Google Dorks & AI Recon

The most mature Google dork automation tool. It scrapes the latest dorks from the Exploit-DB Google Hacking Database (GHDB) and then runs targeted searches against your domain. Supports round-robin proxy rotation, custom delay intervals, and JSON output.

# Clone and install
git clone https://github.com/opsdisk/pagodo.git
cd pagodo
pip install -r requirements.txt

# Always scrape the latest GHDB dorks before scanning
python ghdb_scraper.py -s -j -i

# Quick scan — error messages dork category + SOCKS5 proxy
python3 pagodo.py -d target.com -g dorks/error_messages.dorks -i 12 -x 20 -p socks5h://127.0.0.1:9050 -o results.json -s urls.txt

# Deep scan — all dorks, multiple rotating proxies
python3 pagodo.py -d target.com -g dorks/all.dorks -m 300 -p socks5h://127.0.0.1:9050,http://10.0.0.1:8080 -i 8 -x 15 -l

# Focused scan — only 'files containing passwords' category
python3 pagodo.py -d target.com -g dorks/files_containing_passwords.dorks -m 200 -o passwords_crawl.json

The fastest Google dork scanner written in Go. Supports 6 search engines (Google, Shodan, Bing, DuckDuckGo, Yahoo, Ask). Minimal dependencies — single binary. Perfect for quick targeted searches when you need results immediately without the overhead of Python dependency management.

go install github.com/dwisiswant0/go-dork@latest

# Find PHP endpoints with parameters on target
go-dork -q "site:target.com inurl:.php?id=" -p 5 -s

# Find Jira instances across the internet
go-dork -q "intext:'jira' inurl:'/browse/'" -p 10

# Shodan search via go-dork — specific favicon hash
go-dork -q "org:'Target' http.favicon.hash:116323821" -e shodan -H "Cookie: session=xxx"

# Bing search with proxy (less aggressive rate-limiting)
go-dork -q "site:target.com filetype:env" -e bing -p 5 -x socks5://127.0.0.1:9050

Bash-based Google dork fuzzer that enumerates files, directories, subdomains, and parameters without leaving evidence on the target server. Uses Google searches passively — the target never sees you. Colored output makes findings easy to spot.

# Hunt backup & config files
GooFuzz -t target.com -e pdf,doc,bak,sql,env,zip,tar.gz -p 3

# Passive subdomain enumeration (no direct target contact)
GooFuzz -t target.com -s -p 10 -d 5 -o subdomains.txt

# Custom wordlist fuzzing + content filter for credentials
GooFuzz -t target.com -w sensitive_paths.txt -c "password,credential,secret" -p 5 -r socks5://127.0.0.1:9050

# Extension wordlist + exclude blog/noise domains
GooFuzz -t target.com -e extensionslist.txt -x "wordpress,wp-content,blog" -p 2

Golang-based scanner that automates Google dork scans against specific targets or the entire internet. Has a built-in dork installer that pulls the latest dorks from Exploit-DB. Outputs results as HTML reports. Runs in Docker for air-gapped environments.

# Install latest dorks from Exploit-DB
dorkscout install

# Scan for sensitive shopping info — proxy + HTML output
dorkscout scan -d="/dorkscout/Sensitive Online Shopping Info.dorkscout" -H="/dorkscout/report.html" -x socks5://127.0.0.1:9050

# Docker: scan through proxy with host networking
docker run --net host -v dorkscout_data:/dorkscout r4yan/dorkscout scan -d="/dorkscout/Sensitive Files.dorkscout" -H="/dorkscout/files.html" -x socks5://127.0.0.1:9050

Dead-simple bash script that runs all common dork combinations against a single domain in one shot. Tests for admin panels, common file types, path traversal, and exposed directories. Perfect for the first 5 minutes of recon when you just landed on a target.

# Basic scan
chmod +x FGDS.sh
./FGDS.sh target.com

# With proxy
./FGDS.sh target.com 192.168.1.1 8080

# Docker
docker build -t FGDS . && docker run -it --rm FGDS target.com

Self-hosted network reconnaissance framework that integrates Nmap, Masscan, Zeek, Nuclei, ZGrab2, and ProjectDiscovery tools. Stores results in MongoDB and provides a web UI for analysis. Think of it as your private Shodan that you control — perfect for tracking target infrastructure changes over time during long-term bug bounty engagements.

# Initialize and scan a target range
ivre scancli --init
ivre runscans --routable --limit 1000 --output=XMLFILES
ivre scan2db -s MyTarget -c "Target Inc." -r scans/*.xml

# Launch web UI for analysis
ivre httpd --bind-address 127.0.0.1 --port 8080

Convolutional neural network that automatically analyzes webpage screenshots to identify login pages, admin dashboards, error pages, and other interesting content. During external perimeter assessments, Eyeballer can triage thousands of screenshots and flag the interesting ones — eliminating hours of manual visual review. Trained on real pentest data from Bishop Fox.

# Install
git clone https://github.com/BishopFox/eyeballer.git && cd eyeballer
pip install -r requirements.txt

# Take screenshots first (aquatone / gowitness / eyewitness)
aquatone -out screenshots/

# Run Eyeballer to classify screenshots
python3 eyeballer.py predict screenshots/ results.csv

LLM-powered assistant that augments every stage of the penetration testing workflow: reconnaissance, vulnerability analysis, exploitation guidance, and report generation. It doesn't replace testers — it reasons about application behavior, suggests attack paths based on findings, and drafts findings in real-time during engagements.

git clone https://github.com/berylliumsec/nebula.git

Advanced AI-powered pentesting framework with 150+ integrated security tools and 12+ autonomous AI agents. Uses Gemini CLI (MCP server) for natural language attack orchestration. Agents can independently run tools, analyze output, and decide the next step — think "AI red team operator."

Professional AI-powered pentesting framework with autonomous agents, 72+ integrated security tools (Nmap, BloodHound, Subfinder, Amass, Nuclei, CrackMapExec), real-time tool execution via REST API. Built for security professionals, bug bounty hunters, and enterprise teams. 100% open source with Swagger docs.

git clone https://github.com/SHAdd0WTAka/zen-ai-pentest.git
cd zen-ai-pentest
# API: http://localhost:8000  |  Docs: http://localhost:8000/docs

One of the first and most popular LLM-powered pentesting frameworks. Interactive — you describe what you see, PentestGPT reasons about the next step, suggests tools, and interprets output. Particularly strong for web application testing and CTF-style challenges. Uses GPT-4's reasoning to navigate complex attack surfaces.

Winner of multiple 2025 AI pentesting benchmarks. Highly sophisticated — intelligently designs attack chains against real-world systems rather than following pre-scripted paths. Excels at discovering non-obvious vulnerability chains that human testers and other tools miss.

Runs entirely in the browser. Describe your testing objective in natural language — "find XSS on this login form" or "test this API endpoint for IDOR" — and the AI assistant guides you with specific tool commands, methodology suggestions, and result interpretation. Great for learning or quick testing sessions.

Full pentest lifecycle management platform — planning, execution, finding documentation, and AI-assisted report delivery. Think "project management for pentests." Tracks your bug bounty targets, organizes findings, and generates client-ready reports with AI assistance.

When you just got a new target and want to see what's immediately exposed. Passive only — target never sees you.

# Step 1: Fast dork scan — find exposed files & panels in 30 sec
./FGDS.sh target.com

# Step 2: Quick Google dork for sensitive configs
go-dork -q "site:target.com ext:env | ext:sql | ext:bak | ext:json" -p 3 -s

# Step 3: Find subdomains via Google (passive)
GooFuzz -t target.com -s -p 5 -d 3 -o subdomains.txt

# Step 4: Check for admin panels & debug endpoints
go-dork -q "site:target.com inurl:admin | inurl:debug | inurl:phpinfo | inurl:swagger | inurl:graphql" -p 3

Comprehensive Google dork scan using all GHDB categories. Rotates proxies to avoid bans. Best for long-term engagements where you want to leave no stone unturned.

Use AI tools to accelerate the recon phase — let LLMs reason about target architecture, suggest attack paths, and interpret complex output while you focus on exploitation.

# Step 1: Generate targeted dorks via DorkGPT (plain English)
# Visit dorkgpt.com — describe what you want to find
# Example: "find admin panels, exposed configs, and API docs on target.com"

# Step 2: AI reasons about target technology stack
# Load Nebula or PentestGPT with: "Target uses React+Node.js. What should I check?"
# AI output: Check /api/graphql, .env.development, Firebase configs in JS bundles

# Step 3: Execute AI-suggested dorks
go-dork -q "site:target.com inurl:graphql" -p 5
go-dork -q "site:target.com ext:env OR ext:js intext:firebase" -p 5

# Step 4: Feed findings back to AI → get next attack path suggestions

Set up recurring scans to detect new subdomains, exposed files, and configuration changes on a target over time. Bug bounties are long games — weekly monitoring catches what one-time scans miss.

#!/bin/bash
# cron-bounty.sh — Run weekly via crontab
TARGET="target.com"
DATE=$(date +%Y%m%d)

# 1. Update dork database
cd /opt/pagodo && python ghdb_scraper.py -s -j -i

# 2. Run dork scan, diff with last week for new assets
python3 pagodo.py -d $TARGET -g dorks/all.dorks -m 100 -o scan_$DATE.json -s urls_$DATE.txt
diff urls_$(date -d '7 days ago' +%Y%m%d).txt urls_$DATE.txt > new_assets_$DATE.txt

# 3. Auto-triage new assets with AI screenshot analysis
aquatone -out screenshots_$DATE/ < new_assets_$DATE.txt
python3 /opt/eyeballer/eyeballer.py predict screenshots_$DATE/ triage_$DATE.csv

# 4. Notify if new findings detected
[ -s new_assets_$DATE.txt ] && notify "New assets found on $TARGET"