1d5d77b9bf
Merge v2.0 — full rewrite (event-driven architecture + AI + Nuclei + proxy)
...
Brings in three commits from v2-dev:
- feat: v2.0 full rewrite — event-driven pipeline, AI + Nuclei + proxy
- docs(v2): full documentation rewrite + CHANGELOG + live benchmark
- chore(release): goreleaser + CI workflows + v2 demo GIFs
Fixes #1 (SOCKS5 / Tor support).
First release candidate: v2.0.0-rc1.
2026-04-18 16:49:46 +02:00
0a50fb4eb5
chore(release): goreleaser + CI workflows + v2 demo GIFs
...
Release infrastructure:
- .goreleaser.yml: builds 5-platform binaries (darwin/linux/windows
x amd64/arm64), SHA-256 checksums, pre-release detection for -rc tags
- .github/workflows/release.yml: runs on any 'v*' tag — test -> build
-> publish via goreleaser-action
- .github/workflows/ci.yml: test + vet + race detector on every push
to main / v2-* and every PR
- .gitignore: extended to cover scan artifacts (gods-eye-*.json,
report-*.json, *.stderr), YAML configs (god-eye.yaml, .god-eye.yaml),
IDE state (.idea, .vscode, .cursor), Claude Code working notes
(CLAUDE.md, .claude/), and the /god-eye build artifact
Demo GIFs recorded live against scanme.nmap.org (Nmap's authorized
test host):
- assets/wizard-demo.gif (272 KB): interactive setup walkthrough
- assets/live-scan.gif (37 KB): colorized event stream
- assets/ai-verbose.gif (122 KB): full AI cascade + end-of-scan brief
Legacy v0.1 assets removed:
- assets/demo.gif
- assets/demo-ai.gif
2026-04-18 16:49:29 +02:00
b6042bd5df
docs(v2): full documentation rewrite + CHANGELOG + live benchmark
...
Eight documents polished for v2.0 release:
- README.md: hero + 30-sec quickstart + feature matrix + competitive
landscape + wizard/live/AI GIF demos
- AI_SETUP.md: 3 AI profiles + cascade + auto-pull + end-of-scan brief
+ model comparison + troubleshooting + privacy model
- EXAMPLES.md: 14 practical recipes from zero-flag wizard to routing
via Tor / Burp / mitmproxy
- BENCHMARK.md: cross-tool comparison matrix + methodology + caveats
- BENCHMARK-SCANME.md (new): reproducible live benchmark on Nmap's
authorized test host, documents three bugs fixed mid-test
- FEATURE_ANALYSIS.md: per-feature status across all 6 phases
- SECURITY.md: ethical guidelines + disclosure + compliance
- CHANGELOG.md (new): complete v2.0.0-rc1 release notes
2026-04-18 16:49:04 +02:00
3a4c230aa7
feat: v2.0 full rewrite — event-driven pipeline, AI + Nuclei + proxy
...
Complete architectural overhaul. Replaces the v0.1 monolithic scanner
with an event-driven pipeline of auto-registered modules.
Foundation (internal/):
- eventbus: typed pub/sub, 20 event types, race-safe, drop counter
- module: registry with phase-based selection
- store: thread-safe host store with per-host locks + deep-copy reads
- pipeline: coordinator with phase barriers + panic recovery
- config: 5 scan profiles + 3 AI tiers + YAML loader + auto-discovery
Modules (26 auto-registered across 6 phases):
- Discovery: passive (26 sources), bruteforce, recursive, AXFR, GitHub
dorks, CT streaming, permutation, reverse DNS, vhost, ASN, supply
chain (npm + PyPI)
- Enrichment: HTTP probe + tech fingerprint + TLS appliance ID, ports
- Analysis: security checks, takeover (110+ sigs), cloud, JavaScript,
GraphQL, JWT, headers (OWASP), HTTP smuggling, AI cascade, Nuclei
- Reporting: TXT/JSON/CSV writer + AI scan brief
AI layer (internal/ai/ + internal/modules/ai/):
- Three profiles: lean (16 GB), balanced (32 GB MoE), heavy (64 GB)
- Six event-driven handlers: CVE, JS file, HTTP response, secret
filter, multi-agent vuln enrichment, anomaly + executive report
- Content-hash cache dedups Ollama calls across hosts
- Auto-pull of missing models via /api/pull with streaming progress
- End-of-scan AI SCAN BRIEF in terminal with top chains + next actions
Nuclei compat layer (internal/nucleitpl/):
- Executes ~13k community templates (HTTP subset)
- Auto-download of nuclei-templates ZIP to ~/.god-eye/nuclei-templates
- Scope filter rejects off-host templates (eliminates OSINT FPs)
Operations:
- Interactive wizard (internal/wizard/) — zero-flag launch
- LivePrinter (internal/tui/) — colorized event stream
- Diff engine + scheduler (internal/diff, internal/scheduler) for
continuous ASM monitoring with webhook alerts
- Proxy support (internal/proxyconf/): http / https / socks5 / socks5h
+ basic auth
Fixes #1 — native SOCKS5 / Tor compatibility via --proxy flag.
185 unit tests across 15 packages, all race-detector clean.
2026-04-18 16:48:41 +02:00
f0bda8cc44
fix: AI bug fixes
...
- Fix confidence always showing 0% (use coordinator confidence)
- Simplify AI report prompt to prevent hallucinated subdomain names
- Update slogan to reflect AI-powered capabilities
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
2025-11-21 16:06:07 +01:00
7b611f6041
fix: Remove fake examples from AI report prompt
...
- Simplified GenerateReport prompt to prevent hallucination
- Removed example subdomain names that confused the model
- Added explicit rules to only use real scan data
2025-11-21 15:30:53 +01:00
14c26dc726
feat: Add Multi-Agent AI Orchestration with 8 specialized agents
...
- Implement 8 specialized AI agents (XSS, SQLi, Auth, API, Crypto, Secrets, Headers, General)
- Add fast type-based routing for finding classification
- Include OWASP-aligned knowledge bases per agent
- Add agent handoff logic for cross-vulnerability detection
- Optimize timeouts and parallelism for local LLM
- Add new modules: cache, network, fingerprint, secrets, cloud, API, discovery
- Update documentation with multi-agent feature
2025-11-21 15:23:11 +01:00
b1bf119c82
v0.1.1: Major AI improvements, new security modules, and documentation fixes
...
## AI & CVE Improvements
- Fix AI report to display actual subdomain names instead of generic placeholders
- Add 10-year CVE filter to reduce false positives from outdated vulnerabilities
- Integrate CISA KEV (Known Exploited Vulnerabilities) database support
- Improve AI analysis prompt for more accurate security findings
## New Security Modules
- Add wildcard DNS detection with multi-phase validation (DNS + HTTP)
- Add TLS certificate analyzer for certificate chain inspection
- Add comprehensive rate limiting module for API requests
- Add retry mechanism with exponential backoff
- Add stealth mode for reduced detection during scans
- Add progress tracking module for better UX
## Code Refactoring
- Extract scanner output logic to dedicated module
- Add base source interface for consistent passive source implementation
- Reduce admin panel paths to common generic patterns only
- Improve HTTP client with connection pooling
- Add JSON output formatter
## Documentation Updates
- Correct passive source count to 20 (was incorrectly stated as 34)
- Fix AI model names: deepseek-r1:1.5b (fast) + qwen2.5-coder:7b (deep)
- Update all markdown files for consistency
- Relocate demo GIFs to assets/ directory
- Add benchmark disclaimer for test variability
## Files Changed
- 4 documentation files updated (README, AI_SETUP, BENCHMARK, EXAMPLES)
- 11 new source files added
- 12 existing files modified
2025-11-21 12:00:58 +01:00
163b51f141
🔧 Fix CVE detection with direct NVD API integration
...
- Replaced AI function calling with direct SearchCVE() calls for reliability
- Added rate limiting (6s between requests) to prevent NVD API 429 errors
- CVE detection now shows real vulnerabilities with CVE IDs and CVSS scores
- Improved prompt context for AI analysis of CVE results
The function calling approach wasn't working reliably with Ollama models.
Now CVE data is fetched directly from NVD and passed to AI for analysis.
2025-11-20 13:51:32 +01:00
123d6123c4
🚀 God's Eye v0.1.0 - AI-Powered Subdomain Reconnaissance
...
Initial public release of God's Eye - an AI-powered subdomain enumeration and reconnaissance tool.
## Key Features
**AI-Powered Analysis:**
- Local LLM integration via Ollama (100% private, zero API costs)
- Real-time CVE detection using function calling
- Smart cascade: fast triage (phi3.5:3.8b) + deep analysis (qwen2.5-coder:7b)
- JavaScript code security review
- Anomaly identification and executive summaries
**Reconnaissance:**
- 11 passive enumeration sources (crt.sh, SecurityTrails, Shodan, etc.)
- Active DNS brute-forcing with customizable wordlists
- HTTP/HTTPS probing with technology detection
- Subdomain takeover detection
- Cloud provider identification
- JavaScript secret extraction
- Port scanning and service detection
**Production-Ready:**
- Battle-tested on real bug bounties
- Concurrent execution with rate limiting
- Multiple output formats (JSON, CSV, TXT)
- Cross-platform support (macOS, Linux, Windows)
- Comprehensive error handling
## Documentation
- Complete README with usage examples
- AI Setup Guide (AI_SETUP.md)
- Performance benchmarks (BENCHMARK.md)
- Security policy (SECURITY.md)
- Professional demo GIFs showing basic and AI-powered scans
## Technical Stack
- Language: Go 1.21+
- AI: Ollama (local LLM inference)
- Architecture: Modular, extensible design
- License: MIT
---
Made with ❤️ by @Vyntral for Orizon
https://github.com/Vyntral/god-eye
2025-11-20 12:49:54 +01:00
14718dd75f
🚀 God's Eye v0.1 - Initial Release
...
God's Eye is an ultra-fast subdomain enumeration and reconnaissance tool with AI-powered security analysis.
## ✨ Key Features
### 🔍 Comprehensive Enumeration
- 20+ passive sources (crt.sh, Censys, URLScan, etc.)
- DNS brute-force with smart wordlists
- Wildcard detection and filtering
- 1000 concurrent workers for maximum speed
### 🌐 Deep Reconnaissance
- HTTP probing with 13+ security checks
- Port scanning (configurable)
- TLS/SSL fingerprinting
- Technology detection (Wappalyzer-style)
- WAF detection (Cloudflare, Akamai, etc.)
- Security header analysis
- JavaScript secrets extraction
- Admin panel & API discovery
- Backup file detection
- robots.txt & sitemap.xml checks
### 🎯 Subdomain Takeover Detection
- 110+ fingerprints (AWS, Azure, GitHub Pages, Heroku, etc.)
- CNAME validation
- Dead DNS detection
### 🤖 AI-Powered Analysis (NEW!)
- Local AI using Ollama - No API costs, complete privacy
- Real-time CVE detection via function calling (queries NVD database)
- Cascade architecture: phi3.5 (fast triage) + qwen2.5-coder (deep analysis)
- JavaScript security analysis
- HTTP response anomaly detection
- Executive summary reports
### 📊 Output Formats
- Pretty terminal output with colors
- JSON export
- CSV export
- TXT (simple subdomain list)
- Silent mode for piping
## 🚀 Installation
bash
go install github.com/Vyntral/god-eye@latest
## 📖 Quick Start
bash
# Basic scan
god-eye -d example.com
# With AI analysis
god-eye -d example.com --enable-ai
# Only active hosts
god-eye -d example.com --active
# Export to JSON
god-eye -d example.com -o results.json -f json
## 🎯 Use Cases
- Bug bounty reconnaissance
- Penetration testing
- Security audits
- Attack surface mapping
- Red team operations
## ⚠️ Legal Notice
This tool is for authorized security testing only. Users must obtain explicit permission before scanning any targets. Unauthorized access is illegal.
## 📄 License
MIT License with additional security tool terms - see LICENSE file
## 🙏 Credits
Built with ❤️ by Vyntral for Orizon
Powered by Go, Ollama, and the security community
---
🤖 Generated with Claude Code
https://claude.com/claude-code
Co-Authored-By: Claude <noreply@anthropic.com >
2025-11-20 10:41:05 +01:00
Vyntral