ScanDalf is a sophisticated Bash script designed for cybersecurity professionals focusing on web reconnaissance and penetration testing. This tool streamlines the process of subdomain enumeration and forced browsing, leveraging popular cybersecurity tools like feroxbuster, subfinder, amass, and httpx. It features an intuitive command-line interface with colorful text outputs, enhancing user experience and readability.
List of tools that are used to perform and cover different aspects of web reconnaissance, from various sources, using different methods.
Tool | Type | Description |
---|---|---|
Subfinder |
Subdomain Enumeration |
Itis a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. |
amass |
Attack Surface Mapper |
performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. |
Feroxbuster |
Forced Browsing |
feroxbuster is a tool designed to perform Forced Browsing. Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the webapps, but are still accessible by an attacker. |
altdns |
Subdomain discovery |
Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. |
waybackurls |
Discovery |
Fetches known URLs from the Wayback Machine for *.domain and output them on stdout. |
gau |
Discovery |
getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan for any given domain. |
gf |
grep on steroids |
A wrapper around grep to avoid typing common patterns. |
- Make sure to install
go
,python
, andRust
- Run the
requirements.sh
file. Make sure to edit the file based on your OS, and the type of installation you want../scandalf -u <URL> [-w] <wordlist>
- Providing wordlist id optional, if not provided it uses the
raft-medium
by seclists.
To run this project, you will need to change the following variables in your scandalf.sh file
1. wordlist
- Set this as any default wordlist
2. mutation_word_list
- add a mutation list, you can also use the one that I have provided just alter the path.
3. result_dir
- set this to where you want to store yout final reports of the recon.
For support, email [email protected].