guelfoweb/knock
Knock
Knock is an attack surface management tool and DNS reconnaissance framework used for discovering and mapping an organization's external infrastructure. It functions as a subdomain enumeration tool and HTTP security scanner to identify reachable hosts and organizational assets.
The project distinguishes itself by using a passive-active hybrid enumeration strategy, combining external API lookups with active wordlist brute-force attacks and DNS zone transfers. It includes a multi-stage validation pipeline that detects DNS wildcard records and verifies host connectivity to filter out false positives.
The framework covers attack surface mapping, DNS security auditing, and vulnerability reconnaissance, including the detection of legacy TLS protocols. Findings are managed through a searchable database and can be exported as HTML or JSON reports. Performance tuning options allow for the adjustment of concurrency levels and network timeouts.
Features
- Attack Surface Mapping - Identifies all reachable subdomains and DNS records to map the organization's external attack surface.
- Subdomain Enumeration Tools - Discovers target subdomains using a hybrid of passive API lookups and active wordlist brute-forcing.
- Hybrid Enumeration Strategies - Combines external service lookups with active wordlist brute-force attacks to maximize subdomain discovery.
- Discovery Validation Pipelines - Implements a multi-stage pipeline to verify host connectivity and detect DNS wildcards to filter false positives.
- DNS Reconnaissance - Functions as a framework for querying DNS records and validating connectivity to map infrastructure.
- DNS Zone Transfers - Implements DNS zone transfer requests to retrieve complete lists of configured hosts from root domains.
- Attack Surface Management - Provides a complete platform for discovering, inventorying, and monitoring internet-facing assets.
- DNS Security Auditing - Performs zone transfers and validates DNS wildcard records to find misconfigured name servers.
- External Asset Discovery - Gathers a comprehensive list of public-facing infrastructure by integrating multiple reconnaissance sources.
- Audit Result Persistence - Stores security audit findings and reconnaissance results in a persistent local database for auditing.
- Wildcard Domain Detectors - Provides utilities to detect and filter out false-positive DNS responses caused by wildcard records.
- Reachability Validators - Verifies the reachability of discovered subdomains by checking status codes and security certificates.
- Network Security Scanners - Identifies legacy TLS versions and filters subdomains based on HTTP status codes and content.
- Security Scan Reporting - Provides a searchable database for storing and exporting security scan findings.
- TLS Version Auditing - Identifies servers using outdated TLS 1.0 or 1.1 protocols to uncover potential security vulnerabilities.
- Network Reconnaissance Tools - Scans discovered hosts for outdated TLS protocols and connectivity issues to identify potential entry points.
- Network Probing Thread Pools - Provides configurable worker thread pools to balance network probing speed and rate-limiting.
- Reconnaissance Tools - Subdomain scanning tool.
- Subdomain Enumeration - Wordlist-based subdomain enumeration tool.
- DNS Security - Tool for enumerating subdomains using wordlists.
- Subdomain Enumeration - Tool for subdomain scanning.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
