sn0int

No entries match these filters. Clear filters

1. v0.24.3 Nov 13, 2022 · release notes

   Adds RISC-V 64-bit compilation support and improves sandbox crash messaging

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.24.3 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.24.3

   └──▷ USE IT
   Build sn0int for RISC-V 64-bit targets.
   shell copy

   GOARCH=riscv64 go build

2. v0.24.0 Dec 5, 2021 · release notes

   Adds sn0int rescope command to re-apply scope rules to existing entities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.24.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.24.0

   • Adds the rescope command with -i, -n, and -y flags to re-evaluate scope/noscope/autoscope/autonoscope rules against existing entities
   • Adds interactive rescope options d (done), a (always), and x (never) to control bulk scope changes

   2 details in Everything

3. v0.23.0 Oct 23, 2021 · release notes

   sn0int v0.23.0 adds interactive run, -X proxy flag, perceptual hashing functions, and configurable user agent

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.23.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.23.0

   └──▷ TRY IT
   Scan a module and pipe live data into it for dynamic interaction
   copy

   $ sn0int run <module>

   Route run traffic through an HTTP proxy
   copy

   $ sn0int run -X http://proxy.example.com:8080 <module>

   • run <module> now accepts interactive input instead of only static data
   • -X <proxy> flag added to run command to specify a proxy server
   • New perceptual image hashing functions added to the module API

   3 details in Everything

4. v0.22.0 Sep 8, 2021 · release notes

   Adds ! prefix to invoke shell commands from readline and SN0INT_WORKSPACE env var support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.22.0

   └──▷ TRY IT
   Specify the target workspace programmatically before running sn0int
   copy

   $ export SN0INT_WORKSPACE=my_workspace && sn0int scan

   • Support invoking shell commands with ! from readline
   • The workspace can be selected with the SN0INT_WORKSPACE environment variable

   2 details in Everything

5. v0.21.0 May 12, 2021 · release notes

   Adds stats command, --values flag to select, and multi-workspace deletion

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.21.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.21.0

   └──▷ USE IT
   Check current workspace metrics without leaving the CLI context.
   shell copy

   sn0int stats

   • Adds stats subcommand to query workspace data via sn0int stats or sn0int -w <workspace> stats
   • Adds --values flag to the existing select command as shorthand for extracting .value fields
   • Adds ability to delete multiple workspaces in a single operation

   3 details in Everything

6. v0.20.0 Dec 28, 2020 · release notes

   Adds stealth levels for modules, inverse notification rules, and sn0int add --stdin.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.20.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.20.0

   • Add new --stdin flag to the sn0int add command to stream structs directly into the database
   • Introduce stealth levels (loud, normal, silent, offline) that modules can specify for targeted scanning
   • Support inverse rules for notifications to exclude specific events
   • Allow author and repository fields in module metadata

   4 details in Everything

7. v0.19.0 Jun 18, 2020 · release notes

   New cal command with calendar heatmap and time-grouping flags, plus a new notification system

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.19.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.19.0

   └──▷ USE IT
   View annual activity heatmap without time slicing.
   shell copy

   sn0int cal 2020

   View detailed monthly heatmap with 12-minute slices and 3 days of context padding.
   shell copy

   sn0int cal -TC3

   Check which notification modules are currently installed.
   shell copy

   sn0int pkg list --source notifications

   • Adds the cal subcommand to display activity annotated with a heatmap.
   • Adds -T flag to cal for 12-minute slice granularity.
   • Adds -H flag to cal to group heatmap data by hour.
   • Adds -C flag to cal to show additional context days in month view.
   • Introduces a notification system with a notifications source for the pkg command.

   5 details in Everything

8. v0.18.0 Mar 7, 2020 · release notes

   Adds MQTT broker connectivity, libsodium decryption, binary HTTP support, and pkg quickstart command

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.18.0 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.18.0

   └──▷ TRY IT
   Initialize a new sn0int package using the updated command structure.
   copy

   $ sn0int pkg quickstart

   Retrieve messages from an MQTT broker within an interceptor or script.
   copy

   $ mqtt_connect("tcp://broker.example.com:1883")

   Decrypt a libsodium encrypted secret box payload in a script.
   copy

   $ libsodium_decrypt_secretbox(secret_box_data, key)

   • pkg quickstart replaces quickstart as the subcommand to initialize a new package layout
   • New mqtt_connect() function for connecting to an MQTT broker
   • New libsodium_decrypt_secretbox() function for decrypting libsodium secret boxes
   • Binary payload support in http_request and http_send functions
   • sn0int activity now supports advanced time references such as 1h ago

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The quickstart subcommand has been renamed to pkg quickstart; scripts calling quickstart directly will fail
9. v0.17.1 Feb 22, 2020 · release notes

   v0.17.1 adds CLI exit commands and sandbox debug dump flag

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.17.1 https://github.com/kpcyrd/sn0int.git
   # already have the repo? check out this version:
   $ git checkout v0.17.1

   └──▷ TRY IT
   Terminate the interactive session from within the prompt without needing a keyboard interrupt.
   copy

   $ exit
   quit

   • exit and quit subcommands now allow exiting the sn0int CLI directly

   1 detail in Everything

10. v0.17.0 Feb 21, 2020 · release notes

    v0.17.0 adds pkg command and string functions, migrates workspace format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    • Add pkg as a new command as a replacement for mod
    • Add sn0int pkg to manage modules
    • Add geo_polygon_contains, to check if a location is inside a polygon
    • Add str_find, str_replace and strval
    • Migrate to new workspace format. Existing workspaces are migrated automatically.

    5 details in Everything

11. v0.16.0 Jan 30, 2020 · release notes

    sn0int v0.16.0 adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. functions and HTTP server IP return.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

12. v0.15.0 Jan 18, 2020 · release notes

    sn0int v0.15.0 adds ratelimit_throttle, add subcommands for urls/ports, repl tab completion, and activity logging API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    └──▷ USE IT
    Automatically enforce rate limits in a custom module without manual sleep logic.
    python copy

    lock = ratelimit_throttle(limit=10, interval=60)
    with lock:
        do_something()

    Add new URLs or ports directly from the CLI without using the REPL.
    shell copy

    sn0int urls add https://example.com
    sn0int ports add 443

    • Added ratelimit_throttle to allow modules to automatically rate-limit according to configured limits via a mutex-like lock
    • Added missing add subcommands for urls and ports in the CLI
    • Added tab completion for sn0int repl
    • Added activity logging API allowing modules to create datetime-tied events with associated data

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. download is removed; sn0int no longer attempts to download GeoIP databases automatically
13. v0.14.0 Nov 23, 2019 · release notes

    Adds sn0int repl interactive mode, sn0int export command, and new crypto currency struct

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    └──▷ TRY IT
    Start an interactive REPL to test script logic in real-time.
    copy

    $ sn0int repl

    Export the current workspace state for external processing or archival.
    copy

    $ sn0int export workspace.json

    Run an investigation only on specific structs within scope using SQL-like filtering.
    copy

    $ sn0int run -t 'where id=1' foo.ki

    • Adds sn0int repl subcommand for interactive script development
    • Adds sn0int export command to export workspace data to JSON
    • Adds support for crypto_currency as a new struct type
    • Exposes -t / --target CLI argument on sn0int run to filter structs

    4 details in Everything

14. v0.13.0 Aug 26, 2019 · release notes

    v0.13.0 introduces autonoscope engine, CLI scope/noscope commands, and new struct/function primitives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    └──▷ TRY IT
    Fetch and parse JSON body directly without manual status code or decode steps
    copy

    $ http_fetch_json("https://api.example.com/data", required_fields=["id", "name"])

    List modules that are not yet installed in the current environment
    copy

    $ sn0int search --new

    Switch to or view the nose_scope directly from the CLI without entering a module context
    copy

    $ sn0int noscope

    • http_fetch and http_fetch_json added as shorthand for http_send with status code validation and optional JSON body parsing
    • Added tls support to sock_connect
    • pgp_pubkey can now return the primary key fingerprint and signatures
    • netblocks added as a new struct type
    • sn0int noscope and sn0int scope CLI commands expose nose_scope and scope directly

    +4 more show less

    • Module search gains --new flag to list only uninstalled modules
    • base64 and base32 functions added with support for custom alphabets
    • set_err function added for control-flow cases
    • Autonoscope engine automatically applies rules to exclude structs from scope

    9 details in Everything

15. v0.12.0 Jun 19, 2019 · release notes

    sn0int v0.12.0 adds cryptographic hashing, XML parsing, strftime/strptime, port models, and workspace options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    • hmac and cryptographic hash functions are now available in the tooling language
    • strftime and strptime functions added for date formatting and parsing
    • XML parser with processing functions included for data extraction
    • New ports model allows specifying port targets directly
    • Advanced workspace options provide greater control over scan environments

    5 details in Everything

16. v0.11.0 Apr 22, 2019 · release notes

    v0.11.0 adds blob support to structs with select --paths, image/EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. parsing, and email displayname

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    └──▷ TRY IT
    Retrieve the file path of a blob attached to a struct in a search query.
    copy

    $ select --paths from structs

    • Structs can now have blobs attached; query the path with select --paths
    • Add support for images (including exif)
    • Add a displayname field for emails

    3 details in Everything

17. v0.9.0 Jan 29, 2019 · release notes

    v0.9.0 adds raw TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./socket functions, database TTLs, JSON output for selects, and new modules for email, subdomain, and URI discovery.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • Adds socket functions to create raw tcp connections (with socks5 support)
    • Adds db_add_ttl to add to the database with a timeout
    • Adds datetime function to get current time+date
    • Adds json output for select
    • New module: smtp-check - validate emails over smtp

    +3 more show less

    • New module: thunderbird-autoconfig - find subdomains via thunderbird autoconfig
    • New module: well-known-uris - test for RFC-5785 well-known uris
    • New module: passive-arp - similar to arp-scan but fully passive, depends on [sniffglue](https://github.com/kpcyrd/sniffglue)

    8 details in Everything

18. v0.8.0 Jan 7, 2019 · release notes

    v0.8.0 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. support, device/network handling, help command, and non-interactive select.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    └──▷ USE IT
    Proxy all sn0int enumeration traffic through a local SOCKS5 proxy.
    shell copy

    sn0int --proxy socks5://127.0.0.1:9050 scan target.com

    Access the built-in help documentation to see available commands.
    shell copy

    sn0int help

    Run a self-test to ensure the tool's configuration and environment are valid.
    shell copy

    sn0int selftest --check-all

    • Add socks5 support for proxying traffic
    • Add basic support for devices and networks to expand target scope
    • Introduce help command to discover available subcommands inline
    • Add necessary flags for selftest to validate local configuration
    • Exclude unneeded open syscall from sandbox to reduce false positives in sandboxes

    5 details in Everything

19. v0.7.0 Dec 24, 2018 · release notes

    v0.7.0 adds phone number support, secret management via keyring, and a URL bruteforce script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Adds phonenumber table for storing phone number records
    • Adds url_escape and url_unescape functions for URI encoding operations
    • Adds first url bruteforce script to support dictionary-based URL discovery
    • Adds keyring integration for secure secret management

    4 details in Everything

20. v0.6.0 Dec 8, 2018 · release notes

    sn0int v0.6.0 adds --stdin script input, automatic fields, and AXFRAXFRA DNS zone transfer request that asks a nameserver to send every record in a zone at once, letting cyber tools enumerate all hostnames in a domain if the server is misconfigured to allow it. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    └──▷ TRY IT
    Pipe data directly into a sn0int script for processing
    copy

    $ echo 'example.com' | sn0int --script scan.ki --stdin

    • Adds --stdin flag to pass input to scripts via standard input
    • Introduces automatic fields derived from other fields in the scope
    • Extends the dns function in Lua scripts to support AXFR (zone transfer)
    • Adds -vv verbosity level which exposes a debug function for script output

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fix indexing in lua scripts (may break existing scripts relying on old indexing behavior)
21. v0.5.0 Nov 20, 2018 · release notes

    Adds workspace command, concurrent investigations, OpenBSD support, and x509_parse_pem parser

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    └──▷ USE IT
    Run multiple investigations in parallel to speed up recon.
    shell copy

    sn0int run & sn0int run & wait

    • db_add returns nil if entity is out of scope.
    • Improve detection if in-scope and out-of-scope in passive spider
    • Allow running investigations concurrently

    3 details in Everything

22. v0.4.0 Nov 11, 2018 · release notes

    sn0int v0.4.0 adds quickstart command, db_select, asn_lookup, mod update, and bulk script publishing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ USE IT
    Initialize sn0int with default settings for the first time
    shell copy

    sn0int quickstart

    Check if a specific URL or host already exists in your scope database before adding it again
    shell copy

    sn0int db_select --url 'example.com'

    Update all installed sn0int modules to their latest versions
    shell copy

    sn0int mod update

    • Adds quickstart CLI subcommand to guide new users through initial setup
    • Adds db_select command to query existing entities in the scope database
    • Adds asn_lookup command for Autonomous System Number resolution
    • Adds mod update command to update installed sn0int modules
    • Enables publishing multiple scripts in a single operation

    +1 more show less

    • Targets can now be filtered and previewed before scanning

    6 details in Everything

23. v0.3.0 Oct 23, 2018 · release notes

    sn0int v0.3.0 adds db_update and geoip_lookup functions, scope/noscope commands, and shell completions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/kpcyrd/sn0int.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • Add db_update function
    • Add geoip_lookup function
    • Extend ipaddrs table with geoip columns
    • Add shell completions for zsh, bash and others

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Foreign keys are now correctly enforced