sif(1)

NAME
sif - blazing-fast pentesting suite

SYNOPSIS
sif -u url [scans] [options]
sif -f file [scans] [options]
targets | sif [scans] [options]
sif {patchnote|version}

DESCRIPTION
sif is a modular recon and exploitation suite. it runs multiple scan types concurrently against one or more targets, and can be extended with yaml modules. a scheme-less target defaults to https:// ; an explicit http:// or https:// is kept; any other scheme is rejected.

TARGETS

-u, --urls list
    comma-separated list of urls to scan.

-f, --file path
    file with one url per line.

stdin
    when stdin is a pipe, one target per line is read from it, alongside any -u / -f targets. lets sif slot into a unix pipeline (e.g. subfinder | sif -silent | notify).

SCANS

-dirlist size
    directory and file fuzzing (small/medium/large).

-mc codes
    dirlist: match only these status codes (comma list, e.g. 200,301).

-fc codes
    dirlist: filter out these status codes (comma list).

-fs sizes
    dirlist: filter out responses of these body sizes (comma list).

-fw counts
    dirlist: filter out responses with these word counts (comma list).

-fr regex
    dirlist: filter out responses whose body matches this regex.

-ac dirlist: auto-calibrate the soft-404 wildcard baseline so catch-all 200s are dropped.

-w path|url
    dirlist: custom wordlist (local file or url); overrides the -dirlist size.

-e exts
    dirlist: extensions appended to each word (comma list, e.g. php,bak,env).

-dnslist size
    subdomain enumeration (small/medium/large).

-ports scope
    port scanning (common/full).

-nuclei
    vulnerability scanning with nuclei templates.

-dork
    automated google dorking.

-js javascript analysis + secret and endpoint extraction.

-c3 cloud storage misconfiguration scan.

-headers
    dump the target's response headers.

-sh, --security-headers
    flag missing or weak security headers and headers that leak server internals.

-st subdomain takeover detection (requires -dnslist).

-cms
    cms detection.

-whois
    whois lookup.

-git
    exposed git repository detection.

-shodan
    shodan host lookup (requires SHODAN_API_KEY).

-securitytrails
    domain discovery and target expansion (requires SECURITYTRAILS_API_KEY).

-sql
    sql reconnaissance (admin panels, error disclosure).

-lfi
    local file inclusion reconnaissance.

-jwt
    jwt discovery plus offline weakness analysis (alg:none, weak hmac secret, missing/expired exp, sensitive plaintext claims).

-openapi
    openapi/swagger spec exposure probe; enumerates paths, methods and unauthenticated operations.

-favicon
    favicon hash fingerprinting (shodan-style mmh3); matches bundled tech and prints the http.favicon.hash pivot query.

-cors
    cors misconfiguration probe (reflected/permissive origins).

-redirect
    open redirect probe.

-xss
    reflected xss probe.

-framework
    framework detection with cve lookup.

-crawl
    web crawler; spiders same-host links, scripts and forms, respecting robots.txt.

-crawl-depth n
    max crawl recursion depth (default 2).

-passive
    passive subdomain and historical url discovery from third-party feeds (zero traffic to the target).

-probe
    live-host probe; reports liveness, final status, page title, server header and the redirect chain.

-noscan
    skip the base url scan (robots.txt, etc).

OPTIONS

-d, --debug
    enable debug logging.

-t, --timeout duration
    per-request timeout (default 10s).

-l, --log dir
    directory to write logs to.

--threads n
    number of concurrent workers (default 10). values below 1 are clamped to 1.

--template name
    sif runtime template to use.

-proxy url
    route every request through a proxy. accepts http, https or socks5 urls.

-H, --header string
    custom header to send with every request, as Key: Value. repeatable or comma-separated.

-cookie string
    cookie header to send with every request.

-rate-limit n
    cap outbound requests per second (0 = unlimited, default 0).

-sarif file
    write a sarif 2.1.0 report of the run to file.

-md, --markdown file
    write a markdown report of the run to file.

-silent
    plain output for pipelines: route all chrome to stderr and print one normalized finding per line to stdout as [severity] target module title. implies non-interactive (no spinners).

-diff
    diff mode: snapshot each target's findings to a json file and, on a re-scan, print only the delta against the last snapshot (+ new for findings that appeared, - gone for ones that vanished), then overwrite the snapshot. the first run for a target reports everything as new.

-store dir
    snapshot directory for -diff. defaults to the -log dir if set, otherwise <user-config>/sif/state. one sanitized file per target. -notify ship findings to every configured provider (slack, discord, telegram, generic webhook) after the scan. providers are configured env-first and overridable by a yaml file; with nothing configured this is a silent no-op.

-notify-severity level
    minimum severity to send: info, low, medium, high or critical (default medium). findings below the floor are dropped.

-notify-config file
    path to a notify-compatible yaml config whose values override the env vars.

-api
    emit json results and suppress the interactive output.

MODULES

-m, --modules ids
    comma-separated module ids to run.

-mt, --module-tags tags
    run modules matching these tags.

-am, --all-modules
    run all loaded modules.

-lm, --list-modules
    list available modules and exit.

COMMANDS

sif patchnote
    fetch the latest github release and print its notes. also available as -pn.

sif version
    print the sif version and exit.

ENVIRONMENT

SHODAN_API_KEY
    api key used by -shodan.

SECURITYTRAILS_API_KEY
    api key used by -securitytrails.

SLACK_WEBHOOK_URL
    slack incoming webhook used by -notify (yaml key slack_webhook_url).

DISCORD_WEBHOOK_URL
    discord webhook used by -notify (yaml key discord_webhook_url).

TELEGRAM_BOT_TOKEN
    telegram bot token used by -notify (yaml key telegram_api_key); requires TELEGRAM_CHAT_ID too.

TELEGRAM_CHAT_ID
    telegram destination chat used by -notify (yaml key telegram_chat_id).

NOTIFY_WEBHOOK_URL
    generic json webhook used by -notify (yaml key webhook_url).

SIF_NO_PATCHNOTES
    set to any value to suppress the once-per-version patch note shown at startup.

FILES

~/.config/sif/modules/
    user-defined yaml modules.

~/.config/sif/seen_version
    records the last release whose notes were shown at startup.

EXAMPLES

run a few scans against a host:
    sif -u https://example.com -headers -sh -cms -framework

fuzz directories and enumerate subdomains:
    sif -u https://example.com -dirlist medium -dnslist medium

scan a list of targets and write logs:
    sif -f targets.txt -headers -l ./logs

SEE ALSO
project page: https://github.com/vmfunc/sif

AUTHORS
vmfunc, xyzeva, and the lunchcat contributors.