diff --git a/public/arf.json b/public/arf.json index ebcf2d0..bf9fada 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1760,18 +1760,18 @@ "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/", - "description": "Hosted web interface for Nikto-based web server misconfiguration and vulnerability checks.", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", "status": "live", "pricing": "free", - "bestFor": "Quick remote Nikto scans from a browser", - "input": "Target URL or host", - "output": "Nikto-style findings on server headers, files, and common web weaknesses", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", "opsec": "active", - "opsecNote": "Performs active vulnerability probing against the target web server.", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", "localInstall": false, "googleDork": false, "registration": false, - "editUrl": true, + "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false @@ -3490,9 +3490,24 @@ "deprecated": false }, { - "name": "Check site availability Online", + "name": "UPcheck", "type": "url", - "url": "https://upcheck.online/" + "url": "https://upcheck.online/", + "description": "Website uptime checker that tests if a site is currently accessible.", + "status": "down", + "pricing": "free", + "bestFor": "Quick site availability checks", + "input": "URL/domain", + "output": "Up/down status", + "opsec": "passive", + "opsecNote": "No identification risk; passive status check only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Follow That Page", @@ -3584,14 +3599,14 @@ "name": "Google Trends", "type": "url", "url": "https://trends.google.com/trends/", - "description": "Google analytics interface for comparing search interest trends across terms, regions, and time windows. Includes related queries and topic momentum insights.", + "description": "Google's search trend analysis tool for tracking keyword popularity and comparing search interest over time.", "status": "live", "pricing": "free", - "bestFor": "Tracking public interest shifts in terms and topics", - "input": "Keywords, geography, category, and date range filters", - "output": "Relative search-interest graphs and related-query suggestions", + "bestFor": "Search trend analysis and keyword research", + "input": "Keywords or domains", + "output": "Trend data and comparative interest graphs", "opsec": "passive", - "opsecNote": "Queries are conducted within Google's public trends interface and do not directly interact with investigation targets.", + "opsecNote": "Google-tracked; your queries may be associated with your account or IP", "localInstall": false, "googleDork": false, "registration": false, @@ -3609,7 +3624,22 @@ { "name": "DNSSEC Analyzer", "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" + "url": "https://dnssec-analyzer.verisignlabs.com/", + "description": "Verisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.", + "status": "live", + "pricing": "free", + "bestFor": "DNSSEC chain-of-trust validation", + "input": "Domain names", + "output": "DNSSEC validation status and chain details", + "opsec": "passive", + "opsecNote": "No identification risk; passive DNS lookup", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSViz", @@ -3645,19 +3675,19 @@ "name": "Sn1per (T)", "type": "url", "url": "https://github.com/1N3/Sn1per", - "description": "Automated reconnaissance and penetration testing framework that orchestrates vulnerability scans and attack-surface discovery workflows.", + "description": "Automated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.", "status": "live", - "pricing": "freemium", - "bestFor": "Automated offensive security reconnaissance pipelines", - "input": "Target domains, hosts, ranges, or web applications", - "output": "Consolidated scan findings, vulnerabilities, and recon artifacts", + "pricing": "free", + "bestFor": "Full-scope pentest automation and recon", + "input": "Target domains or IPs", + "output": "Recon data, open ports, vulnerabilities, and footprinting results", "opsec": "active", - "opsecNote": "Directly probes target infrastructure and can generate detectable scanning traffic.", + "opsecNote": "Generates significant network traffic and alerts; high IDS/WAF detection risk", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": true, - "api": false, + "editUrl": false, + "api": true, "invitationOnly": false, "deprecated": false }, @@ -3665,26 +3695,41 @@ "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/", - "description": "Web-based interface for running Nikto vulnerability checks against web servers. Provides quick external testing without local deployment.", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", "status": "live", "pricing": "free", - "bestFor": "Quick browser-based web server vulnerability scanning", - "input": "Target website URL or host", - "output": "Nikto scan report of detected web server issues", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", "opsec": "active", - "opsecNote": "Initiates direct security probing of target web servers and is likely to be logged by defenders.", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", "localInstall": false, "googleDork": false, "registration": false, - "editUrl": true, + "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { - "name": "WDES - Web Data Exposure Scanner (T)", + "name": "Web Data Exposure Scanner (T)", "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" + "url": "https://github.com/eduardoit/web-data-exposure-scanner", + "description": "Open-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting exposed sensitive data on web servers", + "input": "URLs/domains", + "output": "Exposed data findings", + "opsec": "active", + "opsecNote": "Active scanning may generate server logs and trigger alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3718,14 +3763,14 @@ "name": "RobotsDisallowed", "type": "url", "url": "https://github.com/danielmiessler/RobotsDisallowed", - "description": "Curated wordlist derived from robots.txt disallow paths, used for discovery and content enumeration in security testing.", + "description": "Curated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.", "status": "live", "pricing": "free", - "bestFor": "Directory and content discovery wordlist generation", - "input": "Wordlist consumption by scanners/fuzzers", - "output": "Path candidates likely to expose sensitive or hidden content", + "bestFor": "robots.txt enumeration and directory discovery", + "input": "Used as wordlist input for directory brute-forcing", + "output": "Directory path wordlist", "opsec": "passive", - "opsecNote": "Repository usage is passive; OPSEC risk comes from downstream active scanning tools that consume the list.", + "opsecNote": "Passive wordlist only; no requests made to target during list use", "localInstall": true, "googleDork": false, "registration": false, @@ -3744,19 +3789,19 @@ "name": "Belati (T)", "type": "url", "url": "https://github.com/aancw/Belati", - "description": "Python OSINT framework that aggregates data from multiple online sources and automates collection workflows for investigations.", + "description": "Open-source OSINT data collection and automation framework for gathering information from multiple sources.", "status": "live", "pricing": "free", - "bestFor": "CLI-based multi-source OSINT collection automation", - "input": "Investigation keywords, handles, domains, or entity identifiers", - "output": "Collected artifacts from integrated OSINT data sources", + "bestFor": "Multi-source OSINT collection automation", + "input": "Domains and targets", + "output": "Aggregated OSINT data", "opsec": "passive", - "opsecNote": "Collection relies on public-source queries; risk depends on enabled modules and target-facing lookups.", + "opsecNote": "Primarily passive; behavior depends on configured modules", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": true, - "api": false, + "editUrl": false, + "api": true, "invitationOnly": false, "deprecated": false }, @@ -3764,18 +3809,18 @@ "name": "Burp Suite (T)", "type": "url", "url": "https://portswigger.net/burp", - "description": "Web security testing suite for intercepting, manipulating, and scanning HTTP(S) traffic in web application assessments.", + "description": "Industry-standard web application security testing platform for manual and automated vulnerability assessment.", "status": "live", "pricing": "freemium", - "bestFor": "Manual and automated web application security testing", - "input": "Target web application traffic and scan targets", - "output": "Intercepted requests, vulnerability findings, and test artifacts", + "bestFor": "Web application penetration testing", + "input": "Web applications and URLs", + "output": "Security findings, intercepted traffic, and vulnerability reports", "opsec": "active", - "opsecNote": "Active testing traffic is sent to targets and can trigger alerts or defensive controls.", + "opsecNote": "Full active scanning; generates extensive server logs and may trigger WAF/IDS alerts", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": true, + "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false @@ -3784,19 +3829,19 @@ "name": "EyeWitness (T)", "type": "url", "url": "https://github.com/ChrisTruncer/EyeWitness", - "description": "Reconnaissance tool that captures screenshots of web services and helps identify technologies and exposed login interfaces at scale.", + "description": "Open-source tool for automated website screenshotting, service header collection, and default credential identification.", "status": "live", "pricing": "free", - "bestFor": "Visual triage of large target lists and exposed services", - "input": "List of URLs, hosts, or network service endpoints", - "output": "Screenshots, service metadata, and summary HTML reports", + "bestFor": "Visual site enumeration and credential identification", + "input": "URL lists", + "output": "Screenshots, headers, and default credential matches", "opsec": "passive", - "opsecNote": "Primarily collects presentation-layer snapshots; network requests are still sent to targets but with lower interaction depth than exploit scans.", + "opsecNote": "HTTP requests visible in target server logs; screenshots leave network footprint", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": true, - "api": false, + "editUrl": false, + "api": true, "invitationOnly": false, "deprecated": false }, @@ -3804,19 +3849,19 @@ "name": "Hunting-New-Registered-Domains (T)", "type": "url", "url": "https://github.com/gfek/Hunting-New-Registered-Domains", - "description": "OSINT workflow and scripts focused on identifying newly registered domains likely associated with phishing and brand abuse.", + "description": "Open-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.", "status": "live", "pricing": "free", - "bestFor": "Detecting suspicious newly registered domains for threat hunting", - "input": "Keywords, domain feeds, and candidate domain lists", - "output": "Prioritized domain candidates for further investigation", + "bestFor": "Phishing domain detection and brand threat monitoring", + "input": "Domain patterns or keywords", + "output": "List of newly registered matching domains", "opsec": "passive", - "opsecNote": "Analysis is based on external data sources and does not require direct target interaction by default.", + "opsecNote": "WHOIS queries may create observable patterns; otherwise passive", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": true, - "api": false, + "editUrl": false, + "api": true, "invitationOnly": false, "deprecated": false }, @@ -3824,14 +3869,14 @@ "name": "International Domain Name Conversion Tool", "type": "url", "url": "https://mct.verisign-grs.com/", - "description": "Web utility for converting internationalized domain names between Unicode and Punycode representations.", + "description": "Verisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.", "status": "live", "pricing": "free", - "bestFor": "IDN normalization and Unicode/Punycode translation", - "input": "Domain name in Unicode or Punycode format", - "output": "Converted domain representation in alternate encoding", + "bestFor": "IDN and Punycode domain analysis", + "input": "International or Punycode domain names", + "output": "Converted domain equivalents", "opsec": "passive", - "opsecNote": "Conversion operations are deterministic and do not involve contacting investigation targets.", + "opsecNote": "No identification risk; local conversion tool", "localInstall": false, "googleDork": false, "registration": false, @@ -3844,18 +3889,18 @@ "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/", - "description": "Browser-based Nikto scanning endpoint for identifying common web server misconfigurations and known weaknesses.", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", "status": "live", "pricing": "free", - "bestFor": "Fast external vulnerability checks against web targets", - "input": "Website URL or host target", - "output": "Web vulnerability scan results and issue summary", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", "opsec": "active", - "opsecNote": "Performs active probing against target systems that may be detected and logged.", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", "localInstall": false, "googleDork": false, "registration": false, - "editUrl": true, + "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false @@ -3867,14 +3912,44 @@ "type": "folder", "children": [ { - "name": "Microsoft", + "name": "Windows Defender Security Intelligence (WDSI)", "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + "url": "https://www.microsoft.com/en-us/wdsi", + "description": "Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Microsoft and checking URL threat status", + "input": "URLs", + "output": "Threat status and submission confirmation", + "opsec": "passive", + "opsecNote": "Microsoft-tracked; submissions aggregated for threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Google", + "name": "Google Safe Browsing", "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + "url": "https://safebrowsing.google.com/", + "description": "Google's phishing and malware reporting portal for submitting suspicious URLs for review.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Google and checking URL safety status", + "input": "URLs", + "output": "Safety status and submission confirmation", + "opsec": "passive", + "opsecNote": "Google-tracked; searches and submissions aggregated at scale", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -7567,7 +7642,37 @@ ] }, { - "name": "PEP Databases", + "name": "Public Records?", + "type": "url", + "url": "https://publicrecords.searchsystems.net/" + }, + { + "name": "The World Bank Open Data Catalog", + "type": "url", + "url": "https://datacatalog.worldbank.org/" + }, + { + "name": "BRB Public Records", + "type": "url", + "url": "https://www.brbpub.com/" + }, + { + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "type": "url", + "url": "https://www.govdata.de/" + }, + { + "name": "Open-Data-Portal M\u00fcnchen (German)", + "type": "url", + "url": "https://www.opengov-muenchen.de/" + }, + { + "name": "Searchable FCC ID Database", + "type": "url", + "url": "https://fccid.io/" + }, + { + "name": "Sanctions / PEP", "type": "folder", "children": [ {