karim852/KUMO-Domain-Recon-Tool

Full DNS enumeration with a security grade on email protection. Detects missing DMARC, weak SPF policies, absent DKIM, and open zone transfers.

Resolves the domain to IPv4/IPv6, geolocates each IP, and pulls ASN, ISP, and organization data.

Full registrar record including creation date, expiry, registrant info, and nameservers. Detects domains expiring soon and privacy-protected registrations.

Inspects the full certificate chain — issuer, expiry, Subject Alternative Names, cipher suite, and protocol version. Flags expired, self-signed, or misconfigured certificates.

Scans 70+ common ports and grabs service banners for each open one. False-positive hardened: the host is first probed on random unused ports — if it answers those too (tarpit, transparent proxy, or firewall that accepts everything), only ports with real application-layer evidence (a service banner, a TLS handshake, or a valid HTTP reply) are reported. Every open port is also re-verified before being listed. Enriched with data from Shodan and Censys when available.

Queries crt.sh, HackerTarget, RapidDNS, and AlienVault OTX simultaneously, cross-references with Certificate Transparency logs, resolves every result, checks if it's alive, and flags anything that looks sensitive.

Tests thousands of common subdomain names via DNS with wildcard detection — eliminates false positives automatically. Finds subdomains that passive sources miss entirely.

Fetches the favicon (HTML-declared first, then common paths in parallel — bounded so it never hangs), computes the MMH3 hash used by Shodan/Censys, and maps known hashes to technologies. Handy for fingerprinting the stack and pivoting to other hosts running the same favicon.

Takes a live screenshot of the target and runs it against the ransomware.live feed. Pulls the page title, meta description, favicon, CMS fingerprint, and checks whether the domain appears in any ransomware gang's leak posts.

Identifies the full tech stack — CMS, frameworks, JavaScript libraries, analytics, CDN, server, and more. Runs 80+ signature checks without sending a single intrusive request.

Parses robots.txt for disallowed and allowed paths, highlights sensitive ones, and checks for a security.txt vulnerability disclosure contact. Also discovers sitemaps.

Queries the Wayback Machine for archived snapshots of the target — mining old endpoints, forgotten login pages, exposed config files, and paths that no longer exist on the live site but reveal the attack surface history.

Scrapes the homepage HTML, inline scripts, and every first-party JS file, then extracts the valuable signal — not just secrets. Endpoints, internal/external URLs, API routes, database connection URIs, cloud storage (S3 / GCS / Azure / Firebase), emails, internal hosts, JWTs, private keys, source maps, and risky code comments. Static assets (.css, .js, images, fonts) and documentation domains (MDN, W3C) are filtered out; external URLs are collapsed to unique third-party hosts.

Your browser's DevTools Network tab, headless. Shows exactly what Kumo sent and exactly what came back — the full request headers, every response header verbatim, the complete redirect chain, cookie security flags, allowed HTTP methods, CORS behaviour, and any non-standard or leaky headers worth a second look.

Smart API discovery. Probes a random baseline first to detect catch-all servers, confirms a base API path actually exists before fuzzing, then discovers live endpoints and checks for GraphQL introspection. Every hit shows its HTTP status and response byte size.

Pulls and scans first-party JavaScript for hardcoded secrets — API keys, tokens, cloud credentials, and private keys — with clear-text output and the exact source line for each hit.

Probes 80+ paths that are commonly left exposed: admin panels, backup files, config files, debug interfaces, API docs, source control, and infrastructure files. Every hit is severity-graded. A 403 Forbidden response still confirms the path exists and is automatically downgraded one severity level.

Checks every security-relevant response header and grades the configuration. Flags missing headers that leave the site open to XSS, clickjacking, MIME sniffing, and information disclosure.

Fingerprints the WAF or CDN sitting in front of the target using 40+ signatures — headers, cookies, server banners, and active probe responses. If nothing is detected, it says so clearly.

Checks include: Log4Shell · Spring4Shell · Drupalgeddon2 · Confluence OGNL · Oracle WebLogic · 15 WordPress plugin CVEs · CORS misconfiguration · Host header injection · Clickjacking and many more.

Recent CVE detection (2024–2026) — a dedicated set of detection-only templates fingerprints exposure/version for the newest, actively-exploited CVEs (no exploitation, just correlation):

  RECENT CVE  cPanel / WHM Login Panel Exposed     CVE-2026-41940
  RECENT CVE  Next.js Middleware Auth Bypass       CVE-2025-29927
  RECENT CVE  SharePoint "ToolShell" RCE           CVE-2025-53770
  RECENT CVE  SAP NetWeaver Visual Composer        CVE-2025-31324
  RECENT CVE  Ivanti EPMM / Connect Secure         CVE-2025-4427
  RECENT CVE  CrushFTP Auth Bypass                 CVE-2025-31161
  ... 15 more (Fortinet · Palo Alto · Oracle EBS · Craft CMS · Vite · Langflow · Wazuh)

Queries Shodan InternetDB (free, no key) for open ports, CPEs, hostnames, and CVEs. Every CVE is enriched with CVSS score, severity, KEV flag, and description via Shodan's free CVEDB API.

Pulls host data and certificate intelligence from Censys. Enriched with optional API key for full results.

Aggregates from 5 free sources and runs an automatic per-email stealer check against Hudson Rock's database — showing which employee machines were infected, what malware ran, what passwords were stolen, and which services were compromised.

Discovers @domain employee email addresses across multiple open sources, then merges in every confirmed email found during the breach intelligence scan.

Sources: Hunter.io · crt.sh certificate logs · web page scraping (contact / about / team) · DNS SOA record · WHOIS contact · Wayback Machine archive · common business prefixes.

Enumerates likely AWS S3 / GCP / Azure bucket names derived from the domain and checks for public exposure. Only a confirmed HTTP 200 (publicly readable) is reported — unreliable 403 responses are never flagged as findings.

Generates 61 targeted Google dork queries pre-built for the domain — one click opens them in Google. Covers exposed files, login pages, sensitive directories, subdomains, cached pages, code repositories, and more.

Pre-generates 26 investigation links for the target across the most useful OSINT platforms — one click and you're there.

Identifies the CMS first, then runs only that platform's checks, so a Drupal site is never probed for WordPress paths.

Detection uses 18 weighted signals — asset paths, generator meta, headers — never a product name in the page text. A blog that writes about WordPress is not reported as running it.

Once identified, it reads the version (tagged as inference, since a backported patch doesn't change the advertised number) and probes that CMS's own sensitive paths: 34 in total — config backups, reachable installers, debug logs, exposed database files. On WordPress it also enumerates users via the REST API, plus plugins and themes with versions from their readmes.

Fingerprinting covers 20 platforms including Magento, Shopify, Ghost, Typo3 and PrestaShop. Deep checks exist for three of them, so anything else is reported as identified with no deep checks available, rather than returning an empty card that would read as a clean result.

Finds cPanel, WHM, Plesk, DirectAdmin, Webmin, Virtualmin, CyberPanel, aaPanel, Hestia, VestaCP, CentOS Web Panel, ISPConfig, Froxlor, Cockpit, Ajenti and more, across 20 ports.

Each panel is identified by its login interface — page markup, session cookies, form actions — never by its name, so a web hosting company's own marketing site reports none of the panels it sells.

Cloudflare proxies ports 2082-2096 and 8443, so an open port there is the edge and not your server. Those are excluded behind a CDN and the output says why; non-proxied panel ports are still checked. A panel port that answers without a panel interface is reported as an unexplained open port instead.