mirror of
https://github.com/lunchcat/sif.git
synced 2026-01-13 05:16:44 -08:00
8a0945619b
- add 20+ new framework signatures (vue, angular, react, svelte, sveltekit, remix, gatsby, joomla, magento, shopify, ghost, ember, backbone, meteor, strapi, adonisjs, cakephp, codeigniter, asp.net core, spring boot) - add version confidence scoring with multiple detection sources - add concurrent framework scanning for better performance - expand cve database with 15+ known vulnerabilities (spring4shell, etc.) - add risk level assessment based on cve severity - add comprehensive security recommendations - add new tests for all features
what is sif?
sif is a modular pentesting toolkit written in go. it's designed to be fast, concurrent, and extensible. run multiple scan types against targets with a single command.
./sif -u https://example.com -all
install
from releases
grab the latest binary from releases.
from source
git clone https://github.com/dropalldatabases/sif.git
cd sif
make
requires go 1.23+
usage
# basic scan
./sif -u https://example.com
# directory fuzzing
./sif -u https://example.com -dirlist medium
# subdomain enumeration
./sif -u https://example.com -dnslist medium
# port scanning
./sif -u https://example.com -ports common
# javascript framework detection + cloud misconfig
./sif -u https://example.com -js -c3
# shodan host intelligence (requires SHODAN_API_KEY env var)
./sif -u https://example.com -shodan
# sql recon + lfi scanning
./sif -u https://example.com -sql -lfi
# everything
./sif -u https://example.com -all
run ./sif -h for all options.
modules
| module | description |
|---|---|
dirlist |
directory and file fuzzing |
dnslist |
subdomain enumeration |
ports |
port and service scanning |
nuclei |
vulnerability scanning with nuclei templates |
dork |
automated google dorking |
js |
javascript framework detection (next.js, supabase) |
c3 |
cloud storage misconfiguration scanning |
headers |
http header analysis |
takeover |
subdomain takeover detection |
cms |
cms detection |
whois |
whois lookups |
git |
exposed git repository detection |
shodan |
shodan host intelligence (requires SHODAN_API_KEY) |
sql |
sql admin panel and error disclosure detection |
lfi |
local file inclusion vulnerability scanning |
contribute
contributions welcome. see contributing.md for guidelines.
# format
gofmt -w .
# lint
golangci-lint run
# test
go test ./...
community
join our discord for support, feature discussions, and pentesting tips:
contributors
 mel 🚧 🧑🏫 📆 🛡️ ⚠️ 💼 💻 🎨 💵 🤔 |
 ProjectDiscovery 📦 |
 macdoos 💻 |
 Matthieu Witrowiez 🤔 |
 tessa 🚇 💬 📓 |
 Eva 📝 🖋 🔬 🛡️ ⚠️ 💻 |
acknowledgements
- projectdiscovery for nuclei and other security tools
- shodan for infrastructure intelligence
bsd 3-clause license · made by vmfunc, xyzeva, and contributors