FAQ

FAQ

Do I need root?

Only for scans that need raw sockets (e.g. nmap SYN scans). Passive recon, web enumeration and the /dev/tcp fallback work unprivileged. Kraken warns when launched as root but proceeds. See Usage.

Do I have to install every tool in requirements.txt?

No. Install only what you need. Each module guards its external tools and degrades gracefully, a missing tool produces a warning, never an abort. See Installation.

A module says a tool is missing but it is installed.

It must be on the PATH of the user running Kraken. Go-based tools (subfinder, nuclei…) install into $GOBIN/$GOPATH/bin, make sure that is on PATH. Confirm detection via the Configuration view (C).

Where are my results?

Under kraken_output/<session>/, one subdirectory per module/target, plus kraken.log and the generated reports. Change the base directory with KRAKEN_BASE_DIR. See Output Structure and Configuration.

How do I get a Markdown report?

Run the report module (key 5), it writes both REPORT_*.txt and REPORT_*.md in one pass. See Reporting.

The directory scan is slow / too aggressive. Can I tune it?

Yes. Set KRAKEN_WEB_JOBS to control concurrency (default 8). Lower it to be gentle, raise it for speed. See Web Enumeration.

Why isn't there a set -e?

The menu is an interactive loop; a single failing child tool must not kill the shell. Kraken uses set -uo pipefail and handles errors per function. See Architecture.

Can I run Kraken non-interactively / in a pipeline?

Not currently, it is menu-driven. --help and --version are the only non-interactive entry points. Colors auto-disable when stdout is not a TTY, so piped output stays clean.

How do I add my own tool or module?

See Extending Kraken for the three extension patterns and the conventions to follow.

Is this legal to use?

Only against systems you own or have explicit written authorization to test. See Disclaimer & Legal.