mirror of
https://github.com/lunchcat/sif.git
synced 2026-06-12 19:11:25 -07:00
vmfunc
ef0408ee8d
sif can now slot into unix pipelines. stdin is drained for targets when it's a pipe (keyed off stdin's mode, not stdout), alongside -u/-f. naked hosts are accepted and default to https://; explicit http(s) is kept, other schemes rejected. -silent routes all banner/spinner/log chrome to stderr and prints one normalized finding per line to stdout via finding.Flatten, so `subfinder | sif -silent | notify` works.
496 lines
9.4 KiB
Markdown
496 lines
9.4 KiB
Markdown
# usage
|
|
|
|
complete guide to sif command line options.
|
|
|
|
## target options
|
|
|
|
### -u, --urls
|
|
|
|
specify target urls (comma-separated):
|
|
|
|
```bash
|
|
./sif -u https://example.com
|
|
./sif -u https://site1.com,https://site2.com
|
|
```
|
|
|
|
### -f, --file
|
|
|
|
read targets from a file (one url per line):
|
|
|
|
```bash
|
|
./sif -f targets.txt
|
|
```
|
|
|
|
### stdin (pipe mode)
|
|
|
|
when stdin is a pipe, sif reads one target per line from it, alongside any `-u`/`-f` targets. this lets sif slot into a unix pipeline:
|
|
|
|
```bash
|
|
subfinder -d example.com | sif -silent -probe | notify
|
|
```
|
|
|
|
### naked hosts
|
|
|
|
targets without a scheme default to `https://`; an explicit `http://`/`https://` is kept as given. any other scheme (`ftp://`, `file://`, ...) is rejected:
|
|
|
|
```bash
|
|
./sif -u example.com # scanned as https://example.com
|
|
echo example.com | sif -probe # same, over stdin
|
|
```
|
|
|
|
## scan options
|
|
|
|
### directory fuzzing
|
|
|
|
`-dirlist <size>` - fuzz for directories and files
|
|
|
|
sizes: `small`, `medium`, `large`
|
|
|
|
```bash
|
|
./sif -u https://example.com -dirlist medium
|
|
```
|
|
|
|
#### response filters
|
|
|
|
modern apps serve a catch-all 200 for unknown routes, so a naive scan reports
|
|
every path. these ffuf-style filters cut the noise (a filter always wins over a
|
|
match):
|
|
|
|
- `-mc <codes>` - match only these status codes (comma list, e.g. `200,301`)
|
|
- `-fc <codes>` - filter out these status codes
|
|
- `-fs <sizes>` - filter out responses of these body sizes
|
|
- `-fw <counts>` - filter out responses with these word counts
|
|
- `-fr <regex>` - filter out responses whose body matches this regex
|
|
|
|
```bash
|
|
./sif -u https://example.com -dirlist medium -mc 200,301 -fs 1234
|
|
```
|
|
|
|
#### wildcard calibration
|
|
|
|
`-ac` probes a few paths that cannot exist, learns the soft-404 baseline
|
|
(status + size + words), and auto-drops any response matching it - so SPA
|
|
catch-all 200s stop flooding the output:
|
|
|
|
```bash
|
|
./sif -u https://example.com -dirlist medium -ac
|
|
```
|
|
|
|
#### custom wordlists and extensions
|
|
|
|
`-w <path|url>` overrides the size switch with your own list (local file or
|
|
remote url); `-e <exts>` appends each extension to every word, keeping the bare
|
|
word too:
|
|
|
|
```bash
|
|
./sif -u https://example.com -w /path/to/words.txt -e php,bak,env
|
|
```
|
|
|
|
### subdomain enumeration
|
|
|
|
`-dnslist <size>` - enumerate subdomains
|
|
|
|
sizes: `small`, `medium`, `large`
|
|
|
|
```bash
|
|
./sif -u https://example.com -dnslist small
|
|
```
|
|
|
|
### port scanning
|
|
|
|
`-ports <scope>` - scan for open ports
|
|
|
|
scopes: `common` (top ports), `full` (all ports)
|
|
|
|
```bash
|
|
./sif -u https://example.com -ports common
|
|
```
|
|
|
|
### google dorking
|
|
|
|
`-dork` - automated google dorking
|
|
|
|
```bash
|
|
./sif -u https://example.com -dork
|
|
```
|
|
|
|
### git repository detection
|
|
|
|
`-git` - check for exposed git repositories
|
|
|
|
```bash
|
|
./sif -u https://example.com -git
|
|
```
|
|
|
|
### nuclei scanning
|
|
|
|
`-nuclei` - run nuclei vulnerability templates
|
|
|
|
```bash
|
|
./sif -u https://example.com -nuclei
|
|
```
|
|
|
|
### javascript analysis
|
|
|
|
`-js` - analyze javascript files + secret and endpoint extraction
|
|
|
|
```bash
|
|
./sif -u https://example.com -js
|
|
```
|
|
|
|
### cms detection
|
|
|
|
`-cms` - detect content management systems
|
|
|
|
```bash
|
|
./sif -u https://example.com -cms
|
|
```
|
|
|
|
### http headers
|
|
|
|
`-headers` - dump the target's response headers
|
|
|
|
```bash
|
|
./sif -u https://example.com -headers
|
|
```
|
|
|
|
### security headers
|
|
|
|
`-sh` - flag missing/weak security headers (hsts, csp, x-frame-options, ...) and headers that leak server internals
|
|
|
|
```bash
|
|
./sif -u https://example.com -sh
|
|
```
|
|
|
|
### cloud storage
|
|
|
|
`-c3` - check for cloud storage misconfigurations
|
|
|
|
```bash
|
|
./sif -u https://example.com -c3
|
|
```
|
|
|
|
### subdomain takeover
|
|
|
|
`-st` - check for subdomain takeover vulnerabilities
|
|
|
|
requires `-dnslist` to be enabled
|
|
|
|
```bash
|
|
./sif -u https://example.com -dnslist small -st
|
|
```
|
|
|
|
### shodan lookup
|
|
|
|
`-shodan` - query shodan for host intelligence
|
|
|
|
requires `SHODAN_API_KEY` environment variable
|
|
|
|
```bash
|
|
export SHODAN_API_KEY=your-api-key
|
|
./sif -u https://example.com -shodan
|
|
```
|
|
|
|
### sql reconnaissance
|
|
|
|
`-sql` - detect sql admin panels and error disclosure
|
|
|
|
```bash
|
|
./sif -u https://example.com -sql
|
|
```
|
|
|
|
### lfi scanning
|
|
|
|
`-lfi` - local file inclusion vulnerability checks
|
|
|
|
```bash
|
|
./sif -u https://example.com -lfi
|
|
```
|
|
|
|
### cors probe
|
|
|
|
`-cors` - probe for cors misconfigurations (reflected/permissive origins)
|
|
|
|
```bash
|
|
./sif -u https://example.com -cors
|
|
```
|
|
|
|
### open redirect probe
|
|
|
|
`-redirect` - probe redirect-prone params for open redirects
|
|
|
|
```bash
|
|
./sif -u https://example.com/login?next=home -redirect
|
|
```
|
|
|
|
### reflected xss probe
|
|
|
|
`-xss` - inject a canary into params and report unescaped reflections
|
|
|
|
```bash
|
|
./sif -u https://example.com/search?q=test -xss
|
|
```
|
|
|
|
### framework detection
|
|
|
|
`-framework` - detect web frameworks with version and cve lookup
|
|
|
|
```bash
|
|
./sif -u https://example.com -framework
|
|
```
|
|
|
|
### web crawler
|
|
|
|
`-crawl` - spider the target, following same-host links, scripts and forms
|
|
|
|
`-crawl-depth` - max recursion depth (default 2). respects robots.txt and stays on the target host.
|
|
|
|
```bash
|
|
./sif -u https://example.com -crawl -crawl-depth 3
|
|
```
|
|
|
|
### passive discovery
|
|
|
|
`-passive` - gather subdomains from certificate transparency (crt.sh, certspotter) and historical urls from the wayback machine
|
|
|
|
keyless and zero traffic to the target itself - all lookups hit third-party feeds.
|
|
|
|
```bash
|
|
./sif -u https://example.com -passive
|
|
```
|
|
|
|
### live-host probe
|
|
|
|
`-probe` - check whether the target is alive and report its final status, page title, server header, content-length and the redirect chain it walked
|
|
|
|
```bash
|
|
./sif -u https://example.com -probe
|
|
```
|
|
|
|
### whois lookup
|
|
|
|
`-whois` - perform whois lookups
|
|
|
|
```bash
|
|
./sif -u https://example.com -whois
|
|
```
|
|
|
|
### skip base scan
|
|
|
|
`-noscan` - skip the base url scan (robots.txt, etc)
|
|
|
|
```bash
|
|
./sif -u https://example.com -noscan -dirlist medium
|
|
```
|
|
|
|
## module options
|
|
|
|
### -lm, --list-modules
|
|
|
|
list all available modules:
|
|
|
|
```bash
|
|
./sif -lm
|
|
```
|
|
|
|
### -m, --modules
|
|
|
|
run specific modules by id (comma-separated):
|
|
|
|
```bash
|
|
./sif -u https://example.com -m sqli-error-based,xss-reflected
|
|
```
|
|
|
|
### -mt, --module-tags
|
|
|
|
run modules matching tags:
|
|
|
|
```bash
|
|
./sif -u https://example.com -mt owasp-top10
|
|
./sif -u https://example.com -mt injection
|
|
```
|
|
|
|
### -am, --all-modules
|
|
|
|
run all available modules:
|
|
|
|
```bash
|
|
./sif -u https://example.com -am
|
|
```
|
|
|
|
## runtime options
|
|
|
|
### -t, --timeout
|
|
|
|
http request timeout (default: 10s):
|
|
|
|
```bash
|
|
./sif -u https://example.com -t 30s
|
|
```
|
|
|
|
### --threads
|
|
|
|
number of concurrent threads (default: 10). values below 1 are clamped to 1:
|
|
|
|
```bash
|
|
./sif -u https://example.com --threads 20
|
|
```
|
|
|
|
### -l, --log
|
|
|
|
directory to save log files:
|
|
|
|
```bash
|
|
./sif -u https://example.com -l ./logs
|
|
```
|
|
|
|
### -d, --debug
|
|
|
|
enable debug logging:
|
|
|
|
```bash
|
|
./sif -u https://example.com -d
|
|
```
|
|
|
|
## http options
|
|
|
|
these apply to every outbound request across all scanners (proxy, custom headers, cookie and rate limiting share one client). a scanner that sets a header explicitly still wins over the global default.
|
|
|
|
### -proxy
|
|
|
|
route all traffic through a proxy. supports http, https and socks5 urls:
|
|
|
|
```bash
|
|
./sif -u https://example.com -proxy socks5://127.0.0.1:1080
|
|
```
|
|
|
|
### -H, --header
|
|
|
|
add a custom header to every request. repeatable or comma-separated, `"Key: Value"`:
|
|
|
|
```bash
|
|
./sif -u https://example.com -H "Authorization: Bearer tok" -H "X-Env: staging"
|
|
```
|
|
|
|
### -cookie
|
|
|
|
cookie header to send with every request:
|
|
|
|
```bash
|
|
./sif -u https://example.com -cookie "session=abc; theme=dark"
|
|
```
|
|
|
|
### -rate-limit
|
|
|
|
cap outbound requests per second (0 = unlimited, default 0):
|
|
|
|
```bash
|
|
./sif -u https://example.com -rate-limit 20
|
|
```
|
|
|
|
## output options
|
|
|
|
write the collected findings out to a file after the scan. both formats can be requested in the same run.
|
|
|
|
### -sarif
|
|
|
|
write a sarif 2.1.0 report (one run, tool `sif`, one result per finding). ingestable by github code scanning and other sarif consumers:
|
|
|
|
```bash
|
|
./sif -u https://example.com -headers -cors -sarif out.sarif
|
|
```
|
|
|
|
### -md, --markdown
|
|
|
|
write a readable markdown report grouped by target, then by module:
|
|
|
|
```bash
|
|
./sif -u https://example.com -headers -cors -md report.md
|
|
```
|
|
|
|
### -silent
|
|
|
|
plain output for pipelines: all banner/spinner/log chrome goes to stderr and stdout carries one normalized finding per line, formatted `[severity] target module title`. implies non-interactive (no spinners), so a downstream consumer sees nothing but findings:
|
|
|
|
```bash
|
|
subfinder -d example.com | sif -silent -probe -sh | notify
|
|
```
|
|
|
|
## api options
|
|
|
|
### -api
|
|
|
|
enable api mode for json output:
|
|
|
|
```bash
|
|
./sif -u https://example.com -api
|
|
```
|
|
|
|
output is a json object with scan results.
|
|
|
|
## commands
|
|
|
|
these run without scanning a target.
|
|
|
|
### version
|
|
|
|
print the sif version. release builds are stamped via ldflags, local `make` builds derive it from `git describe`, and `go install`ed builds read it from the module build info:
|
|
|
|
```bash
|
|
./sif version
|
|
```
|
|
|
|
### patchnote
|
|
|
|
show the latest release's notes, fetched from github (also `-pn`):
|
|
|
|
```bash
|
|
./sif patchnote
|
|
```
|
|
|
|
the first time you run a new release sif also prints that release's notes once. set `SIF_NO_PATCHNOTES=1` to disable that.
|
|
|
|
## examples
|
|
|
|
### quick recon
|
|
|
|
```bash
|
|
./sif -u https://example.com -framework -headers -git
|
|
```
|
|
|
|
### full scan
|
|
|
|
```bash
|
|
./sif -u https://example.com \
|
|
-dirlist large \
|
|
-dnslist medium \
|
|
-ports full \
|
|
-framework \
|
|
-js \
|
|
-headers \
|
|
-cms \
|
|
-git \
|
|
-sql \
|
|
-lfi \
|
|
-cors \
|
|
-redirect \
|
|
-xss \
|
|
-am
|
|
```
|
|
|
|
### ci/cd pipeline
|
|
|
|
```bash
|
|
./sif -u https://staging.example.com -api -am > results.json
|
|
```
|
|
|
|
### batch scanning
|
|
|
|
```bash
|
|
echo "https://site1.com
|
|
https://site2.com
|
|
https://site3.com" > targets.txt
|
|
|
|
./sif -f targets.txt -am -l ./logs
|
|
```
|