Suite de ferramentas de auditoria e reconhecimento web/network para ambientes de laboratório e alvos autorizados.
AVISO: Este projeto é destinado exclusivamente para fins educacionais e de teste em ambientes autorizados. O uso irresponsável pode ser ilegal. Use com responsabilidade.
- Python 3.14.2+
git clone https://github.com/nxxtt/ferramentas_osint.git
cd ferramentas_osint
# Windows
.\setup.ps1
# Linux/Mac
chmod +x setup.sh
./setup.shO script instala Poetry, dependências e adiciona os comandos CLI ao PATH.
git clone https://github.com/nxxtt/ferramentas_osint.git
cd ferramentas_osint
pip install poetry
poetry install --with devNota: Após instalar manualmente, use
poetry run mytoolsou ative o venv compoetry env activate.
Isso instala os comandos CLI:
| Comando | Módulo |
|---|---|
mytools |
Painel interativo central |
mytools-port |
Scanner de portas TCP |
mytools-dir |
Scanner de diretórios HTTP |
mytools-recon |
Reconhecimento passivo |
mytools-audit |
Auditoria ofensiva/defensiva |
mytools-dnsxfer |
DNS Zone Transfer |
mytools-subenum |
Enumeração de subdomínios |
mytools-dnshistory |
Histórico DNS (OSINT) |
mytools-whoishistory |
Histórico WHOIS (OSINT) |
mytools-ipasn |
IP ASN/ISP enrichment |
mytools-techfp |
Technology Fingerprint |
mytools-oas |
OpenAPI/Swagger Discovery |
mytools-gql |
GraphQL Playground Exposure |
mytools-sm |
Source Map Discovery |
mytools-vcs |
VCS Leak Detection |
mytools-cfg |
Config File Detection |
mytools-bak |
Backup File Detection |
mytools-dork |
Google Dorking |
mytools-breach |
Email Breach Check |
mytools-soceng |
Social Engineering Recon |
mytools-leak |
Paste/Leak Monitoring |
mytools-dark |
Dark Web Monitoring |
mytools-rebind |
DNS Rebinding Detection |
mytools-dwt |
DNS Water Torture |
mytools-amp |
DNS Amplification Detection |
mytools-tunnel |
DNS Tunnel Detection |
mytools-dnssec |
DNSSEC Validation |
mytools-nsec |
NSEC Walking |
mytools-caa |
CAA Record Check |
mytools-doh |
DNS-over-HTTPS (DoH) Scan |
mytools-dot |
DNS-over-TLS (DoT) Scan |
mytools-secemail |
Email Security (DMARC/SPF/DKIM) |
mytools-spoof |
Email Spoofing Analysis |
mytools-smtpinject |
SMTP Header Injection |
mytools-smtpdown |
SMTP Downgrade Attack |
mytools-templeti |
Email Template Injection |
mytools-attachbypass |
Email Attachment Bypass |
mytools-addrbypass |
Email Address Bypass |
mytools-linktrack |
Email Link Tracking |
mytools-nullbyte |
Null Byte Injection |
mytools-dblurl |
Double URL Encoding Bypass |
mytools-ptraversal |
Path Traversal via Encoding |
mytools-rtlo |
RTL Override Bypass |
mytools-overlong |
Overlong UTF-8 Encoding |
mytools-bominject |
BOM Injection |
mytools-charsetbypass |
Charset Detection Bypass |
mytools-openredirect |
Open Redirect Detection |
mytools-crlfinject |
CRLF Injection Detection |
mytools-sstdetect |
SSTI Detection |
mytools-ssrfdetect |
SSRF Detection |
mytools-xxedetect |
XXE Detection |
mytools-nosqli |
NoSQL Injection Detection |
mytools-ldapi |
LDAP Injection Detection |
mytools-xpathi |
XPath Injection Detection |
mytools-ssiinject |
SSI Injection Detection |
mytools-protopoll |
Prototype Pollution Detection |
mytools-deserial |
Deserialization Injection Detection |
mytools-cachepoison |
Cache Poisoning Detection |
mytools-cachedec |
Web Cache Deception Detection |
mytools-methodoverride |
HTTP Method Override Detection |
mytools-hpp |
HTTP Parameter Pollution Detection |
mytools-blindxss |
Blind XSS via Callback Detection |
mytools-cors |
CORS Misconfiguration Detection |
mytools-clickjack |
Clickjacking Detection |
mytools-hostinject |
Host Header Injection Detection |
mytools-headerinject |
Header Injection via URL Params |
mytools-loginjection |
Log Injection Detection |
mytools-log4shell |
Log4Shell (CVE-2021-44228) Detection |
mytools-cookieboundary |
Cookie Domain Boundary Detection |
mytools-domclob |
DOM Clobbering via Named Access Detection |
mytools-mxss |
Mutation XSS Detection |
mytools-cssinject |
CSS Injection via Style Detection |
mytools-xssvectors |
XSS Vectors Detection |
mytools-fileupload |
File Upload Attacks Detection |
mytools-jwt |
JWT Analysis |
mytools-oauth |
OAuth 2.0 Misconfiguration Detection |
mytools-saml |
SAML Attack Detection |
mytools-oidc |
OIDC Attack Detection |
mytools-bizlogic |
Business Logic Attack Detection |
mytools-accountabuse |
Account Abuse Attack Detection |
mytools-multitenant |
Multi-Tenant Security Testing |
mytools-smuggle |
HTTP Request Smuggling |
mytools-http2abuse |
HTTP/2 Abuse |
mytools-headeredge |
Header & Parsing Edge Cases |
mytools-wsattack |
WebSocket Security Testing |
mytools-tlsfp |
TLS Fingerprinting |
mytools-certcheck |
Certificate Checks |
mytools-gqlattack |
GraphQL Attack Testing |
mytools-grpc |
gRPC Attack Testing |
mytools-thrift |
Thrift Attack Testing |
mytools-timing |
Timing Attack Testing |
mytools-lambda |
Lambda Attack Testing |
mytools-edge |
Edge Functions Attack Testing |
mytools-serverless |
Serverless Attack Testing |
mytools-k8s |
Kubernetes Attack Testing |
mytools-docker |
Docker Attack Testing |
mytools-infra |
Infrastructure Attack Testing |
mytools-iot |
IoT & Industrial Attack Testing |
mytools-lfi |
LFI/RFI Scanner |
mytools-cmd |
Command Injection Scanner |
mytools-csrf |
CSRF Scanner |
mytools-sqli |
SQL Injection Scanner |
mytools-subtakeover |
Subdomain Takeover Detection |
mytools-bruteforce |
Login Brute Force / Credential Testing |
mytools-bucket |
Cloud Bucket Enumeration (S3/GCP/Azure) |
mytools-batch |
Batch Scanner (multi-target) |
mytools-restfuzz |
REST API Fuzzer (auth bypass, content-type, HATEOAS) |
mytools-mobile |
Mobile API Testing (Android/iOS) |
mytools-cmsfp |
CMS Fingerprinting (WordPress, Joomla, Drupal) |
mytools-depscan |
Dependency Scanner (libs + CVE + outdated) |
mytools-analysis |
Attack Path Visualization & Exploit Suggestions |
mytools-cred |
Gerenciador de credenciais |
mytools-reconall |
Recon completo (todos os módulos) |
Nota: Após instalar, abra um novo terminal. Se o comando não for encontrado, adicione o diretório
Scriptsdo Python ao PATH.
python -m mytools.core.main # Painel unificado
python -m mytools.web.attackaudit --help # Ajuda individual
python -m mytools.dns.dnstransfer --help # DNS Zone Transfer# Build
docker build -t mytools .
# Subcomando direto (111 comandos disponíveis)
docker run --rm mytools mytools-recon https://example.com
docker run --rm mytools mytools-port 192.168.1.1 -p 80
docker run --rm mytools mytools-cors https://example.com
# Painel interativo
docker run --rm -it mytools mytools
# Com output em volume
docker run --rm -v $(pwd)/output:/output mytools mytools-recon https://example.com -o /output/recon.jsonOrquestrador do ecossistema com menu interativo colorido para alternar entre todas as subferramentas.
mytools
mytools --versionScanner de portas TCP com suporte a CIDR, banner grabbing e exportação JSON/CSV.
mytools-port 192.168.0.0/24 -p 22,80,443 -b
mytools-port scanme.nmap.org -p top100 -o resultado.json
mytools-port -l targets.txt -o results.json
mytools-port 10.0.0.0/30 -p 80 -w 100 --banner -o scan.csvFuzzing e descoberta de caminhos ocultos em servidores web com filtros de status code e extensões.
mytools-dir http://target.local -x php,txt,bak -s 200,403
mytools-dir http://127.0.0.1:8000 -w wordlist.txt
mytools-dir http://target.local --proxy http://proxy:8080 --delay 10
mytools-dir -l urls.txt --output-dir results/Reconhecimento passivo: headers de segurança, fingerprinting, robots.txt, sitemap.xml, WAF detection, email harvesting, WHOIS e lookup de CVEs.
mytools-recon https://example.com
mytools-recon https://example.com -o recon.json
mytools-recon https://example.com --proxy http://proxy:8080
mytools-recon -l targets.txt --output-dir results/
mytools-recon https://example.com --cve # Lookup de CVEs
mytools-recon https://example.com --cve --nvd-api-key KEY # Com API key
mytools-recon https://example.com --deep # Email harvesting + crawl
mytools-recon https://example.com --deep --crawl-limit 20 # Limite de páginas crawleadasAuditoria red/blue com verificação de CORS, TLS, cookies, XSS, SQLi, CSRF, métodos HTTP perigosos, deep scan de arquivos sensíveis e Session Fixation.
mytools-audit https://example.com --deep
mytools-audit https://example.com --deep -o audit.json
mytools-audit https://example.com --deep --proxy http://proxy:8080 --delay 5
mytools-audit -l targets.txt --output-dir results/
mytools-audit https://example.com --test-vulns # Testa XSS, SQLi e CSRF
mytools-audit https://example.com --paths-file sensitive.txt # Paths customizados
mytools-audit https://example.com --test-methods # Scan de métodos HTTP
mytools-audit https://example.com --login-url /login # Testa Session FixationTenta zone transfer (AXFR) em nameservers de um domínio para enumerar registros DNS.
mytools-dnsxfer example.com
mytools-dnsxfer example.com -o xfr.json
mytools-dnsxfer example.com -t 15Brute-force DNS de subdomínios com wordlist embutida ou customizada.
mytools-subenum example.com
mytools-subenum example.com -o subs.json
mytools-subenum example.com -w wordlist.txt
mytools-subenum example.com -T 50
mytools-subenum -l domains.txt --output-dir results/Consulta histórico DNS via fontes OSINT (DNSlytics, SecurityTrails, ViewDNS).
mytools-dnshistory example.com
mytools-dnshistory example.com -o dns-history.json
mytools-dnshistory example.com --sources dnslytics,viewdnsConsulta histórico WHOIS via fontes OSINT (SecurityTrails, WhoisXML).
mytools-whoishistory example.com
mytools-whoishistory example.com -o whois-history.json
mytools-whoishistory example.com --api-key KEYEnriquece IPs com dados BGP: ASN, organização, ISP, país, cidade. Dual API (ipwho.is + ip-api.com), suporte batch.
mytools-ipasn 8.8.8.8
mytools-ipasn 8.8.8.8 1.1.1.1 1.0.0.1
mytools-ipasn -l ips.txt -o asn.jsonFingerprinting tecnológico com 7 sinais: headers, meta tags, scripts, CSS, cookies, body HTML, headers de segurança. 40+ tecnologias, confidence scoring, categorias.
mytools-techfp https://example.com
mytools-techfp https://example.com -o tech.json
mytools-techfp -l urls.txt --output-dir results/Busca specs OpenAPI/Swagger expostas em paths comuns, faz parse JSON/YAML, extrai endpoints, métodos, tags e schemas.
mytools-oas http://target.com
mytools-oas http://target.com --endpoints
mytools-oas -l urls.txt -o oas.jsonDescobre GraphQL playgrounds expostos (GraphiQL, Playground, Altair, Voyager, Apollo Sandbox) e opcionalmente executa introspection query para extrair schema.
mytools-gql http://target.com
mytools-gql http://target.com --introspect
mytools-gql http://target.com --schemaBusca .map files de JavaScript expostos por duas abordagens: scan de <script src> + probing de paths comuns.
mytools-sm http://target.com
mytools-sm http://target.com --sources
mytools-sm http://target.com --no-scan-scriptsDetecta repositórios versionados expostos (.git, .svn, .hg) com validação de conteúdo para evitar falsos positivos.
mytools-vcs http://target.com
mytools-vcs http://target.com --git-only
mytools-vcs -l urls.txt -o vcs.jsonDetecta arquivos de configuração sensíveis expostos (.env, config.json, settings.py, .htpasswd) com validação por categoria.
mytools-cfg http://target.com
mytools-cfg http://target.com --category env
mytools-cfg http://target.com --sensitive-only
mytools-cfg -l urls.txt -o results.jsonDetecta arquivos de backup expostos (.bak, .old, .swp, .sql, .zip) com validação de magic bytes para evitar falsos positivos.
mytools-bak http://target.com
mytools-bak http://target.com --type sql
mytools-bak http://target.com --type archive
mytools-bak -l urls.txt -o results.jsonGera dorks Google para o alvo e busca via DuckDuckGo. 6 categorias de dorks + dorks customizados.
mytools-dork example.com
mytools-dork example.com --category filetype
mytools-dork example.com --category sensitive --search
mytools-dork example.com --custom-dork 'inurl:api v1'
mytools-dork -l domains.txt -o results.jsonVerifica se emails apareceram em vazamentos de dados usando múltiplas fontes (XposedOrNot, LeakCheck, HIBP).
mytools-breach [email protected]
mytools-breach [email protected] [email protected]
mytools-breach [email protected] --source hibp --hibp-api-key KEY
mytools-breach -f emails.txt -o results.jsonColeta emails, nomes e cargos de funcionários do alvo usando GitHub, Hunter.io e web scraping.
mytools-soceng example.com
mytools-soceng example.com --source github --source hunter
mytools-soceng example.com --hunter-api-key KEY
mytools-soceng -l domains.txt -o results.jsonMonitora pastes e repos públicos por credenciais e dados sensíveis do alvo (GitHub Gists, Pastebin RSS, GitLab Snippets).
mytools-leak example.com
mytools-leak example.com --source github_gists --source pastebin_rss
mytools-leak example.com --github-token ghp_xxx
mytools-leak -l domains.txt -o results.jsonBusca menções do domínio em sites .onion via APIs públicas (Ahmia, DarkSearch, Intelligence X).
mytools-dark example.com
mytools-dark example.com --source ahmia --source darksearch
mytools-dark example.com --intelx-key KEY
mytools-dark -l domains.txt -o results.jsonTesta vulnerabilidade a DNS rebinding (TTL, IPs privados, wildcard, IP flip).
mytools-rebind example.com
mytools-rebind example.com -o rebind.jsonStress test DNS com subdomínios aleatórios para testar resiliência do servidor.
mytools-dwt example.com
mytools-dwt example.com --num-queries 1000
mytools-dwt example.com -o dwt.jsonDetecta se servidor DNS pode ser usado para amplificação DDoS.
mytools-amp example.com
mytools-amp example.com -o amp.jsonDetecta DNS tunneling via análise de entropia, comprimento de labels e padrões.
mytools-tunnel example.com
mytools-tunnel example.com -o tunnel.jsonValida configuração DNSSEC: cadeia de confiança, RRSIG, força de algoritmo.
mytools-dnssec example.com
mytools-dnssec example.com -o dnssec.jsonEnumera zonas DNSSEC via NSEC records em cadeia.
mytools-nsec example.com
mytools-nsec example.com -o nsec.jsonVerifica registros CAA (Certificate Authority Authorization) de certificados.
mytools-caa example.com
mytools-caa example.com -o caa.jsonTesta resolucao DNS via HTTPS (RFC 8484) contra multiplos providers.
mytools-doh example.com
mytools-doh example.com -T AAAA
mytools-doh example.com -p google cloudflare
mytools-doh example.com --timeout 10Testa resolucao DNS via TLS (RFC 7858) na porta 853.
mytools-dot example.com
mytools-dot example.com -T AAAA
mytools-dot example.com -r google cloudflare
mytools-dot example.com --timeout 10Verifica configuração DMARC/SPF/DKIM de email.
mytools-secemail example.com
mytools-secemail example.com -o emailsec.jsonAnálise de vulnerabilidade a spoofing via SPF/DKIM/DMARC.
mytools-spoof example.com
mytools-spoof example.com -o spoof.jsonTesta injeção CRLF em campos de email via SMTP.
mytools-smtpinject mail.example.com
mytools-smtpinject mail.example.com --port 25
mytools-smtpinject mail.example.com --from-addr [email protected]Testa se servidor SMTP pode ser forçado a operar em plaintext (STARTTLS stripping).
mytools-smtpdown mail.example.com
mytools-smtpdown mail.example.com --port 25
mytools-smtpdown mail.example.com --from-addr [email protected]Testa injeção de código em templates de email (Jinja2, Handlebars, Mako, Tornado).
mytools-templeti mail.example.com
mytools-templeti mail.example.com --port 25
mytools-templeti mail.example.com --from-addr [email protected]Testa bypass de filtros de anexos de email (tipos perigosos, extensões duplas).
mytools-attachbypass mail.example.com
mytools-attachbypass mail.example.com --technique double-extensionTesta bypass de blocklists de email usando técnicas de encoding e formatação.
mytools-addrbypass [email protected]
mytools-addrbypass [email protected] --technique unicode
mytools-addrbypass -f emails.txt -o results.jsonDetecta tracking pixels e rewrites de links em emails.
mytools-linktrack https://example.com
mytools-linktrack https://example.com --deepTesta injecao de null bytes (%00) em URLs, headers e parâmetros HTTP.
mytools-nullbyte https://example.com
mytools-nullbyte https://example.com -c url
mytools-nullbyte https://example.com -c headerTesta bypass de filtros via encoding duplo de URLs.
mytools-dblurl https://example.com
mytools-dblurl https://example.com -c paramTesta path traversal via encoding de URLs.
mytools-ptraversal https://example.com
mytools-ptraversal https://example.com -c pathUsa Right-to-Left Override para confundir display de URLs.
mytools-rtlo https://example.com
mytools-rtlo https://example.com --type rtl
mytools-rtlo https://example.com --type zero-width
mytools-rtlo https://example.com --type combiningUsa overlong encoding para bypass de filtros.
mytools-overlong https://example.com
mytools-overlong https://example.com -c urlInjeta Byte Order Mark em início de arquivos/requests.
mytools-bominject https://example.com
mytools-bominject https://example.com -c urlForça detecção de charset errada para bypass.
mytools-charsetbypass https://example.com
mytools-charsetbypass https://example.com -c metaDetecta redirecionamentos abusivos em web apps.
mytools-openredirect https://example.com
mytools-openredirect https://example.com -c param
mytools-openredirect https://example.com -c bypassDetecta injecao de headers via \r\n em HTTP.
mytools-crlfinject https://example.com
mytools-crlfinject https://example.com -c param
mytools-crlfinject https://example.com -c headerDetecta Server-Side Template Injection em 12 engines: Jinja2, Twig, Freemarker, Mako, Pebble, Smarty, ERB, Velocity, Handlebars, Go, Blade, Razor.
mytools-sstdetect https://example.com
mytools-sstdetect https://example.com -c detect
mytools-sstdetect https://example.com -c exploit
mytools-sstdetect https://example.com -c bypass
mytools-sstdetect https://example.com -c header
mytools-sstdetect https://example.com -c bodyCategorias:
detect— Math payloads:{{7*7}},${7*7},@(7*7)para cada engineexploit— RCE: config dump, OS exec, file readbypass— Bypass de filtros: espaços, comments, concat, hexheader— Injeção via User-Agent, Referer, Cookiebody— Injeção via JSON/form body
Detecta Server-Side Request Forgery em web apps.
mytools-ssrfdetect https://example.com
mytools-ssrfdetect https://example.com -c detect
mytools-ssrfdetect https://example.com -c cloud
mytools-ssrfdetect https://example.com -c bypassDetecta XML External Entity em web apps via uploads de XML (SVG, SOAP, DOCX, RSS).
mytools-xxedetect https://example.com
mytools-xxedetect https://example.com -c detect
mytools-xxedetect https://example.com -c file_read
mytools-xxedetect https://example.com -c bypassDetecta injecao NoSQL em web apps (MongoDB, Redis, CouchDB).
mytools-nosqli https://example.com
mytools-nosqli https://example.com -c detect
mytools-nosqli https://example.com -c mongodb
mytools-nosqli https://example.com -c bypassDetecta injecao em filtros LDAP via parametros de busca.
mytools-ldapi https://example.com
mytools-ldapi https://example.com -c detect
mytools-ldapi https://example.com -c auth_bypass
mytools-ldapi https://example.com -c bypassDetecta injecao em consultas XPath.
mytools-xpathi https://example.com
mytools-xpathi https://example.com -c detect
mytools-xpathi https://example.com -c auth_bypass
mytools-xpathi https://example.com -c extractDetecta Server-Side Injection (RCE, leitura de arquivos, bypass).
mytools-ssiinject https://example.com
mytools-ssiinject https://example.com -c detect
mytools-ssiinject https://example.com -c rce
mytools-ssiinject https://example.com -c file_read
mytools-ssiinject https://example.com -c bypassDetecta injecao em prototypes de objetos JS (__proto__, constructor.prototype).
mytools-protopoll https://example.com
mytools-protopoll https://example.com -c detect
mytools-protopoll https://example.com -c constructor
mytools-protopoll https://example.com -c bypass
mytools-protopoll https://example.com -c impact
mytools-protopoll https://example.com -c dom
mytools-protopoll https://example.com -c library
mytools-protopoll https://example.com --callback-url https://evil.com/hookCategorias:
detect— Payloads basicos de proto e constructorconstructor— Via constructor.prototypebypass— Bypass de filtros (URL encoding, double encoding, nested)blind— Deteccao cega via timing/reflection/storedimpact— Verificacao de impacto (isAdmin, role, settings, RCE, XSS)dom— DOM-based: URL params, hash, JSON.parse, referrer, window.namelibrary— Bibliotecas: jQuery.extend, Lodash.merge, Vue.js, Angular, Node.js
Detecta desserializacao em PHP/Java/Python/Ruby/.NET/Node.js.
mytools-deserial https://example.com
mytools-deserial https://example.com -c php
mytools-deserial https://example.com -c java
mytools-deserial https://example.com -c python
mytools-deserial https://example.com -c ruby
mytools-deserial https://example.com -c dotnet
mytools-deserial https://example.com -c nodejs
mytools-deserial https://example.com -c bypassCategorias:
php— PHP serialize/unserialize (O:, a:, R:)java— Java ObjectInputStream, magic bytes, gadget chainspython— Python pickle, reduce, YAML, marshal, shelveruby— Ruby Marshal.load, YAML.load, ERB, Psych, Symboldotnet— .NET BinaryFormatter, ViewState, Json.NET, SoapFormatternodejs— Node.js node-serialize, child_process, fs, eval, processdetect— Deteccao generica (erros, timing, reflexao)bypass— Bypass de filtros (URL encode, base64, gzip)
Detecta cache key poisoning via headers nao-normalizados, path manipulation e CDN-specific headers.
mytools-cachepoison https://example.com
mytools-cachepoison https://example.com -c host
mytools-cachepoison https://example.com -c path
mytools-cachepoison https://example.com -c encoding
mytools-cachepoison https://example.com -c bypass
mytools-cachepoison https://example.com -c cdnCategorias CDN:
cf_connecting_ip— Cloudflare: CF-Connecting-IPtrue_client_ip— Akamai/Cloudflare: True-Client-IPgeneric_forwarded_port— Proxy reverso: X-Forwarded-Portgeneric_forwarded_proto— Proxy reverso: X-Forwarded-Protofastly_client_ip— Fastly: Fastly-Client-IP
Detecta paths que o cache armazena mas a app não deveria — extension, path, framework, encoding, bypass.
mytools-cachedec https://example.com
mytools-cachedec https://example.com -c extension
mytools-cachedec https://example.com -c path
mytools-cachedec https://example.com -c framework
mytools-cachedec https://example.com -c bypassDetecta bypass de ACL via headers, params, body — X-HTTP-Method-Override, _method, etc.
mytools-methodoverride https://example.com
mytools-methodoverride https://example.com -c header
mytools-methodoverride https://example.com -c bypass
mytools-methodoverride https://example.com -c verbDetecta HPP em diferentes positions — query, body, header, JSON, bypass.
mytools-hpp https://example.com
mytools-hpp https://example.com -c query
mytools-hpp https://example.com -c body
mytools-hpp https://example.com -c header
mytools-hpp https://example.com -c bypassInjeta payloads que disparam webhook quando renderizados em painéis internos.
mytools-blindxss https://example.com --webhook https://hook.example.com
mytools-blindxss https://example.com --webhook https://hook.example.com -c input
mytools-blindxss https://example.com --webhook https://hook.example.com -c header
mytools-blindxss https://example.com --webhook https://hook.example.com -c bypassDetecta DOM Clobbering via id/name em elementos HTML que sobrescrevem propriedades JavaScript.
mytools-domclob https://example.com
mytools-domclob https://example.com -c named_access
mytools-domclob https://example.com -c form_child
mytools-domclob https://example.com -c impactDetecta Mutation XSS via entidades HTML decodificadas, switches de namespace SVG/MathML, abuse de raw text, comment parsing, template deprecated e encoding tricks.
mytools-mxss https://example.com
mytools-mxss https://example.com -c entity_decode
mytools-mxss https://example.com -c namespace_switch
mytools-mxss https://example.com -c mathml_inject
mytools-mxss https://example.com -c rawtext_abuse
mytools-mxss https://example.com -c comment_parse
mytools-mxss https://example.com -c template_deprecated
mytools-mxss https://example.com -c encoding_tricksDetecta CSS Injection e técnicas de exfiltração de dados via style tag, style attribute, data extraction, attribute selectors, token exfiltração e CSP bypass.
mytools-cssinject https://example.com
mytools-cssinject https://example.com -c injection_points
mytools-cssinject https://example.com -c data_extraction
mytools-cssinject https://example.com -c attribute_leak
mytools-cssinject https://example.com -c selector_abuse
mytools-cssinject https://example.com -c token_exfil
mytools-cssinject https://example.com -c csp_bypassDetecta vetores de XSS via midia, URIs javascript/data, iframe srcdoc, base tag, custom elements, Shadow DOM e slot/use.
mytools-xssvectors https://example.com
mytools-xssvectors https://example.com -c media_events
mytools-xssvectors https://example.com -c uri_javascript
mytools-xssvectors https://example.com -c uri_data
mytools-xssvectors https://example.com -c iframe_vectors
mytools-xssvectors https://example.com -c base_redirect
mytools-xssvectors https://example.com -c custom_elements
mytools-xssvectors https://example.com -c shadow_dom
mytools-xssvectors https://example.com -c slot_useDetecta polyglots, SVG XXE, ImageMagick, ZIP Slip, filename injection, content-type mismatch e multipart boundary abuse.
mytools-fileupload https://example.com/upload
mytools-fileupload https://example.com -c polyglot
mytools-fileupload https://example.com -c svg_xxe
mytools-fileupload https://example.com -c image_magic
mytools-fileupload https://example.com -c zip_slip
mytools-fileupload https://example.com -c filename_inject
mytools-fileupload https://example.com -c content_type
mytools-fileupload https://example.com -c multipart_boundaryAnalisa tokens JWT para vulnerabilidades: algoritmo fraco (none), key confusion, expiracao, claims, header injection e replay.
mytools-jwt eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.xxx
mytools-jwt eyJ... -c weak_algorithm
mytools-jwt eyJ... -c signature_bypass
mytools-jwt eyJ... -c expiration
mytools-jwt eyJ... -c claims
mytools-jwt eyJ... -c header_injection
mytools-jwt eyJ... -c replay
mytools-jwt --file token.txt
mytools-jwt eyJ... --url https://target.com/api
mytools-jwt eyJ... --wordlist secrets.txt
mytools-jwt eyJ... -o resultado.jsonDetecta misconfigurations em fluxos OAuth: state ausente, implicit flow, redirect URI bypass, PKCE bypass, refresh token rotation.
mytools-oauth https://target.com/authorize
mytools-oauth https://target.com -c misconfig
mytools-oauth https://target.com -c scope_escalation
mytools-oauth https://target.com -c redirect_uri
mytools-oauth https://target.com -c pkce_bypass
mytools-oauth https://target.com -c refresh_tokenDetecta assertion replay e XML Signature Wrapping em implementacoes SAML.
mytools-saml --file response.xml
mytools-saml --saml-response PHNhbWw+...
mytools-saml --file response.xml --url https://target.com/acs
mytools-saml --file response.xml -c assertion_replay
mytools-saml --file response.xml -c xml_signature_wrapping
mytools-saml --file response.xml -o resultado.jsonDetecta discovery abuse e token substitution em implementacoes OpenID Connect.
mytools-oidc https://target.com
mytools-oidc https://target.com -c discovery
mytools-oidc https://target.com -c token_substitution
mytools-oidc https://target.com --proxy http://127.0.0.1:8080Detecta integer overflow em precos, negative quantity abuse e race conditions em checkout/pagamento.
mytools-bizlogic https://target.com/checkout
mytools-bizlogic https://target.com -c integer_overflow
mytools-bizlogic https://target.com -c negative_quantity
mytools-bizlogic https://target.com -c race_condition
mytools-bizlogic https://target.com --proxy http://127.0.0.1:8080Detecta abusos em contas: enumeracao de cupons, loyalty points, gift cards, refund manipulation e subscription bypass.
mytools-accountabuse https://target.com/account
mytools-accountabuse https://target.com -c coupon
mytools-accountabuse https://target.com -c loyalty_points
mytools-accountabuse https://target.com -c gift_card
mytools-accountabuse https://target.com -c refund
mytools-accountabuse https://target.com -c subscription
mytools-accountabuse https://target.com --proxy http://127.0.0.1:8080Testa isolamento entre tenants em aplicações SaaS/multi-tenant: manipulação de tenant ID, isolamento via subdomínios, acesso a recursos compartilhados, e cross-tenant SSRF.
mytools-multitenant https://app.example.com/api/v1/users
mytools-multitenant https://app.example.com -c tenant_id
mytools-multitenant https://app.example.com -c subdomain_isolation
mytools-multitenant https://app.example.com -c shared_resource
mytools-multitenant https://app.example.com -c cross_tenant_ssrf
mytools-multitenant https://app.example.com -c tenant_id shared_resource
mytools-multitenant https://app.example.com --timeout 30
mytools-multitenant https://app.example.com --proxy http://127.0.0.1:8080Testa CL.TE, TE.CL, TE.TE, Chunked+CL e HTTP pipelining desync via raw sockets.
mytools-smuggle https://target.com
mytools-smuggle https://target.com -c cl_te
mytools-smuggle https://target.com -c te_cl te_te
mytools-smuggle https://target.com -c pipeline
mytools-smuggle https://target.com --timeout 10
mytools-smuggle https://target.com --proxy http://127.0.0.1:8080Testa abusos no protocolo HTTP/2: downgrade, fingerprint, stream abuse, reset, settings, priority, push.
mytools-http2abuse https://target.com
mytools-http2abuse https://target.com -c h2_downgrade
mytools-http2abuse https://target.com -c h2_fingerprint h2_reset_attack
mytools-http2abuse https://target.com -c h2_settings_abuse h2_push_abuse
mytools-http2abuse https://target.com --timeout 10
mytools-http2abuse https://target.com --proxy http://127.0.0.1:8080Testa como servidores/proxies lidam com requests HTTP malformed: duplicate headers, versão malformada, null bytes, whitespace, case sensitivity, absolute URI e HTTP/0.9.
mytools-headeredge https://target.com
mytools-headeredge https://target.com -c duplicate_headers
mytools-headeredge https://target.com -c null_request_byte header_whitespace
mytools-headeredge https://target.com -c malformed_version header_case
mytools-headeredge https://target.com -c absolute_uri http09_request
mytools-headeredge https://target.com --timeout 10Testa endpoints WebSocket para vulnerabilidades: CSWSH, hijacking, upgrade abuse, message injection, DoS, compression bomb e payload fuzzing (XSS, SQLi, CMDi, Path Traversal, NoSQL, SSTI, Log Injection). Detecção por reflection + timing. 100% raw sockets.
mytools-wsattack wss://target.com/ws
mytools-wsattack wss://target.com/ws -c ws_scanner
mytools-wsattack wss://target.com/ws -c ws_dos ws_compression_bomb
mytools-wsattack wss://target.com/ws -c ws_payload_fuzz
mytools-wsattack wss://target.com/ws -c ws_upgrade_abuse ws_message_inject
mytools-wsattack wss://target.com/ws --timeout 10Testa fingerprinting TLS via construcao raw de ClientHello: JA3/JA4 hash, replay de browsers, key exchange analysis e cipher audit. 100% raw sockets.
mytools-tlsfp https://target.com
mytools-tlsfp https://target.com -c tls_fingerprint
mytools-tlsfp https://target.com -c tls_replay cipher_audit
mytools-tlsfp https://target.com -c key_exchange tls_fingerprint
mytools-tlsfp https://target.com --timeout 10Testa configuracao de certificados TLS e seguranca: OCSP stapling, certificate chain, CT transparency, split-world detection, HSTS preload e mixed content.
mytools-certcheck https://target.com
mytools-certcheck https://target.com -c ocsp_stapling
mytools-certcheck https://target.com -c cert_chain ct_sct
mytools-certcheck https://target.com -c hsts_preload mixed_content
mytools-certcheck https://target.com --timeout 10Testa seguranca de endpoints GraphQL: introspection, depth abuse, batch queries, alias overloading, schema stitching, persisted queries, resolver analysis e enumeration.
mytools-gqlattack https://target.com/graphql
mytools-gqlattack https://target.com/graphql -c introspection
mytools-gqlattack https://target.com/graphql -c depth_abuse batch_abuse
mytools-gqlattack https://target.com/graphql -c alias_overload persisted_abuse
mytools-gqlattack https://target.com/graphql --timeout 10Testa seguranca de endpoints gRPC: reflection abuse, server/client/bidirectional streaming, gRPC-Web bypass, protobuf field manipulation.
mytools-grpc grpc://target.com:50051
mytools-grpc grpc://target.com:50051 -c reflection
mytools-grpc grpc://target.com:50051 -c server_streaming bidirectional
mytools-grpc grpc://target.com:50051 -c grpc_web protobuf
mytools-grpc grpc://target.com:50051 --timeout 10Testa seguranca de servers Apache Thrift: method enumeration, binary protocol manipulation.
mytools-thrift thrift://target.com:9090
mytools-thrift thrift://target.com:9090 -c method_enumeration
mytools-thrift thrift://target.com:9090 -c binary_protocol
mytools-thrift thrift://target.com:9090 --timeout 10Testa timing side-channels: login user enumeration, token comparison, cache detection, DNS timing.
mytools-timing https://target.com/login
mytools-timing https://target.com/login --usernames admin root user test
mytools-timing https://target.com/login --token abc123def456
mytools-timing https://target.com/login --cache-rounds 10
mytools-timing https://target.com/login --dns-domains example.com google.comTesta seguranca de endpoints AWS Lambda: env var leaks, layer enumeration, temp file persistence.
mytools-lambda https://target.com/api/endpoint
mytools-lambda https://target.com/api/endpoint -c lambda
mytools-lambda https://target.com/api/endpoint --timeout 10Testa seguranca de edge functions: Azure, GCP, Vercel, Cloudflare.
mytools-edge https://target.com/api/endpoint
mytools-edge https://target.com/api/endpoint -c cloud_providers
mytools-edge https://target.com/api/endpoint --timeout 10Testa seguranca generica de endpoints serverless: cold start info leak, timeout abuse.
mytools-serverless https://target.com/api/endpoint
mytools-serverless https://target.com/api/endpoint -c generic
mytools-serverless https://target.com/api/endpoint --timeout 10Testa seguranca de clusters Kubernetes: API enumeration, Dashboard exposure.
mytools-k8s https://target.com:6443
mytools-k8s https://target.com:6443 -c kubernetes
mytools-k8s https://target.com:6443 --timeout 10Testa seguranca de Docker Registries: registry exposure, repository enumeration.
mytools-docker https://registry.target.com
mytools-docker https://registry.target.com -c docker
mytools-docker https://registry.target.com --timeout 10Testa seguranca de infraestrutura: Terraform state, Vault, CI/CD, Elastic, Redis/MongoDB, Debug endpoints.
mytools-infra https://target.com
mytools-infra https://target.com -c infrastructure
mytools-infra https://target.com --timeout 10Testa seguranca de dispositivos IoT e sistemas industriais: Modbus, OPC UA, BACnet, SNMP, MQTT.
mytools-iot 192.168.1.100:502
mytools-iot 192.168.1.100:502 -c iot
mytools-iot 192.168.1.100:502 --timeout 10Testa null origin, subdomain wildcard, credenciais com *, reflected origin.
mytools-cors https://example.com
mytools-cors https://example.com -c null_origin
mytools-cors https://example.com -c credentials
mytools-cors https://example.com -c reflectedTesta X-Frame-Options/CSP e bypasses em browsers legados.
mytools-clickjack https://example.com
mytools-clickjack https://example.com -c xframe
mytools-clickjack https://example.com -c csp
mytools-clickjack https://example.com -c bypassTesta manipulação de Host header para spoofing, SSRF, cache poisoning e bypass.
mytools-hostinject https://example.com
mytools-hostinject https://example.com -c reflected
mytools-hostinject https://example.com -c password_reset
mytools-hostinject https://example.com -c bypass
mytools-hostinject https://example.com --inject-host evil.comTesta se parâmetros de URL são refletidos como headers HTTP nas respostas.
mytools-headerinject https://example.com
mytools-headerinject https://example.com -c param_reflected
mytools-headerinject https://example.com -c header_overwrite
mytools-headerinject https://example.com -c bypassTesta se o servidor é vulnerável a injeção de conteúdo em logs via headers HTTP.
mytools-loginjection https://example.com
mytools-loginjection https://example.com -c user_agent
mytools-loginjection https://example.com -c referer
mytools-loginjection https://example.com -c bypassTesta JNDI injection em headers HTTP (CVE-2021-44228).
mytools-log4shell https://example.com
mytools-log4shell https://example.com -c jndi_basic
mytools-log4shell https://example.com -c header_injection
mytools-log4shell https://example.com -c bypassAudita cookies de uma aplicação web: domain boundary, path traversal, Double Submit Cookie (CSRF), SameSite DNS bypass, CSRF via subdomínio e cookie quoting edge cases.
mytools-cookieboundary https://example.com
mytools-cookieboundary https://example.com -c domain
mytools-cookieboundary https://example.com -c flags
mytools-cookieboundary https://example.com -c path
mytools-cookieboundary https://example.com -c path_traversal
mytools-cookieboundary https://example.com -c double_submit
mytools-cookieboundary https://example.com -c samesite_dns
mytools-cookieboundary https://example.com -c csrf_subdomain
mytools-cookieboundary https://example.com -c cookie_quoting
mytools-cookieboundary https://example.com --proxy http://proxy:8080Detecta Local File Inclusion e Remote File Inclusion via parâmetros HTTP. Payloads de path traversal, wrappers PHP, e protocolos remotos.
mytools-lfi http://target.com/page?file=home
mytools-lfi http://target.com/page?file=home -c lfi
mytools-lfi http://target.com/page?file=home -c rfi
mytools-lfi http://target.com/page?file=home --proxy http://proxy:8080Detecta Command Injection em parâmetros HTTP, headers e cookies. Testa payloads de OS command injection via timing, erro e reflexão.
mytools-cmd http://target.com/api?cmd=ls
mytools-cmd http://target.com/api?cmd=ls -c timing
mytools-cmd http://target.com/api?cmd=ls -c error
mytools-cmd http://target.com/api?cmd=ls -c reflexion
mytools-cmd http://target.com/api?cmd=ls --proxy http://proxy:8080Testa ativamente tokens CSRF: remoção, reutilização, troca de método. Detecta formulários sem proteção CSRF.
mytools-csrf http://target.com/form
mytools-csrf http://target.com/form -c token
mytools-csrf http://target.com/form -c method
mytools-csrf http://target.com/form --proxy http://proxy:8080Scanner standalone de SQL Injection: error-based, blind, time-based, union, bypass. Detecção por timing e análise de response.
mytools-sqli http://target.com/search?q=test
mytools-sqli http://target.com/search?q=test -c error
mytools-sqli http://target.com/search?q=test -c blind
mytools-sqli http://target.com/search?q=test -c union
mytools-sqli http://target.com/search?q=test --proxy http://proxy:8080Detecta dangling CNAMEs apontando para serviços não reclamados (S3, Azure, Heroku, GitHub Pages). Enumeração via crt.sh + wordlist embutida.
mytools-subtakeover example.com
mytools-subtakeover example.com --wordlist extras.txt
mytools-subtakeover example.com --concurrency 20Testa segurança de endpoints de login: rate limiting, account lockout, credential stuffing, password spray. Detecção automática de formulário de login.
mytools-bruteforce https://target.com/login
mytools-bruteforce https://target.com/login -c rate_limit
mytools-bruteforce https://target.com/login -c credential --username admin
mytools-bruteforce https://target.com/login -c spray --password 123456Detecta buckets abertos em S3, GCP e Azure. Gera nomes de bucket a partir do domínio e testa cada provedor.
mytools-bucket example.com
mytools-bucket example.com -p s3
mytools-bucket example.com -p gcp --timeout 15
mytools-bucket example.com -p azureExecuta todos os módulos contra um alvo de uma vez.
mytools-reconall https://example.com --deep
mytools-reconall example.com --skip dnstransfer --skip subenum
mytools-reconall example.com --deep --test-vulns --cveGera grafos de ataque baseados em findings de segurança. Exporta PNG/SVG e DOT format.
mytools-analysis findings.json
mytools-analysis findings.json --target example.com --png attack_path.png
mytools-analysis findings.json --svg attack_path.svg --dot attack_path.dot
mytools-analysis findings.json --exploits-onlyFuncionalidades:
- Constrói grafo direcionado com networkx (nós = vulnerabilidades, arestas = relacionamentos)
- Renderiza PNG/SVG com matplotlib (cores por severidade)
- Exporta DOT format para Graphviz
- Consolida exploits de todos os findings
- Cores: critical=vermelho, high=laranja, medium=amarelo, low=azul, info=cinza
Campo exploit e tool em 75+ módulos:
Todos os módulos de detecção agora incluem campo exploit com comandos/payloads utilizáveis e campo tool com a ferramenta recomendada quando a vulnerabilidade é detectada. Formato usa placeholder <TARGET>. A saída CLI mostra ambos os campos em destaque (Exploit: amarelo, Ferramenta: cyan).
Gerenciador de credenciais com keyring do sistema. Armazena, recupera e lista credenciais de forma segura.
mytools-cred set my-api-key
mytools-cred get my-api-key
mytools-cred del my-api-keyExecuta múltiplos módulos contra múltiplos alvos a partir de um arquivo de configuração YAML. Gera relatório consolidado com resumo de findings por severidade.
mytools-batch targets.txt
mytools-batch targets.txt --module mytools-port --module mytools-dns
mytools-batch targets.txt --severity high --output report.json
mytools-batch targets.txt --parallel 5Fuzzing genérico de APIs REST: auth bypass, content-type switching, version enumeration, HATEOAS. Auto-detecta endpoints via OpenAPI spec.
mytools-restfuzz https://api.example.com
mytools-restfuzz https://api.example.com -c auth_bypass
mytools-restfuzz https://api.example.com -c content_type version_enum
mytools-restfuzz https://api.example.com --endpoints /users /products /orders
mytools-restfuzz https://api.example.com -c hateoas --proxy http://127.0.0.1:8080Análise estática de APK/IPA + teste de OAuth2 mobile. Detecta certificate pinning, endpoints, secrets hardcoded, Network Security Config, entitlements iOS.
mytools-mobile scan app.apk
mytools-mobile scan MyApp.ipa
mytools-mobile endpoints app.apk
mytools-mobile secrets app.apk
mytools-mobile pinning app.apk
mytools-mobile scan app.apk -c apk_dex
mytools-mobile scan app.apk -c apk_disasm
mytools-mobile scan app.apk -c apk_decompile -f com.example.MyClass
mytools-mobile oauth2 --idp https://auth.example.com --client-id abc123Checks:
apk_metadata— Package, version, permissions, components, targetSdkapk_pinning— SSL pinning (OkHttp, TrustManager, NSC, TrustKit)apk_endpoints— URLs/endpoints em DEX bytecodeapk_secrets— API keys, tokens, passwords hardcodedapk_nsc— network_security_config.xml analysisapk_sdk— SDK fingerprinting (30+ SDKs)apk_dex— DEX structure: classes, methods, fields, strings, header infoapk_disasm— Dalvik bytecode disassembly per class/methodapk_decompile— Java source decompilation (DAD decompiler)ipa_metadata— Bundle ID, version, entitlements, ATSipa_provisioning— Provisioning profile analysisipa_macho— Mach-O imports, exports, rpaths, flags (via lief)ipa_secrets— Secrets em Mach-O strings + Info.plistoauth2_test— PKCE flow parameters (requer rede)jwt_validate— Decode + validação JWT
Deteccao ativa de CMS, plugins, temas e usuarios via probing de paths, headers e HTML. Suporta WordPress, Joomla, Drupal, Magento, PrestaShop, OpenCart.
mytools-cmsfp https://example.com
mytools-cmsfp https://example.com -c cms_detect wp_version wp_plugins
mytools-cmsfp https://example.com --plugin-limit 20 --theme-limit 10Checks:
cms_detect— Identificar CMS via paths caracteristicoswp_version— Versao do WordPress (readme.html, generator meta)wp_plugins— Enumerar plugins WordPresswp_themes— Enumerar temas WordPresswp_users— Enumerar usuarios WP (REST API + author pages)joomla_info— Versao + extensoes Joomla
Deteccao de bibliotecas front-end/back-end + verificacao CVE + versoes desatualizadas. Inspirado em retire.js / WPScan lite. Suporta sourcemap probing para resolver versoes.
mytools-depscan https://example.com
mytools-depscan https://example.com -c frontend_deps cve_check
mytools-depscan https://example.com -o deps.jsonChecks:
frontend_deps— Detectar libs front-end de HTML (script/link tags + sourcemaps)backend_deps— Detectar libs back-end (headers, cookies, manifests, error pages)cve_check— Verificar CVEs conhecidas (database offline)outdated_check— Verificar versoes desatualizadas
Adicionadas por add_base_args() — disponíveis em todos os módulos:
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-t, --timeout |
float |
5.0 |
Timeout em segundos |
-o, --output |
str |
None |
Salva resultado em arquivo .json ou .csv |
-v, --verbose |
flag |
False |
Mostra mensagens de debug no terminal |
--log-file |
str |
None |
Salva logs em arquivo |
-q, --quiet |
flag |
False |
Modo silencioso: sem banner/progresso. Requer -o |
--color |
flag |
None |
Força cores ANSI no terminal |
--no-color |
flag |
None |
Desativa cores ANSI no terminal |
--theme |
choice |
"cyber" |
Tema de cores: cyber, dracula, solarized, high-contrast |
--retries |
int |
3 |
Número de tentativas em falha HTTP |
--dry-run |
flag |
False |
Mostra o que faria sem executar |
--verify |
flag |
False |
Verifica certificados SSL/TLS |
--no-verify |
flag |
False |
Desativa verificação SSL/TLS |
--version |
version |
— | Mostra versão e sai |
--dump-payloads |
flag |
False |
Exporta todos os payloads YAML carregados como JSON e sai |
--json |
flag |
False |
Saída JSON estruturada em stdout (para piping com jq/grep) |
Adicionadas por add_http_args() — disponíveis em módulos que fazem requisições HTTP:
| Flag | Tipo | Padrão | Descrição | Módulos sem suporte |
|---|---|---|---|---|
-A, --user-agent |
str |
None |
User-Agent usado nas requisições | — |
--proxy |
str |
None |
Proxy para requisições. Ex: http://proxy:8080 |
— |
--delay |
float |
0.0 |
Delay em segundos entre requisições. 0 = sem limite | — |
--auth |
str |
None |
Basic auth (user:pass). Suporta @credential do keyring |
— |
--bearer-token |
str |
None |
Bearer token. Suporta @credential do keyring |
— |
--cookie |
str |
None |
Cookie. Ex: session=abc123; token=xyz. Suporta @credential |
— |
--header |
append |
[] |
Header customizado (repetível). Ex: --header "X-Token: abc" |
— |
Módulos que NÃO recebem flags HTTP (usam apenas add_base_args):
mytools-port, mytools-dnsxfer, mytools-doh, mytools-dot, mytools-nsec, mytools-tunnel, mytools-amp, mytools-caa, mytools-rebind, mytools-dnssec, mytools-dwt, mytools-dnshistory, mytools-subenum, mytools-smtpinject, mytools-smtpdown, mytools-templeti, mytools-addrbypass, mytools-attachbypass, mytools-spoof, mytools-secemail, mytools-linktrack, mytools-ipasn, mytools-whoishistory
Adicionadas por add_stealth_args() — compatibilidade varia por tipo de módulo:
| Flag | Tipo | Padrão | Módulos compatíveis | Descrição |
|---|---|---|---|---|
--random-delay |
flag |
False |
web, dns, email, osint, network, vcs, config | Delay aleatório entre requests (0-2s) |
--jitter |
float |
0.0 |
web, dns, email, osint, network, vcs, config | Variação aleatória no delay (0.0-1.0). Ex: 0.2 = +/-20% |
--user-agent-rotate |
flag |
False |
web, osint | Rotaciona User-Agent a cada request |
--impersonate |
choice |
None |
web | TLS fingerprint de browser real (requer curl-cffi). Opções: chrome, firefox, safari, edge |
--fragment |
int |
0 |
web, email | Fragmenta headers HTTP em chunks (evasão L7). Valor = tamanho do chunk |
--fragment-tcp |
int |
0 |
network | Fragmenta payload TCP em chunks (evasão L4). Valor = tamanho do chunk |
--tor |
flag |
False |
web, dns, email, osint, network, vcs, config | Roteia requests via Tor (SOCKS5) |
--waf-evasion |
flag |
False |
web, email | Aplica encoding anti-WAF em URLs e headers |
--pad-headers |
int |
0 |
web, email | Adiciona padding headers (mínimo total). Valor = contagem mínima |
--src-port-random |
flag |
False |
network | Porta TCP de origem aleatória |
--rate-limit |
float |
0.0 |
web, dns, email, osint, network, vcs, config | Rate limit global (requests/segundo). 0 = sem limite |
Disponíveis em módulos que suportam -l/--list:
| Flag | Tipo | Descrição |
|---|---|---|
-l, --list |
str |
Arquivo com targets (um por linha). Gera arquivos individuais por host |
--output-dir |
str |
Diretório para salvar JSONs individuais (um por host) |
Nota: Não use
-le target posicional ao mesmo tempo.
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
targets |
positional | — | IP, hostname ou CIDR. Ex: 192.168.0.10, 10.0.0.0/30 |
-p, --ports |
str |
top100 |
Portas: default, top100, all, 22,80,443 ou 1-1024 |
-w, --workers |
int |
100 |
Número de threads |
-b, --banner |
flag |
False |
Coleta banner em portas abertas |
Nota:
mytools-portNÃO recebe flags HTTP nem stealth.
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-w, --wordlist |
str |
None |
Wordlist customizada (um path por linha) |
-x, --extensions |
str |
[] |
Extensões a testar. Ex: php,txt,bak |
-s, --status |
str |
200,301,302,403 |
Status codes aceitos |
--concurrency |
int |
40 |
Concorrência assíncrona |
-M, --method |
choice |
GET |
Método HTTP: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS |
--filter-size |
str |
None |
Filtrar por tamanho. Ex: 100-5000 |
--filter-words |
str |
None |
Filtrar por contagem de palavras. Ex: 10-100 |
-C, --case-variation |
flag |
False |
Gera variações de case (Admin, ADMIN, aDmIn) |
-U, --unicode-norm |
flag |
False |
Gera variantes Unicode (circled, full-width) |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
--cve |
flag |
False |
Busca CVEs associadas às versões detectadas |
--nvd-api-key |
str |
None |
API key do NVD (aumenta limite de 5 para 50 req/30s) |
--deep |
flag |
False |
Ativa crawl para email harvesting |
--crawl-limit |
int |
10 |
Limite de páginas crawladas (requer --deep) |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
--deep |
flag |
False |
Habilita probes de arquivos e endpoints comuns |
--test-vulns |
flag |
False |
Testa XSS/SQLi em parâmetros |
--test-methods |
flag |
False |
Testa métodos HTTP perigosos (PUT, DELETE, PATCH, TRACE) |
--paths-file |
str |
None |
Arquivo com paths customizados. Ativa --deep automaticamente |
--params |
str |
None |
Params para injeção XSS/SQLi (separado por vírgula) |
--login-url |
str |
None |
URL de login para Session Fixation |
--concurrency |
int |
20 |
Concorrência para path probes |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-w, --wordlist |
str |
None |
Arquivo com subdomínios (um por linha) |
-T, --threads |
int |
— | Número de threads |
-P, --passive |
flag |
False |
Enumeração passiva (crt.sh, OTX, URLScan) |
--vt-api-key |
str |
None |
API key VirusTotal (ativa fonte VT no modo passivo) |
--st-api-key |
str |
None |
API key SecurityTrails |
--shodan-api-key |
str |
None |
API key Shodan |
| Flag | Tipo | Descrição |
|---|---|---|
--source |
append |
Fonte de dados (repetível). dnslytics/securitytrails/viewdns ou securitytrails/whoisxml |
--st-api-key |
str |
API key SecurityTrails |
--viewdns-api-key |
str |
API key ViewDNS (dnshistory) |
--whoisxml-api-key |
str |
API key WhoisXML (whoishistory) |
--record-types |
str |
Tipos de registro (dnshistory). Padrão: a,aaaa,mx,ns,txt |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-T, --type |
choice |
A |
Tipo de registro DNS. Opções: A, AAAA, MX, NS, TXT, CNAME, SOA, SRV, CAA |
-p, --providers / -r, --resolvers |
nargs+ |
todos | Providers/resolvers específicos |
| Flag | Tipo | Descrição |
|---|---|---|
name |
positional | Nome da credencial |
| Subcomando posicional | set, get, del |
Operação a realizar |
| Flag | Tipo | Descrição |
|---|---|---|
--git-only |
flag |
Verifica apenas .git |
--svn-only |
flag |
Verifica apenas .svn |
--hg-only |
flag |
Verifica apenas .hg |
--concurrency |
int |
Concorrência (padrão: 30) |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
--category |
choice |
all |
Categoria (cfg: env, config, framework, database, docker, credentials) |
--sensitive-only |
flag |
False |
Apenas arquivos sensíveis (cfg) |
--type |
choice |
all |
Tipo de backup (bak: bak, swp, tilde, sql, archive) |
--concurrency |
int |
30 |
Concorrência |
| Flag | Tipo | Descrição |
|---|---|---|
token |
positional | Token JWT para analisar |
--file |
str |
Arquivo com tokens JWT (um por linha) |
--url |
str |
URL alvo para testes ativos (envia tokens forjados) |
--wordlist |
str |
Arquivo com secrets para brute-force HMAC |
-c, --category |
choice |
Categoria de teste |
| Flag | Tipo | Descrição |
|---|---|---|
--saml-response |
str |
SAML Response em base64 |
--file |
str |
Arquivo com SAML Response XML ou base64 |
--url |
str |
URL do ACS (Assertion Consumer Service) |
| Flag | Tipo | Descrição |
|---|---|---|
findings_file |
positional | Arquivo JSON de findings (saída do attackaudit) |
--target |
str |
Label do alvo |
--png |
str |
Caminho para salvar PNG |
--svg |
str |
Caminho para salvar SVG |
--dot |
str |
Caminho para salvar DOT |
--exploits-only |
flag |
Mostra apenas exploits |
| Flag | Tipo | Descrição |
|---|---|---|
-c, --category |
choice |
Categoria de teste. CORS: null_origin, credentials, reflected. Clickjack: xframe, csp, bypass |
| Flag | Tipo | Descrição |
|---|---|---|
--usernames |
nargs+ |
Usuários para teste de enumeração |
--token |
str |
Token para teste de timing |
--cache-rounds |
int |
Rodadas para teste de cache |
--dns-domains |
nargs+ |
Domínios para teste DNS timing |
| Flag | Tipo | Descrição |
|---|---|---|
--deep |
flag |
Modo profundo (crawl, path probing) |
--test-vulns |
flag |
Testa XSS/SQLi no attackaudit |
--test-methods |
flag |
Testa métodos HTTP |
--cve |
flag |
Busca CVEs no webrecon |
-p, --ports |
str |
Portas para portscanner. Padrão: top100 |
--skip |
append |
Módulo para pular (repetível) |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
all |
Categoria: lfi, rfi, all |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
all |
Categoria: os_command, blind, bypass, all |
--param |
str |
None |
Nome do parâmetro (override auto-detect) |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
all |
Categoria: form_detection, cookie_analysis, origin_referer, token_analysis, all |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
all |
Categoria: error, blind, union, bypass, all |
--param |
str |
None |
Nome do parâmetro (override auto-detect) |
--concurrency |
int |
5 |
Requisições simultâneas |
--time-threshold |
float |
1.5 |
Threshold em segundos para time-based blind |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
--wordlist |
str |
None |
Arquivo com subdomínios extras (1 por linha) |
--concurrency |
int |
10 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
all |
Categoria: rate_limit, lockout, credential, spray, all (all = rate_limit + lockout) |
--username |
str |
admin |
Username para testes |
--password |
str |
password |
Senha para testes |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-p, --providers |
choice |
all |
Provedores: s3, gcp, azure, all |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
targets |
positional | — | Arquivo com alvos (1 por linha) |
modules |
positional (n="+") | — | Módulos ou all |
-p, --parallel |
int |
1 |
Targets simultâneos |
-o, --output-dir |
str |
None |
Diretório para JSONs |
--skip |
append |
[] |
Módulo para pular |
--strict |
flag |
False |
Exit 2 se encontrar vulns |
--fail-fast |
flag |
False |
Para no 1º erro (apenas --parallel 1) |
--format |
choice |
text |
Formato: text, json |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --categories |
nargs="+" |
["all"] |
Categorias: auth_bypass, content_type, version_enum, hateoas, all |
--endpoints |
nargs="+" |
None |
Endpoints para testar (default: auto-detect via /openapi.json) |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
None |
Categoria: detect, constructor, bypass, blind, impact, dom, library |
--callback-url |
str |
None |
URL de callback para detecção out-of-band |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
None |
Categoria: php, java, python, ruby, dotnet, nodejs, detect, bypass |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
None |
Categoria: host, path, header, encoding, bypass, cdn |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | Tipo | Padrão | Descrição |
|---|---|---|---|
-c, --category |
choice |
None |
Categoria: detect, exploit, bypass, header, body |
--concurrency |
int |
5 |
Requisições simultâneas |
| Flag | web | dns | osint | network | vcs | config | |
|---|---|---|---|---|---|---|---|
--proxy |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
--random-delay |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
--jitter |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
--user-agent-rotate |
✅ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
--impersonate |
✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
--fragment |
✅ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
--fragment-tcp |
❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ |
--tor |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
--waf-evasion |
✅ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
--pad-headers |
✅ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
--src-port-random |
❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ |
--rate-limit |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
--delay |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
--auth |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
--bearer-token |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
--cookie |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
--header |
✅ | ✅ | ✅ | ✅ | ✅ | — | — |
Nota:
mytools-portNÃO recebe nenhuma flag HTTP ou stealth. Ele usa apenas flags base (-t,-o,-v,-q,--color,--version).
mytoolsO menu oferece opções numéricas ou palavras-chave: port, dir, recon, audit, dns/xfer, sub/subenum, dns-history, whois-history, ip-asn, tech, oas, gql, sourcemap, vcs, cfg, bak, dork, breach, soceng, leak, dark, rebind, dwt, amp, tunnel, dnssec, nsec, caa, doh, dot, secemail, spoof, smtpinject, smtpdown, templeti, attachbypass, addrbypass, linktrack, nullbyte, dblurl, ptraversal, lfi, rtlo, overlong, cmd, bominject, charsetbypass, csrf, sqli, openredirect, crlfinject, sstdetect, ssrfdetect, xxedetect, nosqli, ldapi, xpathi, ssiinject, protopoll, deserial, cachepoison, cachedec, methodoverride, hpp, blindxss, cors, clickjack, hostinject, headerinject, loginjection, log4shell, cookieboundary, domclob, mxss, cssinject, xssvectors, fileupload, jwt, oauth, saml, oidc, bizlogic, accountabuse, multitenant, smuggle, http2abuse, headeredge, wsattack, tlsfp, certcheck, gqlattack, grpc, thrift, timing, lambda, edge, serverless, k8s, docker, infra, iot, bruteforce, bucket, subtakeover, batch, restfuzz, analysis, cred, reconall.
Cada módulo possui um shell interativo. Dentro dele, digite os argumentos normalmente:
scanner> 192.168.1.0/24 -p 80,443 -b -t 1
Use help para ver a ajuda, exit para voltar ao menu.
| Comando | Descrição |
|---|---|
mytools-port 127.0.0.1 -p 1-1024 |
Scan TCP nas primeiras 1024 portas |
mytools-dir http://testphp.vulnweb.com -x php |
Busca por arquivos .php |
mytools-recon https://example.com |
Recon passivo rápido |
mytools-recon https://example.com --cve |
Recon com lookup de CVEs |
mytools-recon https://example.com --deep |
Recon com email harvesting + crawl |
mytools-audit https://example.com --deep |
Auditoria completa com deep scan |
mytools-audit https://example.com --test-vulns |
Auditoria com testes XSS, SQLi e CSRF |
mytools-audit https://example.com -q -o audit.json |
Audit silencioso com saída em arquivo |
mytools-audit https://example.com --test-methods |
Scan de métodos HTTP |
mytools-dnsxfer example.com |
DNS Zone Transfer scan |
mytools-subenum example.com |
Enumeração de subdomínios |
mytools-dnshistory example.com |
Histórico DNS via OSINT |
mytools-whoishistory example.com |
Histórico WHOIS via OSINT |
mytools-ipasn 8.8.8.8 |
IP ASN/ISP enrichment |
mytools-techfp https://example.com |
Technology fingerprinting |
mytools-oas http://target.com |
OpenAPI/Swagger discovery |
mytools-gql http://target.com |
GraphQL playground discovery |
mytools-sm http://target.com |
Source map discovery |
mytools-vcs http://target.com |
VCS leak detection |
mytools-cfg http://target.com |
Config file detection |
mytools-bak http://target.com |
Backup file detection |
mytools-dork example.com |
Google dorking |
mytools-breach [email protected] |
Email breach check |
mytools-soceng example.com |
Social engineering recon |
mytools-leak example.com |
Paste/leak monitoring |
mytools-dark example.com |
Dark web monitoring |
mytools-rebind example.com |
DNS rebinding test |
mytools-dnssec example.com |
DNSSEC validation |
mytools-secemail example.com |
Email security (DMARC/SPF/DKIM) |
mytools-nullbyte https://example.com |
Null byte injection |
mytools-dblurl https://example.com |
Double URL encoding bypass |
mytools-ptraversal https://example.com |
Path traversal via encoding |
mytools-rtlo https://example.com |
RTL override bypass |
mytools-overlong https://example.com |
Overlong UTF-8 encoding |
mytools-bominject https://example.com |
BOM injection |
mytools-charsetbypass https://example.com |
Charset detection bypass |
mytools-openredirect https://example.com |
Open redirect detection |
mytools-crlfinject https://example.com |
CRLF injection detection |
mytools-sstdetect https://example.com |
SSTI detection |
mytools-ssrfdetect https://example.com |
SSRF detection |
mytools-xxedetect https://example.com |
XXE detection |
mytools-nosqli https://example.com |
NoSQL injection detection |
mytools-ldapi https://example.com |
LDAP injection detection |
mytools-xpathi https://example.com |
XPath injection detection |
mytools-dwt example.com |
DNS Water Torture |
mytools-amp example.com |
DNS Amplification Detection |
mytools-tunnel example.com |
DNS Tunnel Detection |
mytools-nsec example.com |
NSEC Walking |
mytools-caa example.com |
CAA Record Check |
mytools-doh example.com |
DNS over HTTPS (DoH) scan |
mytools-dot example.com |
DNS over TLS (DoT) scan |
mytools-spoof example.com |
Email Spoofing Analysis |
mytools-smtpinject example.com |
SMTP Header Injection |
mytools-smtpdown example.com |
SMTP Downgrade Attack |
mytools-templeti example.com |
Email Template Injection |
mytools-attachbypass example.com |
Email Attachment Bypass |
mytools-addrbypass example.com |
Email Address Bypass |
mytools-linktrack example.com |
Email Link Tracking |
mytools-ssiinject https://example.com |
SSI Injection Detection |
mytools-protopoll https://example.com |
Prototype Pollution Detection |
mytools-deserial https://example.com |
Deserialization Injection |
mytools-cachepoison https://example.com |
Cache Poisoning Detection |
mytools-cachedec https://example.com |
Web Cache Deception |
mytools-methodoverride https://example.com |
HTTP Method Override |
mytools-hpp https://example.com |
HTTP Parameter Pollution |
mytools-blindxss https://example.com |
Blind XSS via Callback |
mytools-cors https://example.com |
CORS Misconfiguration |
mytools-clickjack https://example.com |
Clickjacking Detection |
mytools-hostinject https://example.com |
Host Header Injection |
mytools-headerinject https://example.com |
Header Injection via URL |
mytools-loginjection https://example.com |
Log Injection Detection |
mytools-log4shell https://example.com |
Log4Shell Detection |
mytools-cookieboundary https://example.com |
Cookie Domain Boundary |
mytools-domclob https://example.com |
DOM Clobbering Detection |
mytools-mxss https://example.com |
Mutation XSS Detection |
mytools-cssinject https://example.com |
CSS Injection Detection |
mytools-xssvectors https://example.com |
XSS Vectors Detection |
mytools-fileupload https://example.com |
File Upload Attacks |
mytools-jwt eyJhbGci... |
JWT Analysis |
mytools-oauth https://example.com |
OAuth 2.0 Misconfiguration |
mytools-saml --file response.xml |
SAML Attack Detection |
mytools-oidc https://example.com |
OIDC Attack Detection |
mytools-bizlogic https://example.com |
Business Logic Attacks |
mytools-accountabuse https://example.com |
Account Abuse Detection |
mytools-multitenant https://example.com |
Multi-Tenant Security |
mytools-smuggle https://example.com |
HTTP Request Smuggling |
mytools-http2abuse https://example.com |
HTTP/2 Abuse |
mytools-headeredge https://example.com |
Header & Parsing Edge Cases |
mytools-wsattack wss://example.com |
WebSocket Security Testing |
mytools-tlsfp https://example.com |
TLS Fingerprinting |
mytools-certcheck https://example.com |
Certificate Checks |
mytools-gqlattack https://example.com |
GraphQL Attack Testing |
mytools-grpc target:50051 |
gRPC Security Testing |
mytools-thrift target:9090 |
Thrift Security Testing |
mytools-timing https://example.com |
Timing Attack Detection |
mytools-lambda https://example.com |
AWS Lambda Security |
mytools-edge https://example.com |
Edge Functions Security |
mytools-serverless https://example.com |
Serverless Framework Security |
mytools-k8s https://k8s-api:6443 |
Kubernetes Security Testing |
mytools-docker localhost:2375 |
Docker Security Testing |
mytools-infra https://cloud.example.com |
Cloud Infrastructure Testing |
mytools-iot http://device:80 |
IoT/Industrial Security |
mytools-lfi https://example.com |
LFI/RFI Scanner |
mytools-cmd https://example.com |
Command Injection Scanner |
mytools-csrf https://example.com |
CSRF Scanner |
mytools-sqli https://example.com |
SQL Injection Scanner |
mytools-subtakeover example.com |
Subdomain Takeover Detection |
mytools-bruteforce https://example.com |
Login Brute Force / Credential Testing |
mytools-bucket example.com |
Cloud Bucket Enumeration (S3/GCP/Azure) |
mytools-batch targets.txt |
Batch Scanner (multi-target) |
mytools-restfuzz https://api.example.com |
REST API Fuzzer |
mytools-restfuzz https://api.example.com -c auth_bypass |
Auth bypass testing |
mytools-cmsfp https://example.com |
CMS Fingerprinting |
mytools-depscan https://example.com |
Dependency Scanner |
mytools-cred set my-api-key |
Credential Manager (keyring) |
mytools-mobile scan app.apk |
Mobile API Testing (APK/IPA) |
mytools-analysis findings.json |
Attack path visualization |
mytools-reconall https://example.com --deep |
Recon completo com todos os módulos |
Todos os módulos HTTP suportam proxy e rate limiting:
# Usar proxy
mytools-dir http://target.local --proxy http://proxy:8080
# Rate limiting (segundos entre requests)
mytools-dir http://target.local --delay 0.5
# Proxy + rate limiting
mytools-audit https://target.local --deep --proxy http://proxy:8080 --delay 5# Desativar cores (padrão NO_COLOR — https://no-color.org/)
export NO_COLOR=1
mytoolssrc/mytools/ # Pacote principal
__init__.py # __version__
core/ # Infraestrutura compartilhada
utils.py # Cores, HTTP async, helpers, output (print_exploit_info)
stealth.py # Anti-detection: proxy, UA rotation, Tor, jitter, WAF evasion
cred.py # Gerenciador de credenciais (keyring)
main.py # Menu interativo central
reconall.py # Orquestrador: executa todos os módulos
network/ # Rede e portas
portscanner.py # Scanner de portas TCP
dirscanner.py # Scanner de diretórios HTTP
web/ # Web e HTTP
webrecon.py # Reconhecimento passivo + CVE + WHOIS
attackaudit.py # Auditoria ofensiva/defensiva
attackanalysis.py # Attack path visualization (networkx + matplotlib)
openapidiscovery.py # OpenAPI/Swagger Discovery
graphqlplayground.py # GraphQL Playground Exposure
sourcemapdiscovery.py # Source Map Discovery
techfingerprint.py # Technology Fingerprint
nullbyteinject.py # Null Byte Injection
doubleurlencode.py # Double URL Encoding Bypass
pathtraversal.py # Path Traversal via Encoding
rtloverride.py # RTL Override + Zero-Width + Combining
overlongencoding.py # Overlong UTF-8 Encoding
bominjection.py # BOM Injection
charsetbypass.py # Charset Detection Bypass + Content-Type Mismatch
openredirect.py # Open Redirect Detection
crlfinjection.py # CRLF Injection Detection
sstidetect.py # SSTI Detection
ssrfdetect.py # SSRF Detection
xxedetect.py # XXE Detection
nosqliinject.py # NoSQL Injection Detection
ldapiinject.py # LDAP Injection Detection
xpathinject.py # XPath Injection Detection
ssiinject.py # SSI Injection Detection
prototypepollution.py # Prototype Pollution Detection
deserialinject.py # Deserialization Injection Detection
cachepoisoning.py # Cache Poisoning Detection
cachedeception.py # Web Cache Deception Detection
methodoverride.py # HTTP Method Override Detection
httpparampollution.py # HTTP Parameter Pollution Detection
blindxss.py # Blind XSS via Callback Detection
corsmisconfig.py # CORS Misconfiguration Detection
clickjacking.py # Clickjacking Detection
hostheaderinject.py # Host Header Injection Detection
headerinject.py # Header Injection via URL Params
loginjection.py # Log Injection Detection
log4shell.py # Log4Shell (CVE-2021-44228) Detection
cookieboundary.py # Cookie Domain Boundary Detection
domclobbering.py # DOM Clobbering Detection
mxss.py # Mutation XSS Detection
cssinject.py # CSS Injection Detection
xssvectors.py # XSS Vectors Detection
fileupload.py # File Upload Attacks Detection
jwtanalysis.py # JWT Analysis
oauth.py # OAuth 2.0 Misconfiguration Detection
saml.py # SAML Attack Detection
oidc.py # OIDC Attack Detection
businesslogic.py # Business Logic Attack Detection
accountabuse.py # Account Abuse Attack Detection
multitenant.py # Multi-Tenant Security Testing
httsmuggle.py # HTTP Request Smuggling
http2abuse.py # HTTP/2 Abuse
headeredge.py # Header & Parsing Edge Cases
websocketattack.py # WebSocket Security Testing
tlsfingerprint.py # TLS Fingerprinting
certcheck.py # Certificate Checks
graphqlattack.py # GraphQL Attack Testing
grpcattack.py # gRPC Security Testing
thriftattack.py # Thrift Security Testing
timingattack.py # Timing Attack Detection
lambdaattack.py # AWS Lambda Security Testing
edgefunctions.py # Edge Functions (Cloudflare Workers) Security
serverlessattack.py # Serverless Framework Security Testing
k8sattack.py # Kubernetes Security Testing
dockerattack.py # Docker Security Testing
infraattack.py # Cloud Infrastructure Security Testing
iotattack.py # IoT & Industrial Protocol Testing
dns/ # DNS e resolução
dnstransfer.py # DNS Zone Transfer
subdomainenum.py # Enumeração de subdomínios
dnshistory.py # Histórico DNS (OSINT)
dnswatorture.py # DNS Water Torture
dnsamplification.py # DNS Amplification Detection
dnstunnel.py # DNS Tunnel Detection
dnssecvalidation.py # DNSSEC Validation
nsecwalking.py # NSEC Walking
caacheck.py # CAA Record Check
dnsrebinding.py # DNS Rebinding Detection
dohscan.py # DNS over HTTPS (DoH) scan
dotscan.py # DNS over TLS (DoT) scan
whois/ # WHOIS
whoishistory.py # Histórico WHOIS (OSINT)
osint/ # OSINT e reconhecimento
emailbreachcheck.py # Email Breach Check
socialengrecon.py # Social Engineering Recon
pasteleak.py # Paste/Leak Monitoring
darkwebmonitor.py # Dark Web Monitoring
googledorking.py # Google Dorking
ipasninfo.py # IP ASN/ISP Enrichment
email/ # Segurança de email
emailsecurity.py # DMARC/SPF/DKIM
emailspoof.py # Email Spoofing Analysis
smtpinjection.py # SMTP Header Injection
smtpdowngrade.py # SMTP Downgrade Attack
emailtemplateinject.py # Email Template Injection
emailattachmentbypass.py # Email Attachment Bypass
emailaddressbypass.py # Email Address Bypass
emaillinktracking.py # Email Link Tracking
vcs/ # Controle de versão
vcsleak.py # VCS Leak Detection
config/ # Arquivos de configuração
configfiledetect.py # Config File Detection
backupfiledetect.py # Backup File Detection
data/ # Payloads e wordlists externos (YAML)
__init__.py # Re-exporta load_payloads, dump_registry
loader.py # Carregador YAML/JSON com cache e fallback
core/security_headers.yaml
dns/subdomain_enum.yaml
osint/google_dorking.yaml
osint/darkweb_severity_keywords.yaml
osint/team_paths.yaml
vcs/vcs_leak_paths.yaml
network/port_scanner.yaml
network/dir_scanner.yaml
config/config_file_detect.yaml
config/backup_file_detect.yaml
email/template_injection.yaml
email/smtp_injection.yaml
email/address_bypass.yaml
email/link_tracking.yaml
email/dkim_selectors.yaml
web/jwt_common_secrets.yaml
web/docker_attack.yaml
web/ssrf_detect.yaml
web/openapi_paths.yaml
web/graphql_paths.yaml
web/sourcemap_paths.yaml
web/iot_attack.yaml
web/k8s_attack.yaml
web/infra_attack.yaml
web/lambda_attack.yaml
web/serverless_attack.yaml
web/blindxss.yaml
web/bominjection.yaml
web/businesslogic.yaml
web/cachedeception.yaml
web/cachepoisoning.yaml
web/charsetbypass.yaml
web/cookieboundary.yaml
web/corsmisconfig.yaml
web/crlfinjection.yaml
web/cssinject.yaml
web/deserialinject.yaml
web/domclobbering.yaml
web/edgefunctions.yaml
web/fileupload.yaml
web/methodoverride.yaml
web/mxss.yaml
web/nosqliinject.yaml
web/openredirect.yaml
web/pathtraversal.yaml
web/prototypepollution.yaml
web/xssvectors.yaml
web/xxedetect.yaml
mobile/ # Mobile API Testing (Android/iOS)
__init__.py # Package marker
_common.py # MobileAttempt, MobileResult dataclasses
apk_analyzer.py # APK metadata (androguard): package, SDK, components
apk_pinning.py # SSL pinning detection (OkHttp, NSC, TrustKit)
apk_endpoints.py # API endpoint extraction from DEX bytecode
apk_secrets.py # Hardcoded secrets (AWS, Google, JWT, keys)
apk_nsc.py # Network Security Config analysis
ipa_analyzer.py # IPA metadata (plistlib + lief): Info.plist, Mach-O
ipa_secrets.py # IPA secrets (Mach-O strings + Info.plist)
oauth2_flows.py # OAuth2 PKCE, Client Credentials, JWT validation
mobile_audit.py # BaseScanner CLI: run_scan + colored output
tests/ # Testes unitários (5405 testes)
core/ # test_utils, test_cred, test_reconall
network/ # test_portscanner, test_dirscanner
web/ # test_webrecon, test_attackaudit, ...
dns/ # test_dnstransfer, test_subdomainenum, ...
whois/ # test_whoishistory
osint/ # test_emailbreachcheck, ...
email/ # test_emailsecurity, ...
vcs/ # test_vcsleak
config/ # test_configfiledetect, ...
mobile/ # test_apk_analyzer, test_ipa_analyzer, ...
pyproject.toml # Configuração do projeto
Flags globais (--tor, --proxy, --impersonate, etc.) documentadas em Flags.
poetry run pytest tests/ -v
poetry run pytest tests/ --cov=mytools --cov-report=term-missing # Com coberturapoetry run ruff check src/mytools/ tests/
poetry run basedpyright src/mytools/poetry run pytest tests/ -m smoke # Testes rápidos
poetry run pytest tests/ -m integration # Testes de integração (HTTP real)
poetry run pytest tests/ -m "not real_sleep" # Excluir testes com sleep realpoetry install --with devhttpx>=0.28.1— HTTP client async com sessions, proxy, retryh2>=4.3.0— Protocolo HTTP/2 puro Python (frames, HPACK, SETTINGS, RST_STREAM)beautifulsoup4>=4.15.0— Parser HTML avançadopython-whois>=0.9.6— Consulta WHOISdnspython>=2.8.0— Resolução DNS, zone transfer e enumeração de subdomíniospyjwt>=2.13.0— Decodificação e análise de JWTcryptography>=49.0.0— Operações criptográficas (certificados, chaves)pyyaml>=6.0.3— Parse de YAML (OpenAPI specs + data/ payloads)pyreadline3>=3.5.6— Readline para Windows (apenas Windows)networkx>=3.6.1— Grafos e visualização de caminhos de ataquematplotlib>=3.11.1— Renderização de grafos (PNG/SVG)grpcio>=1.82.1— gRPC client/server (HTTP/2, protobuf)grpcio-reflection>=1.82.1— gRPC server reflection (introspecção de services)protobuf>=7.35.1— Protocol Buffers (serialização gRPC)thriftpy2>=0.6.0— Thrift protocol (RPC, deserialization)curl-cffi>=0.15.0— TLS fingerprint impersonation (Chrome, Firefox, Safari, Edge)httpx-socks[asyncio]>=0.11.0— Tor SOCKS5 proxy (async)
pytest>=9.1.1— Framework de testespytest-asyncio>=1.4.0— Testes asyncpytest-cov>=7.1.0— Cobertura de código (Codecov)respx>=0.23.1— Mock de httpx para testesruff>=0.15.22— Linter/formatterbasedpyright>=1.39.9— Type checker
Este software é fornecido "como está", sem garantia de qualquer tipo. O autor não se responsabiliza pelo uso indevido destas ferramentas. Execute apenas em ambientes que você tenha autorização expressa para testar.
nxt