🦅 RAVEN

Recon & OSINT Framework — fast, single-file domain reconnaissance for authorized security assessments.

RAVEN gathers reconnaissance on a single target domain and produces a clean console summary plus optional JSON and standalone HTML reports. It is designed as a compact, readable, dependency-light tool for penetration testers, bug-bounty hunters, and students learning the recon phase of an engagement.

---

✨ Features

• DNS enumeration — A, AAAA, MX, NS, TXT, CNAME and SOA records via dnspython, gracefully handling missing record types.
• Subdomain enumeration — concurrent brute-force from a wordlist (ships with a built-in top-~100 list) using a thread pool; reports resolving hosts and their IPs.
• HTTP/HTTPS probing — status code, final URL, page <title>, and Server / X-Powered-By banners with a sane timeout and custom User-Agent.
• Technology fingerprinting — infers stacks (WordPress, PHP, Nginx, ASP.NET, React, Cloudflare, …) from headers and body markers via a rules dictionary.
• WAF / CDN detection — signature matching for Cloudflare, Sucuri, Akamai, Incapsula, F5 BIG-IP, AWS WAF and more.
• Security-header audit — flags missing CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• Reporting — colored cross-platform console output (colorama) plus optional --json and dark-themed standalone --html reports (inline CSS, no external assets).

---

📦 Install

pip install -r requirements.txt

Requires Python 3.7+. Dependencies: requests, dnspython, colorama.

---

🚀 Usage

# Basic scan (DNS + subdomains + HTTP probing)
python raven.py -d example.com

# Custom wordlist and more threads
python raven.py -d example.com --subs wordlists/subdomains-top100.txt --threads 40

# Export JSON and HTML reports
python raven.py -d example.com --json report.json --html report.html

# Passive mode — DNS + main host only, no subdomain brute-force
python raven.py -d example.com --no-active

Flag	Description
-d, --domain	Target domain (required)
--subs	Path to a subdomain wordlist (default: bundled list)
--threads	Concurrent resolver threads (default: 20)
--timeout	Per-request timeout in seconds (default: 8)
--json	Write a JSON report to the given file
--html	Write a standalone HTML report to the given file
--no-active	Passive mode: skip subdomain brute-force

---

🖥️ Sample output

    ____  ___ _    ____________   __
   / __ \/   | |  / / ____/ __ \ / /
  / /_/ / /| | | / / __/ / / / // /
 / _, _/ ___ | |/ / /___/ /_/ //_/
/_/ |_/_/  |_|___/_____/_/ |_(_)
        Recon & OSINT Framework  v1.0.0
        by Əliəsgər Fətullayev  |  authorized use only

  [*] Target       : example.com
  [*] Threads      : 20
  [*] Active mode  : yes

[ DNS Enumeration ]
  [+] A     93.184.216.34
  [+] NS    a.iana-servers.net.
  [+] SOA   ns.icann.org. noc.dns.icann.org. 2024...

[ Subdomain Enumeration ]
  [*] Loaded 118 candidate subdomains from subdomains-top100.txt
  [+] www.example.com  ->  93.184.216.34
  [+] api.example.com  ->  93.184.216.35
  [*] 2 live subdomain(s) discovered.

[ HTTP / HTTPS Probing ]
  [+] https://example.com/  [200]
        Server: ECS (dcb/7F83)
        "Example Domain"

[ Technology Fingerprint (main host) ]
  [+] Nginx

[ WAF / CDN Detection (main host) ]
  [!] Possible WAF/CDN: Cloudflare

[ Security Header Audit (main host) ]
  [-] missing : Content-Security-Policy (CSP)
  [-] missing : Strict-Transport-Security (HSTS)

[ RAVEN scan complete ]

---

⚠️ Legal / Ethical Use

RAVEN is provided strictly for authorized security testing and education. Only scan domains and infrastructure that you own or for which you hold explicit written permission to test. Unauthorized scanning or reconnaissance may be illegal in your jurisdiction. The author accepts no liability for misuse or for any damage caused by this software. You are responsible for your own actions.

---

👤 Author

Əliəsgər Fətullayev — 2026 · Released under the MIT License.