery.go         # crt.sh + DNS brute-force enumeration
    ├── probe/
    │   └── probe.go             # HTTP/HTTPS surface probing
    ├── tls/
    │   └── tls.go               # TLS certificate analysis + SAN discovery
    ├── headers/
    │   └── headers.go           # Security header audit + CORS check
    ├── paths/
    │   └── paths.go             # Exposed path + file detection
    ├── techstack/
    │   └── techstack.go         # Deep CMS/framework audit + CVE version matching
    ├── takeover/
    │   └── takeover.go          # Subdomain takeover detection
    ├── chain/
    │   ├── chain.go             # Exploit-chain assembly + ranking
    │   └── chain_test.go
    ├── httpclient/
    │   └── httpclient.go        # Shared connection-pooled HTTP client
    └── dnscache/
        └── dnscache.go          # TTL-based DNS resolver cache

Why

The pentesting and bug bounty community runs on Linux terminals. Tools should be single binaries that do one thing well and get out of the way. No web UI, no cloud account, no API key required.

ANANSI CLI is the portable companion to the full ANANSI platform — the API-powered attack surface intelligence service built into the QYVORA OffSec ecosystem. Same detection logic. Same output philosophy. CLI is for your laptop. The API is for your pipeline.

Legal

Only scan targets you own or have explicit written authorization to test. Unauthorized scanning is illegal in most jurisdictions. QYVORA OffSec accepts no responsibility for misuse of this tool.

Contact

QYVORA OffSec — Tamale, Ghana Website: https://qyvora.netlify.app · Security/Support: qyvorasec@gmail.com

License

MIT — fork it, extend it, integrate it. Attribution appreciated.

Contributing

PRs welcome. Open an issue first for major changes. If you add a new path rule, takeover fingerprint, or detection module — open a PR. The goal is to keep the binary small and the signal high.

QYVORA // Tamale, Ghana

Cybersecurity in Africa is booming. We are building the people behind it.

Name		Name	Last commit message	Last commit date
.github		.github
assets		assets
cmd		cmd
internal		internal
.gitignore		.gitignore
.golangci.yml		.golangci.yml
.goreleaser.yaml		.goreleaser.yaml
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
GOVERNANCE.md		GOVERNANCE.md
LICENSE		LICENSE
Makefile		Makefile
NOTICE		NOTICE
README.md		README.md
SECURITY.md		SECURITY.md
SUPPORT.md		SUPPORT.md
go.mod		go.mod
go.sum		go.sum
install.ps1		install.ps1
install.sh		install.sh
main.go		main.go
security_test.go		security_test.go

Navigation Menu

Repository files navigation

ANANSI CLI

What it does

Performance & Architecture

Tech-Stack Deep Audit

Exploit Chain Analysis

Exploit Phase

Install

Option 1 — One-liner (recommended)

Option 1b — Windows (PowerShell, recommended)

Option 2 — Manual binary download (no Go required)

Option 3 — Build from source (automated)

Option 4 — Install from a source checkout (logo + app menu)

Updating

Verify (one command)

Usage

Flags

Module names for `--modules`

Output

Project structure

Why

Legal

Contact

License

Contributing

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

ANANSI CLI

What it does

Performance & Architecture

Tech-Stack Deep Audit

Exploit Chain Analysis

Exploit Phase

Install

Option 1 — One-liner (recommended)

Option 1b — Windows (PowerShell, recommended)

Option 2 — Manual binary download (no Go required)

Option 3 — Build from source (automated)

Option 4 — Install from a source checkout (logo + app menu)

Updating

Verify (one command)

Usage

Flags

Module names for --modules

Output

Project structure

Why

Legal

Contact

License

Contributing

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

Module names for `--modules`