ivre/ivre
Ivre
This project is a network reconnaissance framework and internet metadata database used for collecting, storing, and analyzing data from active scanners and passive traffic captures. It functions as a threat intelligence aggregator and passive traffic analysis tool, merging scan results from multiple tools into a unified dataset for security investigation.
The system distinguishes itself through its ability to visualize network assets using heatmaps and geographic charts to correlate autonomous systems and domain names. It provides external attack surface management by aggregating metadata to monitor the security posture of public internet assets and mapping connections between nodes to track communication patterns.
The platform covers a broad range of capabilities including active asset scanning, firewall log ingestion, and the archiving of network certificates and keys. It includes a search service for indexing devices across private or public internet ranges and integrates third-party network tools via a plugin-based system. Access to the data is managed through a web interface using key-based authentication and external headers.
Features
- Internet Metadata Databases - Provides a searchable repository for indexing network assets, certificates, and service information.
- Network Reconnaissance - Provides a complete system for collecting, storing, and analyzing data from active scanners and passive traffic captures.
- Network Scanning - Identifies open ports and common products across an address space using active scanning and heatmaps.
- Network Asset Indexes - Provides a searchable index of network devices across private or public internet ranges.
- Network Discovery - Identifies open ports and active services across large address spaces to map the available attack surface.
- Attack Surface Management - Aggregates scan results and metadata to visualize and monitor the security posture of public internet assets.
- Passive Analysis Pipelines - Extracts host and service intelligence from captured network packets without initiating active connections.
- Network Intelligence Extraction - Provides passive traffic analysis to extract host and service intelligence from network captures and firewall logs.
- Passive Intelligence Gathering - Collects and indexes network reconnaissance data to build searchable directories of devices and communication patterns.
- Reconnaissance Result Aggregators - Merges scan results from multiple active reconnaissance tools into a single unified dataset for security investigation.
- Threat Intelligence Aggregation - Functions as a central hub for merging scan results from multiple tools into a unified dataset.
- Network Reconnaissance Visualizations - Generates charts and maps to correlate autonomous systems, domain names, and geographic locations.
- Address Space Heatmaps - Maps address space occupancy and port status onto a coordinate-based grid to identify network patterns.
- Relational Database Persistence - Uses a relational schema to store structured network metadata and scan results for historical analysis.
- Scan Result Visualizers - Visualizes port scan results and autonomous system mappings through heatmaps and geographic charts.
- IP Range Indexers - Creates an optimized index of scanned network devices for fast retrieval across large IP ranges.
- Network Flow Visualizers - Maps connections between nodes and autonomous systems to analyze data flows and geographic distributions.
- Standardized Output Wrappers - Integrates diverse third-party network tools by wrapping their binary outputs into a standardized internal format.
- Traffic Flow Aggregators - Maps connections between network nodes to track communication patterns and detailed flow data.
- Reconnaissance and Discovery - Network recon framework to build alternatives to Shodan/ZoomEye/Censys.
- Data Visualization - A framework for network reconnaissance and self-hosted security analysis.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
