- DNS details
- DNS visual mapping using DNS dumpster
- WHOIS information
- TLS Data - supported ciphers, TLS versions, certificate details and SANs
- Port Scan
- Services and scripts scan
- URL fuzzing and directory detection
- Subdomain enumeration - uses Google dorking, bruteforce and SAN discovery
- Web application data (CMS, Web Server info, robots & sitemap extraction)
- Detects known WAFs
- Supports anonymous routing through Tor/Proxies
- Uses asyncio for improved performance
- Saves output to files - separates targets by folders and modules by files
- Have a parallel-all option run in integration with the -q argument. Essentially, make all scans run together when there is no stdout output for much quicker scan times. Running everything in parallel, especially dirbusting, messes output entirely.
- Support multiple hosts (read from file)
- CIDR notation support
- IP ranges support
- Rate limit evasion
- OWASP vulnerabilities scan (RFI, RCE, XSS, SQLi etc.)
- SearchSploit lookup on results
- More output formats
Raccoon is a tool made for reconnaissance and information gathering with an emphasis on simplicity.
It will do everything from
fetching DNS records, retrieving WHOIS information, obtaining TLS data, detecting WAF presence and up to threaded dir busting and
subdomain enumeration. Every scan outputs to a corresponding file.
It utilizes Python's asyncio to run most scans asynchronously.
Raccoon supports Tor/proxy for anonymous routing. It uses default wordlists (for URL fuzzing and subdomain discovery)
from the amazing SecLists repository but different lists can be passed as arguments.
For more options - see "Usage".
For the latest stable version:
pip install raccoon-scanner
Or clone the GitHub repository for the latest features and changes:
git clone https://github.com/evyatarmeged/Raccoon.git
cd Raccoon
python raccoon/main.py
Raccoon uses Nmap to scan ports as well as utilizes some other Nmap scripts and features. It is mandatory that you have it installed before running Raccoon.
Usage: raccoon [OPTIONS]
Options:
-t, --target TEXT Target to scan [required]
-d, --dns-records TEXT Comma separated DNS records to query.
Defaults to: A, MX, NS, CNAME, SOA
--tor-routing Route HTTP traffic through Tor. Slows total
runtime significantly
--proxy-list TEXT Path to proxy list file that would be used
for routing HTTP traffic. A proxy from the
list will be chosen at random for each
request. Slows total runtime
--proxy TEXT Proxy address to route HTTP traffic through.
Slows total runtime
-w, --wordlist TEXT Path to wordlist that would be used for URL
fuzzing
-T, --threads INTEGER Number of threads to use for URL
Fuzzing/Subdomain enumeration. Default: 25
--ignored-response-codes TEXT Comma separated list of HTTP status code to
ignore for fuzzing. Defaults to:
301,400,401,403,402,404,504
--subdomain-list TEXT Path to subdomain list file that would be
used for enumeration
-f, --full-scan Run Nmap scan with both -sV and -sC
-S, --scripts Run Nmap scan with -sC flag
-s, --services Run Nmap scan with -sV flag
-p, --port TEXT Use this port range for Nmap scan instead of
the default
--tls-port INTEGER Use this port for TLS queries. Default: 443
--no-health-check Do not test for target host availability
-fr, --follow-redirects Follow redirects when fuzzing. Default: True
--no-url-fuzzing Do not fuzz URLs
--no-sub-enum Do not bruteforce subdomains
-q, --quiet Do not output to stdout
-o, --outdir TEXT Directory destination for scan output
--help Show this message and exit.
Any and all contributions, issues, features and tips are welcome.