PAGES
← all tools
◆ Reconnaissance & OSINT

photon

1.3.0 open-source

Photon is a fast web crawler designed for OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. that extracts URLs, emails, secret keys, JavaScript endpoints, subdomains, and files from target websites.

source ↗ rss ↗ What is a cyber toolchain?

Summary

Photon is an open-source command-line crawler built for OSINT, aimed at reconnaissance work rather than general-purpose web scraping. Pointed at a target domain, it extracts URLs in and out of scope, parameterized links, emails, social media accounts, API keys and secrets, JavaScript files and the endpoints inside them, subdomains and DNS data, and files like PDFs and images, saving results as organized output or JSON; it can also clone a site locally and runs directly or via Docker. This puts it in the hands of OSINT researchers and red teamers doing target enumeration rather than developers or SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts. It sits alongside other web-crawler and recon tooling rather than any single named competitor. First committed in 2018 with 21 contributors and 42 tracked releases, it has slowed to just 2 commits in the past year, so treat it as mature but not actively developed.

Photon is a fast web crawler designed for OSINT that extracts URLs, emails, secret keys, JavaScript endpoints, subdomains, and files from target websites.

How photon helps

Which email addresses and social media accounts tie back to this target domain?

walks every crawled page and pulls out intel matches like emails and social handles, tagged with the URL each one was found on

Which of this site's JavaScript files are leaking API keys or endpoints nobody meant to expose?

fetches every JavaScript file it finds during the crawl and scans it for secret keys and hashes, filtering guesses by entropy to cut down false positives, plus the endpoints referenced inside

What subdomains and DNS records exist for this target that I haven't found yet?

resolves subdomains discovered during the crawl and pulls related DNS data, saving them to their own file for the target

Which URLs on this site take parameters an attacker could tamper with?

separates parameterized links from plain ones as it crawls, so injection-testing targets are already sorted from the rest of the site map

Has this target's content changed since the last time I looked at it?

can pull historical snapshots from the Wayback Machine alongside the live crawl, giving a copy of pages as they existed before

Can I hand a teammate a working local copy of this site instead of just a list of links?

clones the site's pages to disk during the crawl instead of only recording what it saw

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities · 1 backed by code, an API document or a real run

Built from photon's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What photon offers you

  • Command-line interface1
All capabilities 9 capabilities
Website cloning verified Downloads and saves a copy of a website locally. 1 release · 5 other sources · first seen Jul 2018

release

docs

  • Fast OSINT web crawler that extracts URLs, emails, API keys, subdomains, JavaScript endpoints, and files from target sites.

command line

example

  • Specify a custom regex pattern to extract specific links or data during scanning. photon --regex 'your_pattern_here' https://example.com v1.0.2 · Jul 2018 · source
  • Crawl a target domain via Docker docker run -it --name photon photon:latest -u google.com
  • Crawl and save results to local folder docker run -it --name photon -v "$PWD:/Photon/google.com" photon:latest -u google.com
Target exclusion filtering shipped Allows excluding specific targets, such as unwanted subdomains, from the scan results. 1 release · 1 other source · first seen Aug 2018

release

  • Adds the --exclude option to allow users to filter out specific targets during scanning v1.0.8 · Aug 2018 · source · release history

example

  • Filter out unwanted subdomains from the scan output using the new --exclude flag. python3 photon.py -u https://example.com --exclude 'api.example.com' v1.0.8 · Aug 2018 · source
Custom user agent support shipped Allows setting a custom User-Agent header for requests, enabling identity masking or specific server targeting. 1 release · 1 other source · first seen Jul 2018

Also counts toward: Command-line interface

release

  • Adds --user-agent CLI flag to set the User-Agent header v1.0.7 · Jul 2018 · source · release history

example

  • Crawl a target with a specific timeout and output results to a JSON file using a custom user agent. photon --target https://example.com --timeout 30 --output result.json --user-agent 'MyBot/1.0' v1.0.7 · Jul 2018 · source
Request timeout configuration shipped Allows specifying a custom timeout for requests made during crawling or scanning. 1 release · 1 other source · first seen Jul 2018

release

example

  • Crawl a target with a specific timeout and output results to a JSON file using a custom user agent. photon --target https://example.com --timeout 30 --output result.json --user-agent 'MyBot/1.0' v1.0.7 · Jul 2018 · source
Intel source attribution shipped Records and associates the original URL where an intelligence item was found with the intel record itself. 1 release · first seen Apr 2019

release

Python 3.2+ runtime requirement shipped Restricts execution to Python versions 3.2 or newer, dropping support for older interpreter versions. 1 release · first seen Apr 2019

release

Configurable output destination shipped Allows specifying a custom file path for output results instead of default locations. 1 release · first seen Jul 2018

release

STDOUT-only URL extraction shipped Enables extracting discovered URLs and printing them to standard output without saving files or metadata. 1 other source · first seen Jul 2018

example

  • Extract only the discovered URLs to stdout without saving any files or metadata. photon https://example.com --only-urls v1.0.4 · Jul 2018 · source
Execution statistics reporting shipped Displays total execution time and average time per request to monitor scanning performance. 1 release · first seen Jul 2018

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for photon, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail photon puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

5 entries

  1. April 20191
  3. August 20181
  5. July 20183
    Show

    5 entries

    1. 1.3.0 Apr 5, 2019 · release notes

      Photon 1.3.0 adds URL-associated Intel and drops legacy Python/ninja modes

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.3.0 https://github.com/s0md3v/Photon.git
# already have the repo? check out this version:
$ git checkout 1.3.0
      • Intel is now associated with the URL where it was found
      • Dropped Python < 3.2 support

      2 details in Everything

    2. v1.0.8 Aug 4, 2018 · release notes

      Photon v1.0.8 adds --exclude CLI flag for target filtering

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.8 https://github.com/s0md3v/Photon.git
# already have the repo? check out this version:
$ git checkout v1.0.8
      └──▷ USE IT
      Filter out unwanted subdomains from the scan output using the new --exclude flag.
      shell 
      python3 photon.py -u https://example.com --exclude 'api.example.com'
      • Adds the --exclude option to allow users to filter out specific targets during scanning

      1 detail in Everything

    3. v1.0.7 Jul 28, 2018 · release notes

      Photon v1.0.7 adds --timeout, --output, and --user-agent CLI flags for control over crawling behavior.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.7 https://github.com/s0md3v/Photon.git
# already have the repo? check out this version:
$ git checkout v1.0.7
      └──▷ USE IT
      Crawl a target with a specific timeout and output results to a JSON file using a custom user agent.
      shell 
      photon --target https://example.com --timeout 30 --output result.json --user-agent 'MyBot/1.0'
      • Adds --timeout CLI flag to set request timeout
      • Adds --output CLI flag to specify output file path
      • Adds --user-agent CLI flag to set the User-Agent header

      3 details in Everything

    4. v1.0.4 Jul 25, 2018 · release notes

      Adds --only-urls flag to Photon v1.0.4 to output only discovered URLs

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.4 https://github.com/s0md3v/Photon.git
# already have the repo? check out this version:
$ git checkout v1.0.4
      └──▷ USE IT
      Extract only the discovered URLs to stdout without saving any files or metadata.
      shell 
      photon https://example.com --only-urls
      • Removes -n as an alias for --ninja

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !The -n CLI flag is no longer a valid alias for --ninja; use --ninja explicitly
    5. v1.0.2 Jul 23, 2018 · release notes

      Photon v1.0.2 adds Python 2 compatibility, custom regex patterns, and request timing metrics.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.2 https://github.com/s0md3v/Photon.git
# already have the repo? check out this version:
$ git checkout v1.0.2
      └──▷ USE IT
      Specify a custom regex pattern to extract specific links or data during scanning.
      shell 
      photon --regex 'your_pattern_here' https://example.com
      • Added ability to specify custom regex pattern
      • Display total time taken and average time per request

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in s0md3v/Photon, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 ±0 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close < 1 day first maintainer reply 0 hours
    6. Open backlog 43 of 112 issues ever filed
    1. Issues opened / month 1 · 0 communitymaintainers
    2. Open backlog 43
    3. Contributors / month 1
    4. Commits / month 1
    5. Stars 13,215
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback