mirror of
https://github.com/lockfale/OSINT-Framework.git
synced 2026-08-26 15:52:23 +02:00
Merge pull request #641 from lockfale/feature/THE-132-domain-batch6-curation
Enrich Domain Name batch 6/6: 21 tools with metadata and naming fixes (THE-132)
This commit is contained in:
s0lray
+183
-78
@@ -1760,18 +1760,18 @@
|
||||
"name": "Online Nikto scanner",
|
||||
"type": "url",
|
||||
"url": "https://nikto.online/",
|
||||
"description": "Hosted web interface for Nikto-based web server misconfiguration and vulnerability checks.",
|
||||
"description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick remote Nikto scans from a browser",
|
||||
"input": "Target URL or host",
|
||||
"output": "Nikto-style findings on server headers, files, and common web weaknesses",
|
||||
"bestFor": "Web server vulnerability scanning",
|
||||
"input": "URLs",
|
||||
"output": "Vulnerability and misconfiguration reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Performs active vulnerability probing against the target web server.",
|
||||
"opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
@@ -3490,9 +3490,24 @@
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Check site availability Online",
|
||||
"name": "UPcheck",
|
||||
"type": "url",
|
||||
"url": "https://upcheck.online/"
|
||||
"url": "https://upcheck.online/",
|
||||
"description": "Website uptime checker that tests if a site is currently accessible.",
|
||||
"status": "down",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick site availability checks",
|
||||
"input": "URL/domain",
|
||||
"output": "Up/down status",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "No identification risk; passive status check only",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true
|
||||
},
|
||||
{
|
||||
"name": "Follow That Page",
|
||||
@@ -3584,14 +3599,14 @@
|
||||
"name": "Google Trends",
|
||||
"type": "url",
|
||||
"url": "https://trends.google.com/trends/",
|
||||
"description": "Google analytics interface for comparing search interest trends across terms, regions, and time windows. Includes related queries and topic momentum insights.",
|
||||
"description": "Google's search trend analysis tool for tracking keyword popularity and comparing search interest over time.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Tracking public interest shifts in terms and topics",
|
||||
"input": "Keywords, geography, category, and date range filters",
|
||||
"output": "Relative search-interest graphs and related-query suggestions",
|
||||
"bestFor": "Search trend analysis and keyword research",
|
||||
"input": "Keywords or domains",
|
||||
"output": "Trend data and comparative interest graphs",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Queries are conducted within Google's public trends interface and do not directly interact with investigation targets.",
|
||||
"opsecNote": "Google-tracked; your queries may be associated with your account or IP",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
@@ -3609,7 +3624,22 @@
|
||||
{
|
||||
"name": "DNSSEC Analyzer",
|
||||
"type": "url",
|
||||
"url": "https://dnssec-analyzer.verisignlabs.com/"
|
||||
"url": "https://dnssec-analyzer.verisignlabs.com/",
|
||||
"description": "Verisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "DNSSEC chain-of-trust validation",
|
||||
"input": "Domain names",
|
||||
"output": "DNSSEC validation status and chain details",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "No identification risk; passive DNS lookup",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "DNSViz",
|
||||
@@ -3645,19 +3675,19 @@
|
||||
"name": "Sn1per (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/1N3/Sn1per",
|
||||
"description": "Automated reconnaissance and penetration testing framework that orchestrates vulnerability scans and attack-surface discovery workflows.",
|
||||
"description": "Automated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Automated offensive security reconnaissance pipelines",
|
||||
"input": "Target domains, hosts, ranges, or web applications",
|
||||
"output": "Consolidated scan findings, vulnerabilities, and recon artifacts",
|
||||
"pricing": "free",
|
||||
"bestFor": "Full-scope pentest automation and recon",
|
||||
"input": "Target domains or IPs",
|
||||
"output": "Recon data, open ports, vulnerabilities, and footprinting results",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Directly probes target infrastructure and can generate detectable scanning traffic.",
|
||||
"opsecNote": "Generates significant network traffic and alerts; high IDS/WAF detection risk",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
@@ -3665,26 +3695,41 @@
|
||||
"name": "Online Nikto scanner",
|
||||
"type": "url",
|
||||
"url": "https://nikto.online/",
|
||||
"description": "Web-based interface for running Nikto vulnerability checks against web servers. Provides quick external testing without local deployment.",
|
||||
"description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick browser-based web server vulnerability scanning",
|
||||
"input": "Target website URL or host",
|
||||
"output": "Nikto scan report of detected web server issues",
|
||||
"bestFor": "Web server vulnerability scanning",
|
||||
"input": "URLs",
|
||||
"output": "Vulnerability and misconfiguration reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Initiates direct security probing of target web servers and is likely to be logged by defenders.",
|
||||
"opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "WDES - Web Data Exposure Scanner (T)",
|
||||
"name": "Web Data Exposure Scanner (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/eduardoit/web-data-exposure-scanner"
|
||||
"url": "https://github.com/eduardoit/web-data-exposure-scanner",
|
||||
"description": "Open-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Detecting exposed sensitive data on web servers",
|
||||
"input": "URLs/domains",
|
||||
"output": "Exposed data findings",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Active scanning may generate server logs and trigger alerts",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -3718,14 +3763,14 @@
|
||||
"name": "RobotsDisallowed",
|
||||
"type": "url",
|
||||
"url": "https://github.com/danielmiessler/RobotsDisallowed",
|
||||
"description": "Curated wordlist derived from robots.txt disallow paths, used for discovery and content enumeration in security testing.",
|
||||
"description": "Curated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Directory and content discovery wordlist generation",
|
||||
"input": "Wordlist consumption by scanners/fuzzers",
|
||||
"output": "Path candidates likely to expose sensitive or hidden content",
|
||||
"bestFor": "robots.txt enumeration and directory discovery",
|
||||
"input": "Used as wordlist input for directory brute-forcing",
|
||||
"output": "Directory path wordlist",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Repository usage is passive; OPSEC risk comes from downstream active scanning tools that consume the list.",
|
||||
"opsecNote": "Passive wordlist only; no requests made to target during list use",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
@@ -3744,19 +3789,19 @@
|
||||
"name": "Belati (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/aancw/Belati",
|
||||
"description": "Python OSINT framework that aggregates data from multiple online sources and automates collection workflows for investigations.",
|
||||
"description": "Open-source OSINT data collection and automation framework for gathering information from multiple sources.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "CLI-based multi-source OSINT collection automation",
|
||||
"input": "Investigation keywords, handles, domains, or entity identifiers",
|
||||
"output": "Collected artifacts from integrated OSINT data sources",
|
||||
"bestFor": "Multi-source OSINT collection automation",
|
||||
"input": "Domains and targets",
|
||||
"output": "Aggregated OSINT data",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Collection relies on public-source queries; risk depends on enabled modules and target-facing lookups.",
|
||||
"opsecNote": "Primarily passive; behavior depends on configured modules",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
@@ -3764,18 +3809,18 @@
|
||||
"name": "Burp Suite (T)",
|
||||
"type": "url",
|
||||
"url": "https://portswigger.net/burp",
|
||||
"description": "Web security testing suite for intercepting, manipulating, and scanning HTTP(S) traffic in web application assessments.",
|
||||
"description": "Industry-standard web application security testing platform for manual and automated vulnerability assessment.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Manual and automated web application security testing",
|
||||
"input": "Target web application traffic and scan targets",
|
||||
"output": "Intercepted requests, vulnerability findings, and test artifacts",
|
||||
"bestFor": "Web application penetration testing",
|
||||
"input": "Web applications and URLs",
|
||||
"output": "Security findings, intercepted traffic, and vulnerability reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Active testing traffic is sent to targets and can trigger alerts or defensive controls.",
|
||||
"opsecNote": "Full active scanning; generates extensive server logs and may trigger WAF/IDS alerts",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
@@ -3784,19 +3829,19 @@
|
||||
"name": "EyeWitness (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/ChrisTruncer/EyeWitness",
|
||||
"description": "Reconnaissance tool that captures screenshots of web services and helps identify technologies and exposed login interfaces at scale.",
|
||||
"description": "Open-source tool for automated website screenshotting, service header collection, and default credential identification.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Visual triage of large target lists and exposed services",
|
||||
"input": "List of URLs, hosts, or network service endpoints",
|
||||
"output": "Screenshots, service metadata, and summary HTML reports",
|
||||
"bestFor": "Visual site enumeration and credential identification",
|
||||
"input": "URL lists",
|
||||
"output": "Screenshots, headers, and default credential matches",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Primarily collects presentation-layer snapshots; network requests are still sent to targets but with lower interaction depth than exploit scans.",
|
||||
"opsecNote": "HTTP requests visible in target server logs; screenshots leave network footprint",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
@@ -3804,19 +3849,19 @@
|
||||
"name": "Hunting-New-Registered-Domains (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/gfek/Hunting-New-Registered-Domains",
|
||||
"description": "OSINT workflow and scripts focused on identifying newly registered domains likely associated with phishing and brand abuse.",
|
||||
"description": "Open-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Detecting suspicious newly registered domains for threat hunting",
|
||||
"input": "Keywords, domain feeds, and candidate domain lists",
|
||||
"output": "Prioritized domain candidates for further investigation",
|
||||
"bestFor": "Phishing domain detection and brand threat monitoring",
|
||||
"input": "Domain patterns or keywords",
|
||||
"output": "List of newly registered matching domains",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Analysis is based on external data sources and does not require direct target interaction by default.",
|
||||
"opsecNote": "WHOIS queries may create observable patterns; otherwise passive",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
@@ -3824,14 +3869,14 @@
|
||||
"name": "International Domain Name Conversion Tool",
|
||||
"type": "url",
|
||||
"url": "https://mct.verisign-grs.com/",
|
||||
"description": "Web utility for converting internationalized domain names between Unicode and Punycode representations.",
|
||||
"description": "Verisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "IDN normalization and Unicode/Punycode translation",
|
||||
"input": "Domain name in Unicode or Punycode format",
|
||||
"output": "Converted domain representation in alternate encoding",
|
||||
"bestFor": "IDN and Punycode domain analysis",
|
||||
"input": "International or Punycode domain names",
|
||||
"output": "Converted domain equivalents",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Conversion operations are deterministic and do not involve contacting investigation targets.",
|
||||
"opsecNote": "No identification risk; local conversion tool",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
@@ -3844,18 +3889,18 @@
|
||||
"name": "Online Nikto scanner",
|
||||
"type": "url",
|
||||
"url": "https://nikto.online/",
|
||||
"description": "Browser-based Nikto scanning endpoint for identifying common web server misconfigurations and known weaknesses.",
|
||||
"description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Fast external vulnerability checks against web targets",
|
||||
"input": "Website URL or host target",
|
||||
"output": "Web vulnerability scan results and issue summary",
|
||||
"bestFor": "Web server vulnerability scanning",
|
||||
"input": "URLs",
|
||||
"output": "Vulnerability and misconfiguration reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Performs active probing against target systems that may be detected and logged.",
|
||||
"opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
@@ -3867,14 +3912,44 @@
|
||||
"type": "folder",
|
||||
"children": [
|
||||
{
|
||||
"name": "Microsoft",
|
||||
"name": "Windows Defender Security Intelligence (WDSI)",
|
||||
"type": "url",
|
||||
"url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest"
|
||||
"url": "https://www.microsoft.com/en-us/wdsi",
|
||||
"description": "Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Reporting malicious sites to Microsoft and checking URL threat status",
|
||||
"input": "URLs",
|
||||
"output": "Threat status and submission confirmation",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Microsoft-tracked; submissions aggregated for threat intelligence",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Google",
|
||||
"name": "Google Safe Browsing",
|
||||
"type": "url",
|
||||
"url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en"
|
||||
"url": "https://safebrowsing.google.com/",
|
||||
"description": "Google's phishing and malware reporting portal for submitting suspicious URLs for review.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Reporting malicious sites to Google and checking URL safety status",
|
||||
"input": "URLs",
|
||||
"output": "Safety status and submission confirmation",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Google-tracked; searches and submissions aggregated at scale",
|
||||
"localInstall": false,
|
||||
"googleDork": true,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -7567,7 +7642,37 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "PEP Databases",
|
||||
"name": "Public Records?",
|
||||
"type": "url",
|
||||
"url": "https://publicrecords.searchsystems.net/"
|
||||
},
|
||||
{
|
||||
"name": "The World Bank Open Data Catalog",
|
||||
"type": "url",
|
||||
"url": "https://datacatalog.worldbank.org/"
|
||||
},
|
||||
{
|
||||
"name": "BRB Public Records",
|
||||
"type": "url",
|
||||
"url": "https://www.brbpub.com/"
|
||||
},
|
||||
{
|
||||
"name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)",
|
||||
"type": "url",
|
||||
"url": "https://www.govdata.de/"
|
||||
},
|
||||
{
|
||||
"name": "Open-Data-Portal M\u00fcnchen (German)",
|
||||
"type": "url",
|
||||
"url": "https://www.opengov-muenchen.de/"
|
||||
},
|
||||
{
|
||||
"name": "Searchable FCC ID Database",
|
||||
"type": "url",
|
||||
"url": "https://fccid.io/"
|
||||
},
|
||||
{
|
||||
"name": "Sanctions / PEP",
|
||||
"type": "folder",
|
||||
"children": [
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user