scilla

‍☠️ Information Gathering tool ‍☠️ - DNS / Subdomains / Ports / Directories enumeration

Coded with  by edoardottt

Share on Twitter!

Install • Get Started • Examples • Changelog • Contributing • License

Installation

Homebrew

brew install scilla

Snap

sudo snap install scilla

Golang

go install -v github.com/edoardottt/scilla/cmd/scilla@latest

Building from source

You need Go (>=1.23)

Building from source for Linux and Windows

Linux

git clone https://github.com/edoardottt/scilla.git
cd scilla
go get ./...
make linux # (to install)
make unlinux # (to uninstall)

Edit the ~/.config/scilla/keys.yaml file if you want to use API keys.

One-liner: git clone https://github.com/edoardottt/scilla.git && cd scilla && go get ./... && make linux

Windows

Note that the executable works only in cariddi folder (Alias?).

git clone https://github.com/edoardottt/scilla.git
cd scilla
.\make.bat windows # (to install)
.\make.bat unwindows # (to uninstall)

Create a keys.yaml file if you want to use API keys.

Using Docker

docker build -t scilla .
docker run scilla help

Examples

• DNS enumeration:

  • scilla dns -target example.com
  • scilla dns -oj output -target example.com
  • scilla dns -oh output -target example.com
  • scilla dns -ot output -target example.com
  • scilla dns -plain -target example.com

• Subdomains enumeration:

  • scilla subdomain -target example.com
  • scilla subdomain -w wordlist.txt -target example.com
  • scilla subdomain -oj output -target example.com
  • scilla subdomain -oh output -target example.com
  • scilla subdomain -ot output -target example.com
  • scilla subdomain -i 400 -target example.com
  • scilla subdomain -i 4** -target example.com
  • scilla subdomain -c -target example.com
  • scilla subdomain -db -target example.com
  • scilla subdomain -plain -target example.com
  • scilla subdomain -db -no-check -target example.com
  • scilla subdomain -db -vt -target example.com
  • scilla subdomain -db -bw -target example.com
  • scilla subdomain -ua "CustomUA" -target example.com
  • scilla subdomain -rua -target example.com
  • scilla subdomain -dns 8.8.8.8 -target example.com
  • scilla subdomain -alive -target example.com

• Directories enumeration:

  • scilla dir -target example.com
  • scilla dir -w wordlist.txt -target example.com
  • scilla dir -oj output -target example.com
  • scilla dir -oh output -target example.com
  • scilla dir -ot output -target example.com
  • scilla dir -i 500,401 -target example.com
  • scilla dir -i 5**,401 -target example.com
  • scilla dir -c -target example.com
  • scilla dir -plain -target example.com
  • scilla dir -nr -target example.com
  • scilla dir -ua "CustomUA" -target example.com
  • scilla dir -rua -target example.com

• Ports enumeration:

  • Default (all ports, so 1-65635) scilla port -target example.com
  • Specifying ports range scilla port -p 20-90 -target example.com
  • Specifying starting port (until the last one) scilla port -p 20- -target example.com
  • Specifying ending port (from the first one) scilla port -p -90 -target example.com
  • Specifying multiple ports scilla port -p 21,25,80 -target example.com
  • Specifying common ports scilla port -common -target example.com
  • Specifying single port scilla port -p 80 -target example.com
  • Specifying output format (json)scilla port -oj output -target example.com
  • Specifying output format (html)scilla port -oh output -target example.com
  • Specifying output format (txt)scilla port -ot output -target example.com
  • Print only results scilla port -plain -target example.com

• Full report:

  • Default (all ports, so 1-65635) scilla report -target example.com
  • Specifying ports range scilla report -p 20-90 -target example.com
  • Specifying starting port (until the last one) scilla report -p 20- -target example.com
  • Specifying ending port (from the first one) scilla report -p -90 -target example.com
  • Specifying single port scilla report -p 80 -target example.com
  • Specifying multiple ports scilla report -p 21,25,80 -target example.com
  • Specifying output format (json)scilla report -oj output -target example.com
  • Specifying output format (html)scilla report -oh output -target example.com
  • Specifying output format (txt)scilla report -ot output -target example.com
  • Specifying directories wordlist scilla report -wd dirs.txt -target example.com
  • Specifying subdomains wordlist scilla report -ws subdomains.txt -target example.com
  • Specifying status codes to be ignored in directories scanning scilla report -id 500,501,502 -target example.com
  • Specifying status codes to be ignored in subdomains scanning scilla report -is 500,501,502 -target example.com
  • Specifying status codes classes to be ignored in directories scanning scilla report -id 5**,4** -target example.com
  • Specifying status codes classes to be ignored in subdomains scanning scilla report -is 5**,4** -target example.com
  • Use also a web crawler for directories enumeration scilla report -cd -target example.com
  • Use also a web crawler for subdomains enumeration scilla report -cs -target example.com
  • Use also a public database for subdomains enumeration scilla report -db -target example.com
  • Specifying common ports scilla report -common -target example.com
  • No follow redirects scilla report -nr -target example.com
  • Use VirusTotal as subdomains source scilla report -db -vt -target example.com
  • Set the User Agent scilla report -ua "CustomUA" -target example.com
  • Generate a random user agent for each request scilla report -rua -target example.com
  • Set DNS IP to resolve the subdomains scilla report -dns 8.8.8.8 -target example.com
  • Check also if the subdomains are alive scilla report -alive -target example.com

Get Started

scilla help prints the help in the command line.

…

Changelog

Detailed changes for each release are documented in the release notes.

Contributing

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

To do:

• Add more tests

• Tor support

• Proxy support

In the news

• Kali Linux Tutorials
• GeeksForGeeks.org
• Brisk Infosec
• Kalitut

License

This repository is under GNU General Public License v3.0.
edoardottt.com to contact me.