KUMO-Domain-Recon-Tool - Kumo 蜘蛛 is a domain OSINT & security reconnaissanc

项目说明

<p align="center">
<img src="docs/banner.jpg" alt="KUMO 蜘蛛 — Domain OSINT & Reconnaissance" width="100%">
</p>

<p align="center">
<img src="
<img src="
<img src="
<img src="
<img src="
<img src="
<img src="
<a href=" src="
</p>

---

Give Kumo a domain and it maps e reachable about it in one pass:
DNS and email security, certificates and subdomains from CT logs,
open ports, technology fingerprints, leaked credentials and
infostealer infections, cloud buckets, and 358 checks
against known exposures. Twenty-se run in parallel, each one
streaming its own card the moment it lands — in the terminal or in the browser.

No API key is required for any of it.

<p align="center">
<img src="dashboard.png" alt="Kumo web dashboard" width="100%">
<br>_{The dashboard mid-scan: cards stream in as each module finishes,
glowing by se, with the scanner leading on findings.}
</p>

---

📑 Table of contents

---

📦 Installation

Requirements

| | |
|---|---|
| OS | Linux, macOS or Windows |
| Python | 3.8+ |
| Rights | none — Kumo ne root |
| API keys | none required |

Install

Optional extras, each used by a single module and skipped cleanly when absent:

> Nothing to configure. There is no config file, no key file and no
> database. Kumo reads what it needs from public sources at run time.

---

🚀 Running your first scan

Step 1 — Open the home screen

With no target, Kumo opens its home screen: every module numbered and grouped,
with the web interface on top.

<p align="center">
<img src="docs/cli-home.jpg" alt="Kumo CLI home screen" width="100%">
</p>

Step 2 — Choose what to run

| Input | Runs |
|---|---|
| 1 4 12 | just those modules |
| a | all 27 |
| f | fast scan — skips the slow modules |
| w | the web dashboard |
| q | quit |

Then enter the domain when prompted. Or skip the menu entirely:

Step 3 — Watch the spider work

Modules run in parallel, so results do not arrive in order. A spider crawls the
strand while they run, spinning silk behind it as each one lands, with the
modules still in flight trailing the counter.

<p align="center">
<img src="docs/cli-scan.jpg" alt="Kumo scanning" width="100%">
</p>

Step 4 — Export

---

🖥️ The terminal

The terminal is not a fallback — every module renders in full, with its own
layout, tables and se colouring.

| | |
|---|---|
| Home screen | all modules numbered, grouped, sized to the terminal |
| Selection | by number, or a / f / w |
| Themes | four palettes in 24-bit colour, --theme or KUMO_THEME |

---

🌐 The dashboard

Each module gets a card that appears immediately, shows a rotating edge while it is still running, then fills and
takes on the colour of what it found — red for critical, amber for warnings,
green for clean.

| | |
|---|---|
| Streaming | cards arrive as modules finish, no waiting for the slowest |
| Se glow | card colour is derived from the badges it renders |
| Module pills | click to enable or disable before scanning |
| Export | JSON, or a standalone HTML report |
| Themes | four, switchable li across reloads |

---

🎨 Themes

Four palettes, in both the dashboard and the terminal. Click a dot in the
header, or press <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>T</kbd> to cycle. The
choice is saved and survives a reload.

<p align="center">
<img src="docs/themes.jpg" alt="Kumo themes" width="100%">
</p>

| Theme | Character |
|---|---|
| Void *(default)* | deepest navy, cyan bloom, flat surfaces |
| Void Glass | lit card edges, under-glow, larger radius |
| Web 蜘蛛 | accent, strongest glow |
| Carbon | neutral surfaces, restrained glow — best for client screenshots |

In the terminal:

Adding a fifth theme is one palette block plus one dot — every renderer reads
its colours through the same token set.

---

🔓 scanner

358 checks, no external tool and no template directory to sync. The engine
mirrors nuclei's matcher model — status, word, regex, size and a small
dsl, combined with matchers_condition.

<p align="center">
<img src="docs/.jpg" alt="Kumo scanner card" width="82%">
</p>

---

🧩 Modules

27 modules, every one running in parallel. Click a module to see what it returns on a real scan.

Run them by number from the home screen, or by name: python3 kumo.py corp.demo -m dns ssl nuclei

Network & Infrastructure

<details>
<summary><b>📡 DNS — Records + email security</b> &nbsp;·&nbsp; <code>dns</code></summary>

Full DNS enumeration with a security grade on email protection. Detects missing DMARC, weak SPF policies, absent DKIM, and open zone transfers.

<p align="center"><img src="docs/mod-dns.jpg" alt="dns module" width="90%"></p>

</details>

<details>
<summary><b>📍 Geolocation — IP + ASN</b> &nbsp;·&nbsp; <code>geo</code></summary>

Resolves the domain to IPv4/IPv6, geolocates each IP, and pulls ASN, ISP, and organization data.

<p align="center"><img src="docs/mod-geo.jpg" alt="geo module" width="90%"></p>

</details>

<details>
<summary><b>🌐 WHOIS / RDAP — Registration data</b> &nbsp;·&nbsp; <code>whois</code></summary>

Full registrar record including creation date, expiry, registrant info, and nameservers. Detects domains expiring soon and pri registrations.

<p align="center"><img src="docs/mod-whois.jpg" alt="whois module" width="90%"></p>

</details>

<details>
<summary><b>🔒 SSL/TLS — Certificate analysis</b> &nbsp;·&nbsp; <code>ssl</code></summary>

Inspects the full certificate chain — issuer, expiry, Subject Alternati, cipher suite, and protocol . Flags expired, self-signed, or misconfigured certificates.

<p align="center"><img src="docs/mod-ssl.jpg" alt="ssl module" width="90%"></p>

</details>

<details>
<summary><b>🚪 Port Scan — 70+ ports + banners</b> &nbsp;·&nbsp; <code>ports</code></summary>

Scans 70+ common ports and grabs service banners for each open one. False-positi: the host is first probed on random unused ports — if it answers those too (tarpit, transparent proxy, or firewall that accepts e), only ports with real application-layer e (a service banner, a TLS handshake, or a valid HTTP reply) are reported. Every open port is also re- before being listed. Enriched with data from Shodan and Censys when a.

<p align="center"><img src="docs/mod-ports.jpg" alt="ports module" width="90%"></p>

</details>

<details>
<summary><b>🗺️ Subdomain Discovery — 4 passi + CT logs</b> &nbsp;·&nbsp; <code>subdomains</code></summary>

Queries crt.sh, HackerTarget, RapidDNS, and AlienVault OTX simultaneously, cross-references with Certificate Transparency logs, resol result, checks if it's alive, and flags anything that looks sensitive.

<p align="center"><img src="docs/mod-subdomains.jpg" alt="subdomains module" width="90%"></p>

</details>

<details>
<summary><b>🔨 Subdomain Brute Force</b> &nbsp;·&nbsp; <code>brute</code></summary>

Tests thousands of common subdomain names via DNS with wildcard detection — eliminates false positi. Finds subdomains that passi miss entirely.

<p align="center"><img src="docs/mod-brute.jpg" alt="brute module" width="90%"></p>

</details>

<details>
<summary><b>🎯 Favicon Hash — tech fingerprint</b> &nbsp;·&nbsp; <code>favicon</code></summary>

Fetches the favicon (HTML-declared first, then common paths in parallel — bounded so it ne), computes the MMH3 hash used by Shodan/Censys, and maps known hashes to technologies. Handy for fingerprinting the stack and pi to other hosts running the same favicon.

<p align="center"><img src="docs/mod-favicon.jpg" alt="favicon module" width="90%"></p>

</details>

---

Web Application Analysis

<details>
<summary><b>🖼️ Screenshot — Website o</b> &nbsp;·&nbsp; <code>screenshot</code></summary>

Takes a li of the target and runs it against the ransomware.live feed. Pulls the page title, meta description, favicon, CMS fingerprint, and checks whether the domain appears in any ransomware gang's leak posts.

<p align="center"><img src="docs/mod-screenshot.jpg" alt="screenshot module" width="90%"></p>

</details>

<details>
<summary><b>🕵️ WhatWeb — Technology fingerprinting</b> &nbsp;·&nbsp; <code>whatweb</code></summary>

Identifies the full tech stack — CMS, frameworks, Ja libraries, analytics, CDN, server, and more. Runs 80+ signature checks without sending a single intrusi.

<p align="center"><img src="docs/mod-whatweb.jpg" alt="whatweb module" width="90%"></p>

</details>

<details>
<summary><b>🤖 Robots / Security — Crawl rules + disclosure</b> &nbsp;·&nbsp; <code>robots</code></summary>

Parses robots.txt for disallowed and allowed paths, highlights sensitive ones, and checks for a security.txt disclosure contact. Also discovers sitemaps.

<p align="center"><img src="docs/mod-robots.jpg" alt="robots module" width="90%"></p>

</details>

<details>
<summary><b>📚 Wayback Machine — Archi</b> &nbsp;·&nbsp; <code>wayback</code></summary>

Queries the Wayback Machine for archi of the target — mining old endpoints, forgotten login pages, exposed config files, and paths that no longer exist on the live site but reveal the attack surface history.

<p align="center"><img src="docs/mod-wayback.jpg" alt="wayback module" width="90%"></p>

</details>

<details>
<summary><b>🧠 Content Intelligence — JS/HTML extraction</b> &nbsp;·&nbsp; <code>content_intel</code></summary>

Scrapes the homepage HTML, inline scripts, and every first-party JS file, then extracts the signal — not just secrets. Endpoints, internal/external URLs, API routes, database connection URIs, cloud storage (S3 / GCS / Azure / Firebase), emails, internal hosts, JWTs, private keys, source maps, and risky code comments. Static assets (.css, .js, images, fonts) and documentation domains (MDN, W3C) are filtered out; external URLs are collapsed to unique third-party hosts.

<p align="center"><img src="docs/mod-content_intel.jpg" alt="content_intel module" width="90%"></p>

</details>

<details>
<summary><b>🔎 HTTP Inspector — request/response headers</b> &nbsp;·&nbsp; <code>http_inspect</code></summary>

Your browser's De *Network* tab, headless. Shows exactly what Kumo sent and exactly what came back — the full request headers, every response header , the complete redirect chain, cookie security flags, allowed HTTP methods, CORS behaviour, and any non-standard or leaky headers worth a second look.

<p align="center"><img src="docs/mod-http_inspect.jpg" alt="http_inspect module" width="90%"></p>

</details>

<details>
<summary><b>🔌 API Endpoint Fuzzer</b> &nbsp;·&nbsp; <code>api_fuzzer</code></summary>

Smart API discovery. Probes a random baseline first to detect catch-all servers, confirms a base API path actually exists before fuzzing, then discovers li and checks for GraphQL introspection. Every hit shows its HTTP status and response byte size.

<p align="center"><img src="docs/mod-api_fuzzer.jpg" alt="api_fuzzer module" width="90%"></p>

</details>

<details>
<summary><b>🔑 JS Secret Scanner</b> &nbsp;·&nbsp; <code>js_secrets</code></summary>

Pulls and scans first-party Ja for hardcoded secrets — API keys, tokens, cloud credentials, and private keys — with clear-text output and the exact source line for each hit.

<p align="center"><img src="docs/mod-js_secrets.jpg" alt="js_secrets module" width="90%"></p>

</details>

<details>
<summary><b>🔓 Sensiti Discovery — 80+ known paths</b> &nbsp;·&nbsp; <code>endpoints</code></summary>

Probes 80+ paths that are commonly left exposed: admin panels, backup files, config files, debug interfaces, API docs, source control, and infrastructure files. Every hit is se. A 403 Forbidden response still confirms the path exists and is automatically downgraded one se level.

<p align="center"><img src="docs/mod-endpoints.jpg" alt="endpoints module" width="90%"></p>

</details>

---

Security & Threat Intelligence

<details>
<summary><b>🛡️ HTTP Headers — Security grade</b> &nbsp;·&nbsp; <code>headers</code></summary>

Checks every security-relevant response header and grades the configuration. Flags missing headers that leave the site open to XSS, clickjacking, MIME sniffing, and information disclosure.

<p align="center"><img src="docs/mod-headers.jpg" alt="headers module" width="90%"></p>

</details>

<details>
<summary><b>🧱 WAF Detection</b> &nbsp;·&nbsp; <code>wafw00f</code></summary>

Fingerprints the WAF or CDN sitting in front of the target using 40+ signatures — headers, cookies, ser, and acti responses. If nothing is detected, it says so clearly.

<p align="center"><img src="docs/mod-wafw00f.jpg" alt="wafw00f module" width="90%"></p>

</details>

<details>
<summary><b>🔓 Scanner — 358 built-in checks</b> &nbsp;·&nbsp; <code>nuclei</code></summary>

<p align="center"><img src="docs/mod-nuclei.jpg" alt="nuclei module" width="90%"></p>

Checks include: Log4Shell · Spring4Shell · Drupalgeddon2 · Confluence OGNL · Oracle WebLogic · 15 WordPress plugin CVEs · CORS misconfiguration · Host header injection · Clickjacking and many more.

Recent C (2024–2026) — a dedicated set of *detection-only* templates fingerprints exposure/ for the newest, acti CVEs (no exploitation, just correlation):

</details>

<details>
<summary><b>🔭 Shodan — InternetDB + C</b> &nbsp;·&nbsp; <code>shodan</code></summary>

Queries Shodan InternetDB (free, no key) for open ports, CPEs, hostnames, and CVEs. Every CVE is enriched with C, se, KEV flag, and description 's free CVEDB API.

<p align="center"><img src="docs/mod-shodan.jpg" alt="shodan module" width="90%"></p>

</details>

<details>
<summary><b>🔬 Censys — Hosts + certificates</b> &nbsp;·&nbsp; <code>censys</code></summary>

Pulls host data and certificate intelligence from Censys. Enriched with optional API key for full results.

<p align="center"><img src="docs/mod-censys.jpg" alt="censys module" width="90%"></p>

</details>

<details>
<summary><b>💀 Breach & Credential Intelligence — 5 sources</b> &nbsp;·&nbsp; <code>breachintel</code></summary>

Aggregates from 5 free sources and runs an automatic per-email stealer check against Hudson Rock's database — showing which employee machines were infected, what malware ran, what passwords were stolen, and which services were compromised.

<p align="center"><img src="docs/mod-breachintel.jpg" alt="breachintel module" width="90%"></p>

</details>

<details>
<summary><b>📧 Email Har</b> &nbsp;·&nbsp; <code>email_harvest</code></summary>

Discovers employee email addresses across multiple open sources, then merges in every confirmed email found during the breach intelligence scan.

<p align="center"><img src="docs/mod-email_harvest.jpg" alt="email_harvest module" width="90%"></p>

Sources: Hunter.io · crt.sh certificate logs · web page scraping (contact / about / team) · DNS SOA record · WHOIS contact · Wayback Machine archive · common business prefixes.

</details>

<details>
<summary><b>☁️ Cloud Storage Buckets</b> &nbsp;·&nbsp; <code>cloud_buckets</code></summary>

Enumerates likely AWS S3 / GCP / Azure bucket names derived from the domain and checks for public exposure. Only a confirmed HTTP 200 (publicly readable) is reported — unreliable 403 responses are ne as findings.

<p align="center"><img src="docs/mod-cloud_buckets.jpg" alt="cloud_buckets module" width="90%"></p>

</details>

<details>
<summary><b>🔍 Google Dorks — 61 queries</b> &nbsp;·&nbsp; <code>dorks</code></summary>

Generates 61 targeted Google dork queries pre-built for the domain — one click opens them in Google. Covers exposed files, login pages, sensiti, subdomains, cached pages, code repositories, and more.

<p align="center"><img src="docs/mod-dorks.jpg" alt="dorks panel" width="46%"></p>

</details>

<details>
<summary><b>🔗 OSINT Platform Links — 26 sources</b> &nbsp;·&nbsp; <code>osint</code></summary>

Pre-generates 26 in links for the target across the most useful OSINT platforms — one click and you're there.

<p align="center"><img src="docs/mod-osint.jpg" alt="osint panel" width="46%"></p>

---

</details>

---

⚙️ Optional API keys

E abo with no key at all. These only unlock richer data:

| | Unlocks |
|---|---|
| SHODAN_API_KEY | full Shodan host data — banners, services, history |
| CENSYS_API_ID + CENSYS_API_SECRET | full Censys host & certificate search |
| HIBP_API_KEY | per-email Ha lookup |
| CHIASMODON_API_KEY | Chiasmodon pro tier — more results |
| RANSOMWARE_LI | Ransomware.live pro feed |

---

📟 CLI reference

| Flag | Default |
|---|---|
| --theme | void, or $KUMO_THEME |
| -p / --port | 8888 |
| --host | 0.0.0.0 |

Fast mode skips: wayback · brute · subdomains · screenshot ·
email_harvest · nuclei · cloud_buckets

---

🧪 Tests

test_rules.py is the one that matters. It runs each rule
against a fixture *and* against se, and fails if a rule
either misses its target or fires on something harmless.

---

🙏 Credits

Kumo collects and correlates — the data belongs to the sources below, and they
deserve the star far more than this repo does:

| Source | Used for |
|---|---|
| crt.sh | certificate transparency logs, subdomain discovery |
| Shodan InternetDB | open ports, CVEs, host tags — free, keyless |
| Hudson Rock | infostealer infection intelligence |
| ProjectDiscovery | the templates behind most rules |
| Wayback Machine | archived URLs and historical surface |

Respect each source's own terms of use and rate limits.

---

🌐 Ecosystem

| | Tool | Domain |
|---|---|---|
| ☁️ | Kumo 蜘蛛 | domain OSINT & reconnaissance |
| 🌑 | Kage 影 | DFIR host triage |

---

> ⚠️ For authorized security testing only.
> Only scan domains you own or ha written permission to test.
> Free to use, modify and share for educational and personal purposes — please
> credit the work. Commercial use requires explicit permission from the author.

<p align="center">_{Built for those who move fast. 蜘蛛}</p>

项目信息

开发语言：Python

Star 数：62

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Kumo 蜘蛛 is a domain OSINT & security reconnaissance framework. Drop a domain, get everything back in real time across 27 parallel modules: DNS, open ports, leaked credentials, infostealer infections, vulnerable endpoints, subdomains, CVEs, malware families, and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。