Offensive security, reconnaissance, and bug bounty utilities by TheVillageHacker.
Lightweight helpers for:
- Web reconnaissance and attack-surface mapping
- Subdomain takeover fingerprinting
- Sensitive URL / file triage
- HTTP method and CORS checks
- TLS cipher review
- End-to-end bug bounty recon automation
Use only on systems you are authorized to test.
tools/
├── recon/
│ ├── Bigfoot/ # Subdomain takeover detection
│ ├── FileFetcher/ # Interesting URL / sensitive path triage
│ └── urlscrapper/ # Page URL extractor (Go)
├── web/
│ ├── cors/ # CORS CLI + browser PoC page
│ └── Enum-HTTP-Methods/ # HTTP verb enumeration (Go + Python)
├── network/
│ ├── Bulk-Ping/ # Parallel host liveness
│ └── ciphercheck/ # TLS cipher strength from Nmap output
├── bug_bounty/
│ ├── run.sh # Full recon pipeline
│ ├── setup.sh # Install common recon tooling
│ └── resolvers.txt
├── Mainframe_Pen-test/ # Mainframe notes + mf-cli-appsec
├── utils/ # Shell / Oh My Posh helpers
├── requirements.txt # Python deps for Python tools
└── README.md
git clone https://github.com/thevillagehacker/tools.git
cd tools
# Bash tools
chmod +x recon/*/*.sh network/*/*.sh bug_bounty/*.sh
# Python tools
pip install -r requirements.txt
# Go tools
cd recon/urlscrapper && go build -o urlscrapper . && cd ../..
cd web/Enum-HTTP-Methods/src/go && go build -o enum-http-methods . && cd ../../../..Recommended environment: Linux (Kali/Parrot/Ubuntu), or WSL. macOS works for most scripts if bash ≥ 4 and coreutils/curl are available.
HTTP(S) fingerprinting against a large service list (fingerprints.txt), optional CNAME hints via dig/host, concurrent bulk scans.
./recon/Bigfoot/bigfoot.sh -d dangling.example.com
./recon/Bigfoot/bigfoot.sh -f subs.txt --only-vuln -o findings.txt
./recon/Bigfoot/bigfoot.sh -f subs.txt --json -o findings.jsonl| Flag | Purpose |
|---|---|
-d / -f |
Single host or host list |
-c N |
Concurrency (default 10) |
--only-vuln |
Print only possible takeovers |
--json |
JSON lines |
--http-only |
Skip HTTPS |
--no-cname |
Skip CNAME lookup |
Requires curl (or httpie). Edit fingerprints.txt to add providers (service\|substring).
Pulls URLs via waybackurls or gau (-d), or classifies an existing list (-f). Buckets JS, PHP, JSON, docs, config/secrets, backups, API docs.
./recon/FileFetcher/fetcher.sh -d example.com
./recon/FileFetcher/fetcher.sh -f urls.txt --probe -o out/example| Flag | Purpose |
|---|---|
-d / -f |
Domain (passive URLs) or file |
-o DIR |
Output directory (default ./results) |
--probe |
Live-check interesting URLs (httpx or curl) |
Go tool: HTML attribute crawl + regex fallback, relative URL resolution, optional concurrent status checks.
cd recon/urlscrapper
go build -o urlscrapper .
./urlscrapper -u https://example.com
./urlscrapper -u https://example.com -sc -c 20 -o links.txt
./urlscrapper -u https://example.com --same-host -silent -o scoped.txt| Flag | Purpose |
|---|---|
-u |
Target URL (required) |
-o |
Output file |
-sc |
Status-code check |
-c |
Status-check workers |
--same-host |
Keep same hostname only |
-timeout |
HTTP timeout |
Probes common verbs, highlights dangerous methods that return 2xx, prints Allow / Access-Control-Allow-Methods on OPTIONS. Does not follow redirects by default.
Go:
cd web/Enum-HTTP-Methods/src/go
go build -o enum-http-methods .
./enum-http-methods -u https://example.com/
./enum-http-methods -l urls.txt -auth 'Bearer TOKEN' --jsonPython:
python web/Enum-HTTP-Methods/src/python/methods.py -u https://example.com/
python web/Enum-HTTP-Methods/src/python/methods.py -l urls.txt --json- CLI (recommended) — sets
Originserver-side and inspects ACAO/ACAC:
python web/cors/cors_check.py -u https://target/api/me
python web/cors/cors_check.py -u https://target/api -o https://evil.example --preflight --jsonExit code 2 if any check looks vulnerable.
index.html— browser PoC. Host it on an origin you control; the browser sends that origin (JS cannot forgeOrigin). Use the CLI for arbitrary origins.
Parallel ICMP checks; optional TCP fallback when ICMP is filtered.
./network/Bulk-Ping/bulk_ping.sh -f hosts.txt
./network/Bulk-Ping/bulk_ping.sh -f hosts.txt -c 100 --tcp 443Writes results/up.txt, down.txt, summary.txt.
Parses Nmap ssl-enum-ciphers output, classifies via ciphersuite.info with a local fallback.
python network/ciphercheck/cipher_check.py -f nmap_ssl.txt -o results.csv
python network/ciphercheck/cipher_check.py -f nmap_ssl.txt -o results.csv --local-only
python network/ciphercheck/cipher_check.py -f nmap_ssl.txt -o results.csv -p http://127.0.0.1:8080End-to-end recon:
- Subdomains (haktrails, subfinder, alterx)
- Resolve (puredns / dnsx)
- Optional nmap
- Live HTTP (httpx)
- Crawl (katana / gospider)
- Takeover (Bigfoot)
- Interesting URLs (wayback + FileFetcher)
cd bug_bounty # or copy run.sh into your workspace
mkdir -p scope/example
echo example.com > scope/example/roots.txt
./run.sh example
./run.sh example --passive --no-crawl
./run.sh example --dns-only
./run.sh # interactive target + roots| Flag | Purpose |
|---|---|
--passive / --skip-nmap |
No nmap |
--dns-only |
Stop after resolve |
--no-crawl / --no-takeover / --no-files |
Skip stages |
--debug |
Extra logs |
Environment setup (Go tools, pdtm, zsh helpers):
sudo ./bug_bounty/setup.shsetup.sh installs common binaries and prepares ~/bug_bounty with run.sh (and a scan.sh symlink for older muscle memory).
roots.txt
│
▼
run.sh (or manual chain)
│
├─► subfinder / haktrails / puredns
├─► Bulk-Ping or httpx
├─► Bigfoot (takeovers)
├─► urlscrapper / katana / FileFetcher
├─► Enum-HTTP-Methods / cors_check
└─► CipherCheck (from nmap TLS output)
| Tool | Needs |
|---|---|
| Bigfoot | curl (or httpie); optional dig/host |
| FileFetcher | waybackurls or gau; optional httpx |
| urlscrapper | Go 1.21+ |
| Enum-HTTP-Methods | Go or Python + requests, termcolor |
| cors_check | Python + requests |
| CipherCheck | Python + requests |
| Bulk-Ping | ping; bash /dev/tcp for --tcp |
| run.sh | subfinder, dnsx, httpx, anew, jq; optional puredns, nmap, katana, gospider, waybackurls, haktrails, alterx |
pip install -r requirements.txtMainframe_Pen-test/ contains methodology docs and mf-cli-appsec (Go). See that directory’s README for build and usage. It is separate from the web recon toolkit.
Bug reports, fingerprint additions (recon/Bigfoot/fingerprints.txt), and PRs are welcome.
For authorized security testing, education, and research only. You are responsible for permission and legal compliance. The author assumes no liability for misuse.
TheVillageHacker — GitHub