The Ultimate Open-Source OSINT & Web Security Hub | One tool. 25+ features. Infinite reconnaissance possibilities.
A blazing-fast, concurrent URL security scanner & OSINT toolkit built in Go with an extensible plugin architecture. Designed for security researchers, bug bounty hunters, penetration testers, and DevOps teams who need comprehensive reconnaissance in seconds, not hours.
Scan once. Get everything you need.
- Subdomain Discovery – Passive enumeration via cert transparency, DNS history, and archive APIs
- Historical URL & Archive Explorer – Uncover old admin panels, debug endpoints, leaked files
- Leaked Content Detection – Spot accidentally indexed directories, robots.txt disallows, exposed .git & .env files
- Social Surface Preview – Extract LinkedIn, GitHub, Twitter, social profiles exposed by the target
- Target Footprint Summary – One-card overview: hosting, ASN, country, tech stack, risk indicators
- WHOIS & Domain Intelligence – Registration details, nameservers, historical registrant info
- DNS Records Deep Dive – A, MX, NS, TXT, SOA records with historical changes
- IP & Geolocation Mapping – Hosting provider, autonomous system, country, data center details
- HTTP Security Header Scorecard – CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy with fixes
- TLS/SSL Health Report – Certificate validity, key strength, cipher suites, protocol versions, expiration warnings
- Missing Security Header Detection – Identify gaps, suggest implementations, provide snippets
- OWASP Security Baseline – Lightweight checks for reflective XSS, SQLi patterns, SSRF hints, path traversal indicators
- WAF/CDN Detection – Identify Cloudflare, Akamai, AWS Shield, ModSecurity fingerprints
- Deep HTTP Fingerprinting – Framework detection (Django, Rails, Laravel, Express, etc.), server software, middleware, language
- CMS & Plugin Enumeration – WordPress plugins, Drupal modules, Joomla versions with known vulnerabilities
- Frontend Framework Detection – React, Vue, Angular, Next.js versions and configurations
- JavaScript Dependency Analysis – Identify outdated libraries (jQuery, Bootstrap, etc.) via DOM inspection
- API Endpoint Discovery – GraphQL, REST APIs, WebSocket endpoints, deprecated API paths
- Port & Service Discovery – Top common ports with service identification (HTTP, HTTPS, SSH, FTP, etc.)
- SSL Certificate Chain Analysis – Full certificate hierarchy, issuer reputation, self-signed detection
- Threat Intelligence Integration – Optional hooks for IP reputation, malware blacklists, domain scores
- Real-Time Monitoring Mode – Scheduled rescans with webhook/Slack notifications on changes
- Dark Web & Paste Site Hints – Meta-level pointers for external threat intel searches (non-invasive)
- Multi-Format Outputs – JSON, SARIF, HTML, Markdown, CSV with customizable templates
- Shareable Scan Badges – GitHub README badges linking to scan results
- Beautiful HTML Reports – Severity tags, icons, remediation tips, proof-of-concept samples
- CLI + Web UI Parity – Every feature available in CLI and browser interface
- Scan Presets – "Quick Recon", "Bug Bounty", "Compliance Baseline" templates
- AI-Assisted Risk Summary – Auto-generate executive summaries with top 3 risks & business impact
- OSINT Graph Visualization – Visual attack surface mapping: domains → IPs → tech → third-parties
- Proof-Based Findings – Each issue includes HTTP samples, matched payload, "why it matters" explanations
- Interactive Onboarding – First-time user walkthrough with shareable report generation
- Community Plugin System – Extensible Go interfaces; featured community checks in the hub
- "Teach Me" Mode – Educational notes on each finding type for junior security learners
- Safe-by-Default Scanning – No destructive payloads, explicit consent warnings, privacy-first design
| Category | Features | Status |
|---|---|---|
| Recon & OSINT | Subdomains, Archives, Tech Stack, Social Links, Footprint | ✅ Active |
| Web Security | Headers, TLS, OWASP Checks, Exposed Files, WAF Detection | ✅ Active |
| Tech Detection | Fingerprinting, CMS, Frameworks, JS Libraries, APIs | ✅ Active |
| Intelligence | Port Scanning, Cert Chain, Threat Intel Hooks, Monitoring | 🚀 Launching Soon |
| Reporting | JSON/SARIF/HTML, Badges, Presets, CLI Parity | 🚀 Launching Soon |
| AI & Trends | Risk Summaries, Graph Viz, Plugin System, "Teach Me" Mode | 🎯 Q1 2026 |
✅ All-in-One Platform – 25+ checks in a single unified tool; no tool-chaining needed ✅ Speed & Scale – Goroutine-based concurrency handles thousands of URLs in minutes ✅ Privacy-First – Open source, self-hosted, no cloud data collection ✅ Extensible – Plugin architecture for custom checks and integrations ✅ Beautiful Output – Scan badges, interactive HTML reports, shareable findings ✅ Community-Driven – Trending 2026 features: AI summaries, graphs, plugin ecosystem ✅ DevOps Ready – JSON/SARIF output, CI/CD-friendly, GitHub Actions integration ✅ Educational – "Teach Me" mode for junior security professionals learning on the job
# Clone and build
git clone https://github.com/DhanushNehru/urlhawkscanner.git
cd urlhawkscanner
go build -o urlhawkscanner
sudo mv urlhawkscanner /usr/local/bin/
# Or install directly
go install github.com/DhanushNehru/urlhawkscanner@latest# Scan a single URL (comprehensive OSINT + security)
urlhawkscanner -u https://example.com
# Scan a list of URLs with 50 concurrent workers
urlhawkscanner -l urls.txt -t 50
# Output to JSON for pipeline integration
urlhawkscanner -u https://example.com -f json -o report.json
# Generate shareable HTML report
urlhawkscanner -u https://example.com -f html -o scan.html
# Use a preset template (quick, complete, compliance)
urlhawkscanner -u https://example.com --preset bug-bounty
# Enable monitoring with Slack webhooks
urlhawkscanner -u https://example.com --monitor --slack-webhook https://hooks.slack.com/...# Launch the web interface
urlhawkscanner web
# Open http://localhost:3000 and start scanning visually- Complete Feature Guide – Deep dive into all 25+ features
- Architecture & Plugin System – Build custom checks
- CLI Reference – All flags and options
- Report Templates – HTML, JSON, SARIF, Markdown
- Integration Guides – GitHub Actions, CI/CD, Slack
Quickly enumerate attack surface, identify tech stacks, find misconfigurations → prioritize bounties.
Comprehensive reconnaissance phase; combined OSINT + security checks in one tool.
Compliance baseline scanning, security header audits, TLS certificate monitoring.
CI/CD integration, automated security baselines, real-time monitoring mode.
"Teach Me" mode explains each finding; open-source code to study Go concurrency patterns.
✨ Trending Features:
- AI-Powered Risk Summaries – Auto-generate executive briefs in plain English
- Visual Attack Surface Graphs – See your target's entire tech ecosystem at a glance
- Community-Driven Plugins – Share and discover custom OSINT checks
- Privacy Advocate – Open source, no SaaS, runs locally
- One-Command Setup – Install, scan, get insights in 2 minutes
We thrive on community contributions! Whether it's new checks, bug fixes, docs, or plugin ideas—your help makes this tool legendary.
- Fork the repository
- Create a feature branch:
git checkout -b feature/awesome-check - Commit with clear messages:
git commit -m 'Add X-Auth-Token header check' - Push and open a Pull Request
👉 See CONTRIBUTING.md for detailed guidelines.
📋 Scan Report: https://example.com
├── 🔴 Critical Issues (1)
│ ├── Missing HSTS Header
│ └── Weak TLS Protocol (SSLv3 detected)
├── 🟡 Warnings (5)
│ ├── Outdated jQuery (1.8.2)
│ ├── Exposed Git Repository
│ └── Debug Mode Enabled
└── ✅ Passed (12)
├── Strong CSP Policy
├── X-Content-Type-Options Set
└── HTTPS Enforced
🎯 Risk Score: 6/10 | AI Summary: "High-priority TLS upgrade needed."
| Task | Time | URLs/Sec |
|---|---|---|
| Scan 1 URL (full checks) | ~2-3s | - |
| Scan 100 URLs (t=10) | ~15s | ~6.7 URLs/s |
| Scan 1000 URLs (t=50) | ~45s | ~22 URLs/s |
| Scan 10K URLs (t=100) | ~8m | ~20 URLs/s |
Benchmarks on modest hardware; results vary by network latency.
- Core scanning engine
- CLI & Web UI
- AI-powered risk summaries (Q1 2026)
- OSINT graph visualization (Q1 2026)
- Community plugin marketplace (Q2 2026)
- Real-time monitoring dashboard (Q2 2026)
- Kubernetes security scanning (Q3 2026)
- Mobile app for scan results (Q3 2026)
URL Hawk Scanner is released under the Apache 2.0 License.
Disclaimer: This tool is for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain written permission before scanning any target you do not own.
Built with ❤️ by Dhanush Nehru and the open-source security community.
⭐ Star this repo if you find it useful 🍴 Fork to contribute or customize 💬 Discuss ideas in Discussions tab 🐛 Report bugs in Issues
- 🌐 Live Demo
- 📦 Docker Image
- 🎥 YouTube Tutorial (coming soon)
- 📖 Full Wiki
Made by the community. For the community. 🚀