> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automated Web Scanners Manual enumeration finds what a wordlist and a human eye catch, automated scanners trade precision for coverage, running thousands of known-vulnerability checks or OSINT lookups in the time it'd take to try a handful by hand. They're best used early to triage a target fast, not as a replacement for the manual work on the rest of this site. > [!NOTE] > > These tools are noisy by nature (high request volume, known signatures), expect them to show up in logs and trip WAF rules well before any manual testing would. Confirm scope accordingly. *** ## Nuclei Nuclei runs a huge, community maintained library of YAML templates against a target, each template checking for one specific CVE, misconfiguration, or exposure. It's less a single scanner than a template engine, the value is almost entirely in keeping the template set current. ```text theme={null} nuclei -update-templates ``` A basic scan against a single target, writing results to a file. ```text theme={null} nuclei -u https://TARGET.TLD -o scan_results.txt ``` > [!TIP] > > Running every template against every target wastes time. Filter by severity when you only care about actionable findings, or by tag when you already know the stack (e.g. only WordPress-related templates on a WordPress site). > > ```text theme={null} > nuclei -u https://TARGET.TLD -s critical,high > nuclei -u https://TARGET.TLD -tags wordpress,cve > ``` Scanning a whole list of targets, with the request rate capped to stay under a WAF's radar. ```text theme={null} nuclei -l targets.txt -rl 3 -c 2 ``` *** ## Nikto Nikto checks a web server itself for thousands of known-bad files, outdated software versions, and generic misconfigurations, closer to a vulnerability scanner for the server than for the application logic. ```text theme={null} nikto -h http://TARGET.TLD ``` `-Tuning` narrows the scan to specific test categories instead of running everything, useful for a faster, more targeted pass. | Tuning Code | Test Category | | - | - | | `0` | File upload checks | | `1` | Interesting files, ones commonly seen in logs | | `2` | Misconfigurations and default files | | `3` | Information disclosure | | `4` | Injection (XSS/script/HTML) | | `5` | Remote file retrieval, inside the webroot | | `6` | Denial of service | | `7` | Remote file retrieval, server-wide | | `8` | Command execution / remote shell | | `9` | SQL injection | | `a` | Authentication bypass | | `b` | Software identification | | `c` | Remote source inclusion | | `x` | Reverse tuning, run everything except the codes listed | ```text theme={null} nikto -h http://TARGET.TLD -Tuning b # software identification only nikto -h http://TARGET.TLD -Tuning 9 # SQL injection checks only ``` > [!WARNING] > > Tuning code `5` is remote file retrieval inside the webroot, not local file inclusion specifically, LFI findings fall more generally under information disclosure (`3`) or the file-retrieval categories. Pick codes based on what you actually want tested rather than assuming a one-to-one mapping to a named vuln class. *** ## Amass Amass is OWASP's subdomain and attack-surface mapping tool, it goes further than a simple subdomain brute-forcer by correlating DNS, certificate, scraping, and API-based data sources together. ```text theme={null} amass enum -passive -d DOMAIN.TLD ``` Active enumeration adds DNS resolution, reverse lookups, and brute forcing on top of the passive sources, louder but more complete. ```text theme={null} amass enum -active -d DOMAIN.TLD ``` *** ## Automated Recon Frameworks Beyond single-purpose scanners, several frameworks chain multiple recon steps (DNS, subdomains, screenshots, port scans, vuln checks) into one run.
Framework What it does
**FinalRecon** Python-based recon tool with modules for SSL checks, WHOIS, header analysis, and crawling, runs everything in one pass with `--full`
**Recon-ng** Modular Python framework, closest in spirit to Metasploit but for OSINT/recon: DNS enum, subdomain discovery, port scanning, web crawling
**theHarvester** Email, subdomain, host, and employee-name gathering from search engines, PGP servers, and Shodan (see [Passive Information Gathering](https://0-x.dev/passive-information-gathering.md) for usage)
**SpiderFoot** OSINT automation platform correlating IPs, domains, emails, and social profiles across many data sources, with DNS/web crawling/port scanning built in
**Discover** Bash-based recon menu wrapping several of the above tools into guided workflows
```text theme={null} ./finalrecon.py --full --url http://TARGET.TLD:PORT recon-ng ``` > [!TIP] > > Recon-ng and SpiderFoot are both interactive/menu-driven rather than single-shot commands, expect to spend a few minutes picking modules and setting the workspace rather than a one-liner. *** ## Quick Reference Tools > **[Nuclei](https://github.com/projectdiscovery/nuclei)** > > Template-driven vulnerability scanner, the de facto standard for fast CVE/misconfig checks. > **[Nikto](https://github.com/sullo/nikto)** > > Web server vulnerability and misconfiguration scanner. > **[Amass](https://github.com/owasp-amass/amass)** > > OWASP's attack-surface and subdomain mapping tool. > **[Discover](https://github.com/leebaird/discover)** > > Menu-driven wrapper around several recon tools. > **[SpiderFoot](https://www.spiderfoot.net/)** > > OSINT automation platform, see also the [OSINT cheatsheet](https://0-x.dev/osint.md). > **[Recon-ng](https://github.com/lanmaster53/recon-ng)** > > Modular Python recon framework. > [!WARNING] > > Automated scanners generate significant traffic and are easy to attribute back to a single source IP. Only run them against explicitly authorized targets, and throttle rate limits (`-rl`, `-c`) on anything shared or production-adjacent. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.