scilla is a Go-based information gathering CLI that consolidates DNS enumeration, subdomain discovery, port scanning and directory brute forcing into one reporting pipeline for authorized pentest and bug bounty workflows.
| Tool | edoardottt/scilla — Go information gathering tool combining DNS, subdomain, port and directory enumeration |
| Category | Reconnaissance / network and web enumeration |
| Primary Use | Running dns, subdomain, dir, port or combined report scans against in-scope targets during authorized engagements |
| Safe Use | Educational and documentary analysis for authorized penetration testers and bug bounty researchers operating strictly within scope and written permission; also useful for defenders auditing their own external attack surface |
| Telemetry Note | Generates high volumes of DNS queries, HTTP requests and TCP connection attempts that appear in authoritative DNS logs, WAF/access logs and flow data; default user agent is fingerprintable unless -rua is used, and VirusTotal/BuiltWith API calls are observable in egress |
scilla is an open source information gathering tool written in Go by edoardottt, distributed under GPL-3.0 and sitting at roughly 1,270 stars at the time of writing. Its pitch is consolidation: rather than chaining dig, a subdomain bruteforcer, a port scanner and a directory fuzzer, scilla exposes all four as subcommands of a single binary with a shared output format. The repository's topic list — bugbounty, recon, dns-enumeration, portscanner, subdomain-scanner — makes the intended audience explicit: authorized penetration testers and bug bounty researchers doing scoping and reconnaissance against in-scope assets.
The command surface is built around five subcommands: dns, subdomain, dir, port, and report, plus help and examples. Every scanning subcommand takes a mandatory -target argument accepting a URL or IP. This uniformity is the tool's main ergonomic win; once you learn the flag vocabulary for one module, it transfers to the others, and the report command reuses the same flags to run everything in one pass. That makes scilla particularly attractive for early-phase external assessments where you want a single artifact summarizing an asset's exposed surface.
The dns subcommand performs DNS enumeration against the target domain, with output selectable as JSON via -oj, HTML via -oh, or plain text via -ot. The -plain flag strips everything except results, which is useful when piping into downstream tooling. The README is notably thin on which record types are queried, so an operator evaluating the tool should treat the DNS module as a baseline resolver-and-report component rather than a full-featured DNS interrogation suite like dig or dnsrecon.
Subdomain enumeration supports two strategies that can be combined. The first is wordlist-based brute forcing with -w wordlist.txt, where the tool resolves candidate hostnames against the target domain. The second is passive-ish enrichment through public databases: -db pulls from an external source, with -db -vt selecting VirusTotal and -db -bw selecting BuiltWith as the data source. This is where the keys.yaml configuration file comes in — installed at ~/.config/scilla/keys.yaml on Linux — since API-key-backed sources require credentials. There is also a -c flag to add a web crawler as a discovery source, scraping pages for hostnames rather than guessing them.
Subdomain results can be filtered with -i to ignore specific HTTP status codes, and the README shows a wildcard-friendly syntax like -i 4** for ignoring entire status classes. The -db -no-check variant skips status code checking entirely for database-sourced subdomains, which trades verification for speed when ingesting large third-party datasets. A practical touch for operators dealing with CDN-fronted or WAF-protected targets is -dns 8.8.8.8, letting you pin resolution to a specific resolver, and -alive to confirm which discovered hostnames actually respond — a common triage step before deeper testing.
Directory enumeration via dir is a classic content discovery brute forcer: it takes a -w wordlist, probes paths under the target, and reports status codes. The -i filter works the same way as in the subdomain module, so scilla dir -i 500,401 -target example.com or the class-based -i 5**,401 form lets you tune noise out of error-prone hosts. The -nr flag disables redirect following, which matters when a misconfigured catch-all redirect would otherwise turn every guess into a false positive. Like the other modules, dir supports custom user agents with -ua and per-request random user agents with -rua.
The port subcommand is a straightforward TCP port scanner with flexible range syntax: -p 20-90 for a range, -p 20- and -p -90 for open-ended ranges, -p 21,25,80 for discrete lists, and -common to restrict scanning to well-known ports. The default is a full 1-65535 sweep, which is loud and slow against remote targets — an operator with authorization constraints or bandwidth considerations will want -common or an explicit range. Note that port accepts a URL or IP as -target, so the same command works for hostname-based scoping.
The report subcommand is where scilla differentiates itself from a pile of single-purpose scripts. It orchestrates DNS, subdomain, port and directory enumeration into one consolidated output, with separate wordlists for each phase via -ws subdomains.txt and -wd dirs.txt, and separate ignore filters via -is and -id. It also exposes the enrichment toggles from the individual modules — -cs and -cd for crawler-assisted discovery, -db -vt for VirusTotal, -dns for resolver pinning, -rua for randomized user agents, and -alive for liveness checking. In effect, report is a one-shot external reconnaissance pipeline producing a JSON, HTML or TXT deliverable, which maps cleanly onto the documentation obligations of a client engagement.
Installation is well covered across platforms: brew install scilla for macOS, sudo snap install scilla for Snap-enabled Linux distributions, and go install -v github.com/edoardottt/scilla/cmd/scilla@latest for any system with a Go toolchain of version 1.23 or newer. Building from source uses make linux or make.bat windows, and a Dockerfile is present so docker build -t scilla . yields a containerized runner — the cleanest option if you want scan traffic isolated from your host. One quirk documented in the README: on Windows the executable only works from its own folder, a known limitation tracked in the project's issue tracker.
From a defensive perspective, scilla's activity is highly observable. Subdomain and directory brute forcing generate thousands of NXDOMAIN responses and 404s that surface in authoritative DNS logs and web access logs; full-range port scans produce connection-attempt patterns trivially flagged by IDS sensors. The default user agent is distinctive enough to fingerprint unless -rua is used, and the tool's public roadmap lists Tor and proxy support as unfinished to-do items, meaning current versions scan from the operator's source IP. Blue teams can leverage this: honeytokens on nonexistent subdomains and aggressive 404-rate alerting are direct countermeasures to this class of tooling.
The project shows signs of active maintenance: a go.yml GitHub Actions workflow badge, documented release notes, a golangci-lint gate for contributors, and an explicit to-do list (more tests, Tor support, proxy support). Coverage in Kali Linux tutorial outlets and GeeksForGeeks suggests a real user base in the pentest community. The relative thinness of the README on internals — no discussion of concurrency model, rate limiting, or wordlist defaults — means an operator should read the source or test in a lab before relying on it for time-sensitive engagements.
As a piece of the reconnaissance landscape, scilla occupies the consolidation niche: less specialized than amass for subdomain intelligence or ffuf for content discovery, but convenient when a single binary and a single report artifact are worth more than per-phase depth. For authorized professionals running scoped external assessments, it is a legitimate time-saver; for defenders, it is a representative example of the combined-tooling noise profile that external-facing monitoring should be tuned to catch. As always, the usual rule applies: run it only against assets you own or have written permission to test.
edoardottt/scilla.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.