List of Modules
June 29, 2026 · View on GitHub
| Module | Type | Needs API Key | Description | Flags | Consumed Events | Produced Events | Author | Created Date |
|---|---|---|---|---|---|---|---|---|
| ajaxpro | scan | No | Check for potentially vulnerable Ajaxpro instances | active, safe, web-heavy | HTTP_RESPONSE, URL | FINDING, TECHNOLOGY | @liquidsec | 2024-01-18 |
| aspnet_bin_exposure | scan | No | Check for ASP.NET Security Feature Bypasses (CVE-2023-36899 and CVE-2023-36560) | active, safe, web-heavy | URL | FINDING | @liquidsec | 2025-01-28 |
| baddns | scan | No | Check hosts for domain/subdomain takeovers | active, baddns, cloud-enum, safe, subdomain-hijack, web | DNS_NAME, DNS_NAME_UNRESOLVED | FINDING | @liquidsec | 2024-01-18 |
| baddns_direct | scan | No | Check for unusual subdomain / service takeover edge cases that require direct detection | active, baddns, cloud-enum, safe, subdomain-enum | STORAGE_BUCKET, URL | FINDING | @liquidsec | 2024-01-29 |
| baddns_zone | scan | No | Check hosts for DNS zone transfers and NSEC walks | active, baddns, cloud-enum, safe, subdomain-enum | DNS_NAME | FINDING | @liquidsec | 2024-01-29 |
| badsecrets | scan | No | Library for detecting known or weak secrets across many web frameworks | active, safe, web | HTTP_RESPONSE | FINDING, TECHNOLOGY | @liquidsec | 2022-11-19 |
| bucket_amazon | scan | No | Check for S3 buckets related to target | active, cloud-enum, safe, web | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @TheTechromancer | 2022-11-04 |
| bucket_digitalocean | scan | No | Check for DigitalOcean spaces related to target | active, cloud-enum, safe, slow, web-heavy | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @TheTechromancer | 2022-11-08 |
| bucket_firebase | scan | No | Check for open Firebase databases related to target | active, cloud-enum, safe, web | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @TheTechromancer | 2023-03-20 |
| bucket_google | scan | No | Check for Google object storage related to target | active, cloud-enum, safe, web | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @TheTechromancer | 2022-11-04 |
| bucket_hetzner | scan | No | Check for Hetzner Object Storage buckets related to target | active, cloud-enum, safe, slow, web-heavy | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @ChrisJr404 | 2026-05-04 |
| bucket_microsoft | scan | No | Check for Azure storage blobs related to target | active, cloud-enum, safe, web | DNS_NAME, STORAGE_BUCKET | FINDING, STORAGE_BUCKET | @TheTechromancer | 2022-11-04 |
| bypass403 | scan | No | Check 403 pages for common bypasses | active, loud, web-heavy | URL | FINDING | @liquidsec | 2022-07-05 |
| dnsbrute | scan | No | Brute-force subdomains with massdns + static wordlist | active, loud, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2024-04-24 |
| dnsbrute_mutations | scan | No | Brute-force subdomains with massdns + target-specific mutations | active, loud, slow, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2024-04-25 |
| dnscommonsrv | scan | No | Check for common SRV records | active, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-05-15 |
| dotnetnuke | scan | No | Scan for critical DotNetNuke (DNN) vulnerabilities | active, invasive, loud, web-heavy | HTTP_RESPONSE | FINDING, TECHNOLOGY | @liquidsec | 2023-11-21 |
| filedownload | scan | No | Download common filetypes such as PDF, DOCX, PPTX, etc. | active, download, safe, web | HTTP_RESPONSE, URL_UNVERIFIED | FILESYSTEM | @TheTechromancer | 2023-10-11 |
| fingerprintx | scan | No | Fingerprint exposed services like RDP, SSH, MySQL, etc. | active, safe, service-enum, slow | OPEN_TCP_PORT | PROTOCOL, URL_UNVERIFIED | @TheTechromancer | 2023-01-30 |
| generic_ssrf | scan | No | Check for generic SSRFs | active, invasive, web-heavy | URL | FINDING | @liquidsec | 2022-07-30 |
| git | scan | No | Check for exposed .git repositories | active, code-enum, safe, web | URL | CODE_REPOSITORY, FINDING | @TheTechromancer | 2023-05-30 |
| gitlab_com | scan | No | Enumerate GitLab SaaS (gitlab.com/org) for projects and groups | active, code-enum, safe | SOCIAL | CODE_REPOSITORY | @TheTechromancer | 2024-03-11 |
| gitlab_onprem | scan | No | Detect self-hosted GitLab instances and query them for repositories | active, code-enum, safe | HTTP_RESPONSE, SOCIAL, TECHNOLOGY | CODE_REPOSITORY, FINDING, SOCIAL, TECHNOLOGY | @TheTechromancer | 2024-03-11 |
| gowitness | scan | No | Take screenshots of webpages | active, safe, web-screenshots | SOCIAL, URL | TECHNOLOGY, URL, URL_UNVERIFIED, WEBSCREENSHOT | @TheTechromancer | 2022-07-08 |
| graphql_introspection | scan | No | Perform GraphQL introspection on a target | active, safe, web | URL | FINDING | @mukesh-dream11 | 2025-07-01 |
| host_header | scan | No | Try common HTTP Host header spoofing techniques | active, loud, web-heavy | HTTP_RESPONSE | FINDING | @liquidsec | 2022-07-27 |
| http | scan | No | Visit webpages using blasthttp (native Rust HTTP engine) | active, cloud-enum, safe, social-enum, subdomain-enum, web | OPEN_TCP_PORT, URL, URL_UNVERIFIED | HTTP_RESPONSE, URL | @liquidsec | 2026-03-08 |
| hunt | scan | No | Watch for commonly-exploitable HTTP parameters | active, safe, web-heavy | WEB_PARAMETER | FINDING | @liquidsec | 2022-07-20 |
| iis_shortnames | scan | No | Check for IIS shortname vulnerability | active, iis-shortnames, loud, web | URL | URL_HINT | @liquidsec | 2022-04-15 |
| legba | scan | No | Credential bruteforcing supporting various services. | active, invasive, loud | PROTOCOL | FINDING | @christianfl, @fuzikowski | 2025-07-18 |
| lightfuzz | scan | No | BBOT's DAST module — lightly fuzz web parameters discovered during recon for common vulnerability classes | active, invasive, loud, web-heavy | URL, WEB_PARAMETER | FINDING, HTTP_RESPONSE | @liquidsec | 2024-06-28 |
| medusa | scan | No | Medusa SNMP bruteforcing with v1, v2c and R/W check. | active, invasive, loud | PROTOCOL | FINDING | @christianfl | 2025-05-16 |
| newsletters | scan | No | Searches for Newsletter Submission Entry Fields on Websites | active, safe | HTTP_RESPONSE | FINDING | @stryker2k2 | 2024-02-02 |
| ntlm | scan | No | Watch for HTTP endpoints that support NTLM authentication | active, safe, web | HTTP_RESPONSE, URL | DNS_NAME, FINDING | @liquidsec | 2022-07-25 |
| nuclei | scan | No | Fast and customisable vulnerability scanner | active, invasive, loud | URL | FINDING, TECHNOLOGY | @TheTechromancer | 2022-03-12 |
| oauth | scan | No | Enumerate OAUTH and OpenID Connect services | active, affiliates, cloud-enum, safe, subdomain-enum, web | DNS_NAME, URL_UNVERIFIED | DNS_NAME | @TheTechromancer | 2023-07-12 |
| paramminer_cookies | scan | No | Smart brute-force to check for common HTTP cookie parameters | active, loud, slow, web-paramminer | HTTP_RESPONSE, WEB_PARAMETER | WEB_PARAMETER | @liquidsec | 2022-06-27 |
| paramminer_getparams | scan | No | Use smart brute-force to check for common HTTP GET parameters | active, loud, slow, web-paramminer | HTTP_RESPONSE, WEB_PARAMETER | WEB_PARAMETER | @liquidsec | 2022-06-28 |
| paramminer_headers | scan | No | Use smart brute-force to check for common HTTP header parameters | active, loud, slow, web-paramminer | HTTP_RESPONSE, WEB_PARAMETER | WEB_PARAMETER | @liquidsec | 2022-04-15 |
| portscan | scan | No | Port scan with masscan. By default, scans top 100 ports. | active, loud, portscan | DNS_NAME, IP_ADDRESS, IP_RANGE | OPEN_TCP_PORT | @TheTechromancer | 2024-05-15 |
| reflected_parameters | scan | No | Highlight parameters that reflect their contents in response body | active, safe, web-heavy | WEB_PARAMETER | FINDING | @liquidsec | 2024-10-29 |
| retirejs | scan | No | Detect vulnerable/out-of-date JavaScript libraries | active, safe, web-heavy | URL_UNVERIFIED | FINDING | @liquidsec | 2025-08-19 |
| robots | scan | No | Look for and parse robots.txt | active, safe, web | URL | URL_UNVERIFIED | @liquidsec | 2023-02-01 |
| securitytxt | scan | No | Check for security.txt content | active, cloud-enum, safe, subdomain-enum, web | DNS_NAME | EMAIL_ADDRESS, URL_UNVERIFIED | @colin-stubbs | 2024-05-26 |
| sslcert | scan | No | Extract hostnames and emails from TLS certificates in HTTP responses | active, affiliates, email-enum, safe, subdomain-enum, web | HTTP_RESPONSE | DNS_NAME, EMAIL_ADDRESS | @TheTechromancer | 2022-03-30 |
| telerik | scan | No | Scan for critical Telerik vulnerabilities | active, invasive, loud, web-heavy | HTTP_RESPONSE, URL | FINDING | @liquidsec | 2022-04-10 |
| url_manipulation | scan | No | Attempt to identify URL parsing/routing based vulnerabilities | active, loud, web-heavy | URL | FINDING | @liquidsec | 2022-09-27 |
| virtualhost | scan | No | Fuzz for virtual hosts | active, loud, slow | URL | DNS_NAME_UNVERIFIED, HTTP_RESPONSE, VIRTUAL_HOST | @liquidsec | 2022-05-02 |
| waf_bypass | scan | No | Detects potential WAF bypasses | active, safe, web-heavy | URL | FINDING | @liquidsec | 2025-09-26 |
| wafw00f | scan | No | Web Application Firewall Fingerprinting Tool | active, loud | URL | WAF | @liquidsec | 2023-02-15 |
| webbrute | scan | No | A fast web fuzzer powered by blasthttp | active, loud | URL | URL_UNVERIFIED | @liquidsec | 2022-04-10 |
| webbrute_shortnames | scan | No | Brute-force IIS shortnames using ML-predicted wordlists | active, iis-shortnames, loud, web-heavy | URL_HINT | URL_UNVERIFIED | @liquidsec | 2022-07-05 |
| affiliates | scan | No | Summarize affiliate domains at the end of a scan | affiliates, passive, safe | * | @TheTechromancer | 2022-07-25 | |
| anubisdb | scan | No | Query anubisdb.com for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-10-04 |
| apkpure | scan | No | Download android applications from apkpure.com | code-enum, download, passive, safe | MOBILE_APP | FILESYSTEM | @domwhewell-sage | 2024-10-11 |
| asn | scan | No | Query asndb for ASN information | passive, safe, subdomain-enum | IP_ADDRESS | ASN | @TheTechromancer | 2022-07-25 |
| azure_tenant | scan | No | Query Azure for tenant information using multiple enumeration methods | affiliates, cloud-enum, passive, safe, subdomain-enum | DNS_NAME | AZURE_TENANT, DNS_NAME, FINDING, URL_UNVERIFIED | @TheTechromancer | 2024-07-04 |
| bevigil | scan | Yes | Retrieve OSINT data from mobile applications using BeVigil | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME, URL_UNVERIFIED | @alt-glitch | 2022-10-26 |
| bucket_file_enum | scan | No | Works in conjunction with the filedownload module to download files from open storage buckets. Currently supported cloud providers: AWS, DigitalOcean | cloud-enum, passive, safe | STORAGE_BUCKET | URL_UNVERIFIED | @TheTechromancer | 2023-11-14 |
| bufferoverrun | scan | Yes | Query BufferOverrun's TLS API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2024-10-23 |
| builtwith | scan | Yes | Query Builtwith.com for subdomains | affiliates, passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-23 |
| c99 | scan | Yes | Query the C99 API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-08 |
| censys_dns | scan | Yes | Query the Censys API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-04 |
| censys_ip | scan | Yes | Query the Censys API for hosts by IP address | passive, safe | IP_ADDRESS | DNS_NAME, IP_ADDRESS, OPEN_TCP_PORT, OPEN_UDP_PORT, PROTOCOL, TECHNOLOGY, URL_UNVERIFIED | @TheTechromancer | 2026-01-26 |
| certspotter | scan | No | Query Certspotter's API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-28 |
| chaos | scan | Yes | Query ProjectDiscovery's Chaos API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-14 |
| code_repository | scan | No | Look for code repository links in webpages | code-enum, passive, safe | URL_UNVERIFIED | CODE_REPOSITORY | @domwhewell-sage | 2024-05-15 |
| credshed | scan | Yes | Send queries to your own credshed server to check for known credentials of your targets | passive, safe | DNS_NAME | EMAIL_ADDRESS, HASHED_PASSWORD, PASSWORD, USERNAME | @SpamFaux | 2023-10-12 |
| crt | scan | No | Query crt.sh (certificate transparency) for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-05-13 |
| crt_db | scan | No | Query crt.sh (certificate transparency) for subdomains via PostgreSQL | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2025-03-27 |
| dehashed | scan | Yes | Execute queries against dehashed.com for exposed credentials | email-enum, passive, safe | DNS_NAME | EMAIL_ADDRESS, HASHED_PASSWORD, PASSWORD, USERNAME | @SpamFaux | 2023-10-12 |
| dnsbimi | scan | No | Check DNS_NAME's for BIMI records to find image and certificate hosting URL's | cloud-enum, passive, safe, subdomain-enum | DNS_NAME | RAW_DNS_RECORD, URL_UNVERIFIED | @colin-stubbs | 2024-11-15 |
| dnscaa | scan | No | Check for CAA records | email-enum, passive, safe, subdomain-enum | DNS_NAME | DNS_NAME, EMAIL_ADDRESS, URL_UNVERIFIED | @colin-stubbs | 2024-05-26 |
| dnsdumpster | scan | No | Query dnsdumpster for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-03-12 |
| dnstlsrpt | scan | No | Check for TLS-RPT records | cloud-enum, email-enum, passive, safe, subdomain-enum | DNS_NAME | EMAIL_ADDRESS, RAW_DNS_RECORD, URL_UNVERIFIED | @colin-stubbs | 2024-07-26 |
| docker_pull | scan | No | Download images from a docker repository | code-enum, download, passive, safe, slow | CODE_REPOSITORY | FILESYSTEM | @domwhewell-sage | 2024-03-24 |
| dockerhub | scan | No | Search for docker repositories of discovered orgs/usernames | code-enum, passive, safe | ORG_STUB, SOCIAL | CODE_REPOSITORY, SOCIAL, URL_UNVERIFIED | @domwhewell-sage | 2024-03-12 |
| emailformat | scan | No | Query email-format.com for email addresses | email-enum, passive, safe | DNS_NAME | EMAIL_ADDRESS | @TheTechromancer | 2022-07-11 |
| fullhunt | scan | Yes | Query the fullhunt.io API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-24 |
| git_clone | scan | No | Clone code github repositories | code-enum, download, passive, safe, slow | CODE_REPOSITORY | FILESYSTEM | @domwhewell-sage | 2024-03-08 |
| gitdumper | scan | No | Download a leaked .git folder recursively or by fuzzing common names | code-enum, download, passive, safe, slow | CODE_REPOSITORY | FILESYSTEM | @domwhewell-sage | 2025-02-11 |
| github_codesearch | scan | Yes | Query Github's API for code containing the target domain name | code-enum, passive, safe, subdomain-enum | DNS_NAME | CODE_REPOSITORY, URL_UNVERIFIED | @domwhewell-sage | 2023-12-14 |
| github_org | scan | No | Query Github's API for organization and member repositories | code-enum, passive, safe, subdomain-enum | ORG_STUB, SOCIAL | CODE_REPOSITORY | @domwhewell-sage | 2023-12-14 |
| github_usersearch | scan | Yes | Query Github's API for users with emails matching in scope domains that may not be discoverable by listing members of the organization. | code-enum, passive, safe | DNS_NAME | EMAIL_ADDRESS, SOCIAL | @domwhewell-sage | 2025-05-10 |
| github_workflows | scan | Yes | Download a github repositories workflow logs and workflow artifacts | code-enum, download, passive, safe | CODE_REPOSITORY | FILESYSTEM | @domwhewell-sage | 2024-04-29 |
| google_playstore | scan | No | Search for android applications on play.google.com | code-enum, passive, safe | CODE_REPOSITORY, ORG_STUB | MOBILE_APP | @domwhewell-sage | 2024-10-08 |
| hackertarget | scan | No | Query the hackertarget.com API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-28 |
| hunterio | scan | Yes | Query hunter.io for emails | email-enum, passive, safe, subdomain-enum | DNS_NAME | DNS_NAME, EMAIL_ADDRESS, URL_UNVERIFIED | @TheTechromancer | 2022-04-25 |
| ip2location | scan | Yes | Query IP2location.io's API for geolocation information. | passive, safe | IP_ADDRESS | GEOLOCATION | @TheTechromancer | 2023-09-12 |
| ipneighbor | scan | No | Look beside IPs in their surrounding subnet | loud, passive, subdomain-enum | IP_ADDRESS | IP_ADDRESS | @TheTechromancer | 2022-06-08 |
| ipstack | scan | Yes | Query IPStack's GeoIP API | passive, safe | IP_ADDRESS | GEOLOCATION | @tycoonslive | 2022-11-26 |
| jadx | scan | No | Decompile APKs and XAPKs using JADX | code-enum, passive, safe | FILESYSTEM | FILESYSTEM | @domwhewell-sage | 2024-11-04 |
| kreuzberg | scan | No | Module to extract data from files | passive, safe | FILESYSTEM | RAW_TEXT | @domwhewell-sage | 2024-06-03 |
| leakix | scan | Yes | Query leakix.net for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-11 |
| myssl | scan | No | Query myssl.com's API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2023-07-10 |
| otx | scan | Yes | Query otx.alienvault.com for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-24 |
| pgp | scan | No | Query common PGP servers for email addresses | email-enum, passive, safe | DNS_NAME | EMAIL_ADDRESS | @TheTechromancer | 2022-08-10 |
| portfilter | scan | No | Filter out unwanted open ports from cloud/CDN targets | passive, safe | OPEN_TCP_PORT, URL, URL_UNVERIFIED | @TheTechromancer | 2025-01-06 | |
| postman | scan | Yes | Query Postman's API for related workspaces, collections, requests and download them | code-enum, passive, safe, subdomain-enum | ORG_STUB, SOCIAL | CODE_REPOSITORY | @domwhewell-sage | 2024-09-07 |
| postman_download | scan | Yes | Download workspaces, collections, requests from Postman | code-enum, download, passive, safe, subdomain-enum | CODE_REPOSITORY | FILESYSTEM | @domwhewell-sage | 2024-09-07 |
| rapiddns | scan | No | Query rapiddns.io for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-24 |
| securitytrails | scan | Yes | Query the SecurityTrails API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-03 |
| shodan_dns | scan | Yes | Query Shodan for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-03 |
| shodan_enterprise | scan | Yes | Shodan Enterprise API integration module. | passive, safe | IP_ADDRESS | FINDING, OPEN_TCP_PORT, OPEN_UDP_PORT, TECHNOLOGY | @Control-Punk-Delete | 2026-01-27 |
| shodan_idb | scan | No | Query Shodan's InternetDB for open ports, hostnames, technologies, and vulnerabilities | passive, portscan, safe, subdomain-enum | DNS_NAME, IP_ADDRESS | DNS_NAME, FINDING, OPEN_TCP_PORT, TECHNOLOGY | @TheTechromancer | 2023-12-22 |
| skymem | scan | No | Query skymem.info for email addresses | email-enum, passive, safe | DNS_NAME | EMAIL_ADDRESS | @TheTechromancer | 2022-07-11 |
| social | scan | No | Look for social media links in webpages | passive, safe, social-enum | URL_UNVERIFIED | SOCIAL | @TheTechromancer | 2023-03-28 |
| subdomaincenter | scan | No | Query subdomain.center's API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2023-07-26 |
| subdomainradar | scan | Yes | Query the Subdomain API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-08 |
| trajan | scan | No | Scans GitHub, GitLab, Azure DevOps, Jenkins, and JFrog for misconfigurations using Praetorian's Trajan tool | code-enum, passive, safe | CODE_REPOSITORY, TECHNOLOGY, URL_UNVERIFIED | FINDING | @N7WERA | 2026-04-11 |
| trickest | scan | Yes | Query Trickest's API for subdomains | affiliates, passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @amiremami | 2024-07-27 |
| trufflehog | scan | No | TruffleHog is a tool for finding credentials | code-enum, passive, safe | CODE_REPOSITORY, FILESYSTEM, HTTP_RESPONSE, RAW_TEXT | FINDING | @domwhewell-sage | 2024-03-12 |
| urlscan | scan | No | Query urlscan.io for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME, URL_UNVERIFIED | @TheTechromancer | 2022-06-09 |
| viewdns | scan | No | Query viewdns.info's reverse whois for related domains | affiliates, passive, safe | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-07-04 |
| virustotal | scan | Yes | Query VirusTotal's API for subdomains | passive, safe, subdomain-enum | DNS_NAME | DNS_NAME | @TheTechromancer | 2022-08-25 |
| wayback | scan | No | Query archive.org's Wayback Machine for subdomains, URLs, parameters, and archived content | passive, safe, subdomain-enum | DNS_NAME, URL | DNS_NAME, FINDING, HTTP_RESPONSE, URL_UNVERIFIED, WEB_PARAMETER | @liquidsec | 2022-04-01 |
| asset_inventory | output | No | Merge hosts, open ports, technologies, findings, etc. into a single asset inventory CSV | DNS_NAME, FINDING, HTTP_RESPONSE, IP_ADDRESS, OPEN_TCP_PORT, TECHNOLOGY, URL, WAF | IP_ADDRESS, OPEN_TCP_PORT | @liquidsec | 2022-09-30 | |
| csv | output | No | Output to CSV | * | @TheTechromancer | 2022-04-07 | ||
| discord | output | No | Message a Discord channel when certain events are encountered | * | @TheTechromancer | 2023-08-14 | ||
| elastic | output | No | Send scan results to Elasticsearch | * | @TheTechromancer | 2022-11-21 | ||
| emails | output | No | Output any email addresses found belonging to the target domain | email-enum, safe | EMAIL_ADDRESS | @domwhewell-sage | 2023-12-23 | |
| json | output | No | Output to Newline-Delimited JSON (NDJSON) | * | @TheTechromancer | 2022-04-07 | ||
| kafka | output | No | Output scan data to a Kafka topic | * | @TheTechromancer | 2024-11-22 | ||
| mongo | output | No | Output scan data to a MongoDB database | * | @TheTechromancer | 2024-11-17 | ||
| mysql | output | No | Output scan data to a MySQL database | * | @TheTechromancer | 2024-11-13 | ||
| nats | output | No | Output scan data to a NATS subject | * | @TheTechromancer | 2024-11-22 | ||
| neo4j | output | No | Output to Neo4j | * | @TheTechromancer | 2022-04-07 | ||
| nmap_xml | output | No | Output to Nmap XML | DNS_NAME, HTTP_RESPONSE, IP_ADDRESS, OPEN_TCP_PORT, PROTOCOL | @TheTechromancer | 2024-11-16 | ||
| postgres | output | No | Output scan data to a SQLite database | * | @TheTechromancer | 2024-11-08 | ||
| rabbitmq | output | No | Output scan data to a RabbitMQ queue | * | @TheTechromancer | 2024-11-22 | ||
| slack | output | No | Message a Slack channel when certain events are encountered | * | @TheTechromancer | 2023-08-14 | ||
| splunk | output | No | Send every event to a splunk instance through HTTP Event Collector | * | @w0Tx | 2024-02-17 | ||
| sqlite | output | No | Output scan data to a SQLite database | * | @TheTechromancer | 2024-11-07 | ||
| stdout | output | No | Output to text | * | @TheTechromancer | 2024-04-03 | ||
| subdomains | output | No | Output only resolved, in-scope subdomains | safe, subdomain-enum | DNS_NAME, DNS_NAME_UNRESOLVED | @TheTechromancer | 2023-07-31 | |
| teams | output | No | Message a Teams channel when certain events are encountered | * | @TheTechromancer | 2023-08-14 | ||
| txt | output | No | Output to text | * | @TheTechromancer | 2024-04-03 | ||
| web_parameters | output | No | Output WEB_PARAMETER names to a file | WEB_PARAMETER | @liquidsec | 2025-01-25 | ||
| web_report | output | No | Create a markdown report with web assets | FINDING, TECHNOLOGY, URL | @liquidsec | 2023-02-08 | ||
| webhook | output | No | Send every event to a custom URL via a webhook | * | @TheTechromancer | 2022-04-13 | ||
| websocket | output | No | Output to websockets | * | @TheTechromancer | 2022-04-15 | ||
| zeromq | output | No | Output scan data to a ZeroMQ socket (PUB) | * | @TheTechromancer | 2024-11-22 | ||
| cloudcheck | internal | No | Tag events by cloud provider, identify cloud resources like storage buckets | * | @TheTechromancer | 2024-07-07 | ||
| dnsresolve | internal | No | Perform DNS resolution | * | DNS_NAME, IP_ADDRESS, IP_RANGE, RAW_DNS_RECORD | @TheTechromancer | 2022-04-08 | |
| python | internal | No | Output via Python API | * | @TheTechromancer | 2022-09-13 | ||
| aggregate | internal | No | Summarize statistics at the end of a scan | passive, safe | @TheTechromancer | 2022-07-25 | ||
| excavate | internal | No | Passively extract juicy tidbits from scan data | passive, safe | HTTP_RESPONSE, RAW_TEXT | URL_UNVERIFIED, WEB_PARAMETER | @liquidsec | 2022-06-27 |
| speculate | internal | No | Derive certain event types from others by common sense | passive, safe | AZURE_TENANT, DNS_NAME, DNS_NAME_UNRESOLVED, HTTP_RESPONSE, IP_ADDRESS, IP_RANGE, SOCIAL, STORAGE_BUCKET, URL, URL_UNVERIFIED, USERNAME | DNS_NAME, FINDING, IP_ADDRESS, OPEN_TCP_PORT, ORG_STUB | @liquidsec | 2022-05-03 |
| unarchive | internal | No | Extract different types of files into folders on the filesystem | passive, safe | FILESYSTEM | FILESYSTEM | @domwhewell-sage | 2024-12-08 |
For a list of module config options, see Module Options.