mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
dff4de397e
* feat(config): add -config/-profile config file and profile overlays extend the existing goflags yaml config mechanism (the same one -template already uses) with an explicit -config path and named -profile overlays, instead of adding a second config system. resolveConfigInput unifies -config/-profile/-template into a single flat yaml path for goflags to merge before Parse: unset, it returns "" and goflags falls back to its ambient ~/.config/sif/config.yaml unchanged. a profile overlays its keys onto the file's top-level keys in a go map before handing goflags a flat temp file, so precedence stays explicit cli flag > profile > file default > built-in default via goflags' own DefValue sentinel merge. -config and -template share one config slot and are mutually exclusive. verifies empirically that goflags auto-creates and merges the ambient config file with no explicit SetConfigFilePath call, which this feature depends on. * docs(config): document -config/-profile and drop the dead toml example template-example.toml was unreferenced by any go file and did not match how goflags actually reads config (flat long-name keys, yaml). replace it with config-example.yaml showing the real schema, including a profiles block, and document -config/-profile in the usage/configuration guides and the man page. * fix(config): validate malformed config on the no-profile path resolveConfigInput used to return an explicit -config path unparsed when -profile was not set, so a malformed yaml file skipped validation entirely. goflags then silently discarded the decode error, dropping every real setting in the file with no diagnostic and exit 0, while the same file with -profile already errored cleanly through loadConfigMap. route both branches through one buildFlatConfig that always loads via loadConfigMap and only overlays a profile when one is selected, so a malformed file errors the same way regardless of -profile. * fix(config): let explicit cli flags override config and profile values goflags' own merge (readConfigFile) treats a flag whose current value equals its DefValue as "unset" and applies the config value over it. that makes an explicit cli flag silently lose to the config file or a profile whenever the user happens to pass the flag's own default, e.g. "-timeout 10s" against the built-in 10s default: today the file's 1s wins even though the flag was set explicitly on the command line. the same class of bug hits -threads, -concurrency, -notify-severity, and any profile value on the same merge path. scan the raw args for every flag the user actually passed (long or short alias, space or "=" form) and strip those keys out of the resolved config/ profile map before it ever reaches goflags, so cli precedence holds unconditionally instead of only when the value differs from the default. flagAliasGroups derives the long/short alias groups from the real flag registration (grouping by the shared flag.Value pointer) rather than a second hardcoded name table, so it can't drift from registerFlags. goflags also swallows a type-mismatched config value entirely (discards fl.Value.Set's error); that is a separate, lower-severity gap in the vendored dependency itself and is left alone, noted in a comment.
300 lines
8.1 KiB
Groff
300 lines
8.1 KiB
Groff
.\" man page for sif - the blazing-fast pentesting suite
|
|
.TH sif 1 "2026-06-10" "sif" "sif manual"
|
|
.SH NAME
|
|
sif \- blazing-fast pentesting suite
|
|
.SH SYNOPSIS
|
|
.B sif
|
|
.B \-u
|
|
.I url
|
|
.RI [ scans ]
|
|
.RI [ options ]
|
|
.br
|
|
.B sif
|
|
.B \-f
|
|
.I file
|
|
.RI [ scans ]
|
|
.RI [ options ]
|
|
.br
|
|
.I "targets"
|
|
|
|
|
.B sif
|
|
.RI [ scans ]
|
|
.RI [ options ]
|
|
.br
|
|
.B sif
|
|
.RB { patchnote | version }
|
|
.SH DESCRIPTION
|
|
.B sif
|
|
is a modular recon and exploitation suite. it runs multiple scan types
|
|
concurrently against one or more targets, and can be extended with yaml
|
|
modules. a scheme\-less target defaults to
|
|
.B https://
|
|
\&; an explicit
|
|
.B http://
|
|
or
|
|
.B https://
|
|
is kept; any other scheme is rejected.
|
|
.SH TARGETS
|
|
.TP
|
|
.BR \-u ", " \-\-urls " \fIlist\fR"
|
|
comma\-separated list of urls to scan.
|
|
.TP
|
|
.BR \-f ", " \-\-file " \fIpath\fR"
|
|
file with one url per line.
|
|
.TP
|
|
.B stdin
|
|
when stdin is a pipe, one target per line is read from it, alongside any
|
|
.B \-u
|
|
/
|
|
.B \-f
|
|
targets. lets sif slot into a unix pipeline (e.g. \fBsubfinder | sif \-silent | notify\fR).
|
|
.SH SCANS
|
|
.TP
|
|
.BR \-dirlist " \fIsize\fR"
|
|
directory and file fuzzing (small/medium/large).
|
|
.TP
|
|
.BR \-mc " \fIcodes\fR"
|
|
dirlist: match only these status codes (comma list, e.g. 200,301).
|
|
.TP
|
|
.BR \-fc " \fIcodes\fR"
|
|
dirlist: filter out these status codes (comma list).
|
|
.TP
|
|
.BR \-fs " \fIsizes\fR"
|
|
dirlist: filter out responses of these body sizes (comma list).
|
|
.TP
|
|
.BR \-fw " \fIcounts\fR"
|
|
dirlist: filter out responses with these word counts (comma list).
|
|
.TP
|
|
.BR \-fr " \fIregex\fR"
|
|
dirlist: filter out responses whose body matches this regex.
|
|
.TP
|
|
.B \-ac
|
|
dirlist: auto\-calibrate the soft\-404 wildcard baseline so catch\-all 200s are dropped.
|
|
.TP
|
|
.BR \-w " \fIpath|url\fR"
|
|
dirlist: custom wordlist (local file or url); overrides the \fB\-dirlist\fR size.
|
|
.TP
|
|
.BR \-e " \fIexts\fR"
|
|
dirlist: extensions appended to each word (comma list, e.g. php,bak,env).
|
|
.TP
|
|
.BR \-dnslist " \fIsize\fR"
|
|
subdomain enumeration (small/medium/large).
|
|
.TP
|
|
.BR \-ports " \fIscope\fR"
|
|
port scanning (common/full).
|
|
.TP
|
|
.B \-nuclei
|
|
vulnerability scanning with nuclei templates.
|
|
.TP
|
|
.B \-dork
|
|
automated google dorking.
|
|
.TP
|
|
.B \-js
|
|
javascript analysis + secret and endpoint extraction.
|
|
.TP
|
|
.B \-c3
|
|
cloud storage misconfiguration scan.
|
|
.TP
|
|
.B \-headers
|
|
dump the target's response headers.
|
|
.TP
|
|
.BR \-sh ", " \-\-security\-headers
|
|
flag missing or weak security headers and headers that leak server internals.
|
|
.TP
|
|
.B \-st
|
|
subdomain takeover detection (requires \fB\-dnslist\fR).
|
|
.TP
|
|
.B \-cms
|
|
cms detection.
|
|
.TP
|
|
.B \-whois
|
|
whois lookup.
|
|
.TP
|
|
.B \-git
|
|
exposed git repository detection.
|
|
.TP
|
|
.B \-shodan
|
|
shodan host lookup (requires \fBSHODAN_API_KEY\fR).
|
|
.TP
|
|
.B \-securitytrails
|
|
domain discovery and target expansion (requires \fBSECURITYTRAILS_API_KEY\fR).
|
|
.TP
|
|
.B \-sql
|
|
sql reconnaissance (admin panels, error disclosure).
|
|
.TP
|
|
.B \-lfi
|
|
local file inclusion reconnaissance.
|
|
.TP
|
|
.B \-jwt
|
|
jwt discovery plus offline weakness analysis (alg:none, weak hmac secret, missing/expired exp, sensitive plaintext claims).
|
|
.TP
|
|
.B \-openapi
|
|
openapi/swagger spec exposure probe; enumerates paths, methods and unauthenticated operations.
|
|
.TP
|
|
.B \-favicon
|
|
favicon hash fingerprinting (shodan\-style mmh3); matches bundled tech and prints the http.favicon.hash pivot query.
|
|
.TP
|
|
.B \-cors
|
|
cors misconfiguration probe (reflected/permissive origins).
|
|
.TP
|
|
.B \-redirect
|
|
open redirect probe.
|
|
.TP
|
|
.B \-xss
|
|
reflected xss probe.
|
|
.TP
|
|
.B \-framework
|
|
framework detection with cve lookup.
|
|
.TP
|
|
.B \-crawl
|
|
web crawler; spiders same\-host links, scripts and forms, respecting robots.txt.
|
|
.TP
|
|
.BR \-crawl\-depth " \fIn\fR"
|
|
max crawl recursion depth (default 2).
|
|
.TP
|
|
.B \-passive
|
|
passive subdomain and historical url discovery from third\-party feeds (zero traffic to the target).
|
|
.TP
|
|
.B \-probe
|
|
live\-host probe; reports liveness, final status, page title, server header and the redirect chain.
|
|
.TP
|
|
.B \-noscan
|
|
skip the base url scan (robots.txt, etc).
|
|
.SH OPTIONS
|
|
.TP
|
|
.BR \-d ", " \-\-debug
|
|
enable debug logging.
|
|
.TP
|
|
.BR \-t ", " \-\-timeout " \fIduration\fR"
|
|
per\-request timeout (default 10s).
|
|
.TP
|
|
.BR \-l ", " \-\-log " \fIdir\fR"
|
|
directory to write logs to.
|
|
.TP
|
|
.BR \-\-threads " \fIn\fR"
|
|
number of concurrent workers (default 10). values below 1 are clamped to 1.
|
|
.TP
|
|
.BR \-\-template " \fIname\fR"
|
|
sif runtime template to use.
|
|
.TP
|
|
.BR \-config " \fIpath\fR"
|
|
load flags from a yaml config file (default ~/.config/sif/config.yaml). mutually exclusive with \-\-template.
|
|
.TP
|
|
.BR \-profile " \fIname\fR"
|
|
select a named profile block from the config file.
|
|
.TP
|
|
.BR \-proxy " \fIurl\fR"
|
|
route every request through a proxy. accepts http, https or socks5 urls.
|
|
.TP
|
|
.BR \-H ", " \-\-header " \fIstring\fR"
|
|
custom header to send with every request, as \fBKey: Value\fR. repeatable or comma\-separated.
|
|
.TP
|
|
.BR \-cookie " \fIstring\fR"
|
|
cookie header to send with every request.
|
|
.TP
|
|
.BR \-rate\-limit " \fIn\fR"
|
|
cap outbound requests per second (0 = unlimited, default 0).
|
|
.TP
|
|
.BR \-sarif " \fIfile\fR"
|
|
write a sarif 2.1.0 report of the run to \fIfile\fR.
|
|
.TP
|
|
.BR \-md ", " \-\-markdown " \fIfile\fR"
|
|
write a markdown report of the run to \fIfile\fR.
|
|
.TP
|
|
.B \-silent
|
|
plain output for pipelines: route all chrome to stderr and print one
|
|
normalized finding per line to stdout as \fB[severity] target module title\fR.
|
|
implies non\-interactive (no spinners).
|
|
.TP
|
|
.B \-diff
|
|
diff mode: snapshot each target's findings to a json file and, on a re\-scan,
|
|
print only the delta against the last snapshot (\fB+ new\fR for findings that
|
|
appeared, \fB- gone\fR for ones that vanished), then overwrite the snapshot.
|
|
the first run for a target reports everything as new.
|
|
.TP
|
|
.BR \-store " \fIdir\fR"
|
|
snapshot directory for \fB\-diff\fR. defaults to the \fB\-log\fR dir if set,
|
|
otherwise \fI<user\-config>/sif/state\fR. one sanitized file per target.
|
|
.B \-notify
|
|
ship findings to every configured provider (slack, discord, telegram, generic
|
|
webhook) after the scan. providers are configured env\-first and overridable by a
|
|
yaml file; with nothing configured this is a silent no\-op.
|
|
.TP
|
|
.BR \-notify\-severity " \fIlevel\fR"
|
|
minimum severity to send: \fBinfo\fR, \fBlow\fR, \fBmedium\fR, \fBhigh\fR or
|
|
\fBcritical\fR (default \fBmedium\fR). findings below the floor are dropped.
|
|
.TP
|
|
.BR \-notify\-config " \fIfile\fR"
|
|
path to a notify\-compatible yaml config whose values override the env vars.
|
|
.TP
|
|
.B \-api
|
|
emit json results and suppress the interactive output.
|
|
.SH MODULES
|
|
.TP
|
|
.BR \-m ", " \-\-modules " \fIids\fR"
|
|
comma\-separated module ids to run.
|
|
.TP
|
|
.BR \-mt ", " \-\-module\-tags " \fItags\fR"
|
|
run modules matching these tags.
|
|
.TP
|
|
.BR \-am ", " \-\-all\-modules
|
|
run all loaded modules.
|
|
.TP
|
|
.BR \-lm ", " \-\-list\-modules
|
|
list available modules and exit.
|
|
.SH COMMANDS
|
|
.TP
|
|
.B sif patchnote
|
|
fetch the latest github release and print its notes. also available as
|
|
.BR \-pn .
|
|
.TP
|
|
.B sif version
|
|
print the sif version and exit.
|
|
.SH ENVIRONMENT
|
|
.TP
|
|
.B SHODAN_API_KEY
|
|
api key used by \fB\-shodan\fR.
|
|
.TP
|
|
.B SECURITYTRAILS_API_KEY
|
|
api key used by \fB\-securitytrails\fR.
|
|
.TP
|
|
.B SLACK_WEBHOOK_URL
|
|
slack incoming webhook used by \fB\-notify\fR (yaml key \fBslack_webhook_url\fR).
|
|
.TP
|
|
.B DISCORD_WEBHOOK_URL
|
|
discord webhook used by \fB\-notify\fR (yaml key \fBdiscord_webhook_url\fR).
|
|
.TP
|
|
.B TELEGRAM_BOT_TOKEN
|
|
telegram bot token used by \fB\-notify\fR (yaml key \fBtelegram_api_key\fR);
|
|
requires \fBTELEGRAM_CHAT_ID\fR too.
|
|
.TP
|
|
.B TELEGRAM_CHAT_ID
|
|
telegram destination chat used by \fB\-notify\fR (yaml key \fBtelegram_chat_id\fR).
|
|
.TP
|
|
.B NOTIFY_WEBHOOK_URL
|
|
generic json webhook used by \fB\-notify\fR (yaml key \fBwebhook_url\fR).
|
|
.TP
|
|
.B SIF_NO_PATCHNOTES
|
|
set to any value to suppress the once\-per\-version patch note shown at startup.
|
|
.SH FILES
|
|
.TP
|
|
.I ~/.config/sif/modules/
|
|
user\-defined yaml modules.
|
|
.TP
|
|
.I ~/.config/sif/seen_version
|
|
records the last release whose notes were shown at startup.
|
|
.SH EXAMPLES
|
|
.TP
|
|
run a few scans against a host:
|
|
.B sif \-u https://example.com \-headers \-sh \-cms \-framework
|
|
.TP
|
|
fuzz directories and enumerate subdomains:
|
|
.B sif \-u https://example.com \-dirlist medium \-dnslist medium
|
|
.TP
|
|
scan a list of targets and write logs:
|
|
.B sif \-f targets.txt \-headers \-l ./logs
|
|
.SH SEE ALSO
|
|
project page: https://github.com/vmfunc/sif
|
|
.SH AUTHORS
|
|
vmfunc, xyzeva, and the lunchcat contributors.
|