Google Dorks & AI Recon

The most mature Google dork automation tool. It scrapes the latest dorks from the Exploit-DB Google Hacking Database (GHDB) and then runs targeted searches against your domain. Supports round-robin proxy rotation, custom delay intervals, and JSON output.

# Clone and install
git clone https://github.com/opsdisk/pagodo.git
cd pagodo
pip install -r requirements.txt

# Always scrape the latest GHDB dorks before scanning
python ghdb_scraper.py -s -j -i

# Quick scan — error messages dork category + SOCKS5 proxy
python3 pagodo.py -d target.com -g dorks/error_messages.dorks -i 12 -x 20 -p socks5h://127.0.0.1:9050 -o results.json -s urls.txt

# Deep scan — all dorks, multiple rotating proxies
python3 pagodo.py -d target.com -g dorks/all.dorks -m 300 -p socks5h://127.0.0.1:9050,http://10.0.0.1:8080 -i 8 -x 15 -l

# Focused scan — only 'files containing passwords' category
python3 pagodo.py -d target.com -g dorks/files_containing_passwords.dorks -m 200 -o passwords_crawl.json

The fastest Google dork scanner written in Go. Supports 6 search engines (Google, Shodan, Bing, DuckDuckGo, Yahoo, Ask). Minimal dependencies — single binary. Perfect for quick targeted searches when you need results immediately without the overhead of Python dependency management.

go install github.com/dwisiswant0/go-dork@latest

# Find PHP endpoints with parameters on target
go-dork -q "site:target.com inurl:.php?id=" -p 5 -s

# Find Jira instances across the internet
go-dork -q "intext:'jira' inurl:'/browse/'" -p 10

# Shodan search via go-dork — specific favicon hash
go-dork -q "org:'Target' http.favicon.hash:116323821" -e shodan

# Bing search with proxy (harder to rate-limit than Google)
go-dork -q "site:target.com filetype:env" -e bing -p 5 -x socks5://127.0.0.1:9050

Golang-based dork scanner built for continuous monitoring. Run it as a cron job — it sends findings to Slack, Discord, or Telegram. Perfect for bug bounty hunters managing multiple targets who need automated weekly dork scans with instant alerts when new exposed assets are discovered.

go install github.com/R4yGM/dorkscout@latest

Dead-simple bash script that runs all common dork combinations against a single domain in one shot. Tests for admin panels, common file types, path traversal, and exposed directories. Perfect for the first 5 minutes of recon when you just landed on a target.

# Basic scan
chmod +x FGDS.sh
./FGDS.sh target.com

# With proxy
./FGDS.sh target.com 192.168.1.1 8080

# Docker
docker build -t FGDS . && docker run -it --rm FGDS target.com

Network recon framework that imports Nmap, Zgrab2, Masscan, and DNS results — then builds an interactive, searchable database with a web UI. Think Shodan, but for your own data. Filter by port, service, banner, GeoIP, ASN. Export findings for reports.

# Initialize and scan a target range
ivre scancli --init
ivre runscans --routable --limit 1000 --output=XMLFILES
ivre scan2db -s MyTarget -c "Target Inc." -r scans/*.xml

# Launch web UI for analysis
ivre httpd --bind-address 127.0.0.1 --port 8080

Convolutional neural network that automatically analyzes webpage screenshots to identify login pages, admin dashboards, error pages, and other interesting content. During external perimeter assessments, Eyeballer can triage thousands of screenshots and flag the interesting ones — eliminating hours of manual visual review. Trained on real pentest data from Bishop Fox.

# Install
git clone https://github.com/BishopFox/eyeballer.git && cd eyeballer
pip install -r requirements.txt

# Take screenshots first (aquatone / gowitness / eyewitness)
aquatone -out screenshots/

# Run Eyeballer to classify screenshots
python3 eyeballer.py predict screenshots/ results.csv

LLM-powered assistant that augments every stage of the penetration testing workflow: reconnaissance, vulnerability analysis, exploitation guidance, and report generation. It doesn’t replace testers — it reasons about application behavior, suggests attack paths based on findings, and drafts findings in real-time during engagements.

git clone https://github.com/berylliumsec/nebula.git

Advanced AI-powered pentesting framework with 150+ integrated security tools and 12+ autonomous AI agents. Uses Gemini CLI (MCP server) for natural language attack orchestration. Agents can independently run tools, analyze output, and decide the next step — think “AI red team operator.”

Professional AI-powered pentesting framework with autonomous agents, 72+ integrated security tools (Nmap, BloodHound, Subfinder, Amass, Nuclei, CrackMapExec), real-time tool execution via REST API. Built for security professionals, bug bounty hunters, and enterprise teams. 100% open source with Swagger docs.

git clone https://github.com/SHAdd0WTAka/zen-ai-pentest.git
cd zen-ai-pentest
# API: http://localhost:8000  |  Docs: http://localhost:8000/docs

One of the first and most popular LLM-powered pentesting frameworks. Interactive — you describe what you see, PentestGPT reasons about the next step, suggests tools, and interprets output. Particularly strong for web application testing and CTF-style challenges. Uses GPT-4’s reasoning to navigate complex attack surfaces.

Winner of multiple 2025 AI pentesting benchmarks. Highly sophisticated — intelligently designs attack chains against real-world systems rather than following pre-scripted paths. Excels at discovering non-obvious vulnerability chains that human testers and other tools miss.

Runs entirely in the browser. Describe your testing objective in natural language — “find XSS on this login form” or “test this API endpoint for IDOR” — and the AI assistant guides you with specific tool commands, methodology suggestions, and result interpretation. Great for learning or quick testing sessions.

Full pentest lifecycle management platform — planning, execution, finding documentation, and AI-assisted report delivery. Think “project management for pentests.” Tracks your bug bounty targets, organizes findings, and generates client-ready reports with AI assistance.

When you just got a new target and want to see what’s immediately exposed. Passive only — target never sees you.

# Step 1: Quick dork scan with go-dork
go-dork -q "site:target.com ext:env | ext:sql | ext:bak | ext:json" -p 3 -s

# Step 2: Find admin panels
go-dork -q "site:target.com inurl:admin | inurl:login | inurl:dashboard" -p 3 -s

# Step 3: One-shot bash dork scan for quick coverage
./FGDS.sh target.com

# Step 4: Check Shodan for exposed services
go-dork -q "hostname:target.com" -e shodan -p 2 -s

Full coverage dork scan with proxy rotation followed by AI-assisted screenshot triage. Best for comprehensive external perimeter mapping.

# Step 1: Scrape latest dorks from Exploit-DB GHDB
cd pagodo && python ghdb_scraper.py -s -j -i

# Step 2: Run deep scan with proxy rotation
python3 pagodo.py -d target.com -g dorks/all.dorks -m 200 -p socks5h://127.0.0.1:9050,http://proxy:8080 -i 10 -x 25 -l -o deep_scan.json -s deep_urls.txt

# Step 3: Extract unique URLs and feed to screenshot tool
sort -u deep_urls.txt > unique_urls.txt
aquatone -out screenshots/ < unique_urls.txt

# Step 4: AI triage screenshots with Eyeballer
python3 eyeballer.py predict screenshots/ eyeballer_results.csv

Use AI tools to accelerate the recon phase — let LLMs reason about target architecture, suggest attack paths, and interpret complex output while you focus on exploitation.

# Step 1: Generate targeted dorks via DorkGPT (plain English)
# Visit dorkgpt.com — describe what you want to find
# Example: "find admin panels, exposed configs, and API docs on target.com"

# Step 2: AI reasons about target technology stack
# Load Nebula or PentestGPT with: "Target uses React+Node.js. What should I check?"
# AI output: Check /api/graphql, .env.development, Firebase configs in JS bundles

# Step 3: Execute AI-suggested dorks
go-dork -q "site:target.com inurl:graphql" -p 5
go-dork -q "site:target.com ext:env OR ext:js intext:firebase" -p 5

# Step 4: Feed findings back to AI — get next attack path suggestions

Set up recurring scans to detect new subdomains, exposed files, and configuration changes on a target over time. Bug bounties are long games — weekly monitoring catches what one-time scans miss.

#!/bin/bash
# cron-bounty.sh — Run weekly via crontab
TARGET="target.com"
DATE=$(date +%Y%m%d)

# 1. Update dork database
cd /opt/pagodo && python ghdb_scraper.py -s -j -i

# 2. Run dork scan, diff with last week for new assets
python3 pagodo.py -d $TARGET -g dorks/all.dorks -m 100 -o scan_$DATE.json -s urls_$DATE.txt
diff urls_$(date -d '7 days ago' +%Y%m%d).txt urls_$DATE.txt > new_assets_$DATE.txt

# 3. Auto-triage new assets with AI screenshot analysis
aquatone -out screenshots_$DATE/ < new_assets_$DATE.txt
python3 /opt/eyeballer/eyeballer.py predict screenshots_$DATE/ triage_$DATE.csv

# 4. Notify if new findings detected
[ -s new_assets_$DATE.txt ] && notify "New assets found on $TARGET"