Obscura Scan

Threat Hunter & Attack Surface Management Platform
A single static Go binary for passive & semi-offensive reconnaissance, correlation, risk scoring, and continuous monitoring.

---

Table of Contents

• What is Obscura Scan?
• Highlights
• Quick Start
• Screenshots
• Documentation
• Architecture
• Safety & Responsible Use
• License
• Links

What is Obscura Scan?

Obscura Scan is an attack-surface management and OSINT/recon platform that you run as one static binary — no Python, no virtualenv, no system libraries, no database server. Point it at a domain, URL, or IP and it runs dozens of recon modules concurrently, correlates the results, scores the risk, optionally enriches with an LLM, and serves everything through a clean web UI + REST API with live progress streaming.

It is the Go rewrite of the platform formerly known internally as AEGIS, re-architected for speed, safety, and single-file deployment.

Most of the value needs no API keys. 43 of the 50 modules are fully self-contained — they talk directly to the target and the DNS/TLS/HTTP protocols. Obscura Scan runs with zero keys configured; key-gated modules simply skip with a reason.

Highlights

• 🧩 50 recon/intel/analysis modules — DNS, TLS, certificates, subdomains, takeover detection, JS endpoint/secret extraction, source-map detection, typosquatting, JARM, cipher auditing, cloud-bucket hunting, email-auth posture, and more.
• 🔒 SSRF-hardened by design — every outbound request goes through a guarded dialer that re-validates the resolved IP at connect time (defeats DNS-rebinding & redirect bypass). Default-deny for private/loopback/metadata ranges.
• ⚡ True parallel engine — bounded worker pool, dependency DAG, panic isolation per module, context cancellation, result caching.
• 📊 Risk scoring + ML — a self-contained IsolationForest and a transparent, confidence-weighted scorer turn findings into a 0–100 risk score. Every finding carries a confidence (confirmed/firm/tentative); the score is anchored by the worst confirmed finding and only nudged by volume, so a flood of low-confidence heuristics can't pin the gauge at 100. Cross-module de-duplication and one-click false-positive suppression keep the report signal-dense.
• 🤖 AI copilot — multi-provider (Gemini → OpenAI → Anthropic) with an always-on offline rule-based fallback. Never hard-fails.
• 🗺️ Attack-surface graph — interactive target → subdomain → IP → ASN → cert-issuer relationship map.
• 🔁 Continuous monitoring — schedule a target, get alerted when new findings appear (Slack / Discord / Teams / Telegram).
• 🚀 Campaigns — scan many targets at once and aggregate into one dashboard.
• 🎛️ Profiles — one-click Quick / Full / Bug Bounty / Compliance scan templates.
• 📤 8 export formats — JSON, CSV, STIX 2.1, Splunk-CIM, QRadar-LEEF, Elastic-ECS, PDF, DOCX.
• 🛡️ Enterprise controls — optional Bearer-token API auth, per-IP rate limiting, audit log.
• 📈 Observability — Prometheus /metrics, structured logging, graceful shutdown.

Quick start

# 1. Get it (see Installation for binaries / Docker)
git clone https://github.com/security-life-org/Obscura.git
cd Obscura
make build            # -> bin/obscura  (CGO_ENABLED=0, pure Go)

# 2. Run it (every config value is optional)
./bin/obscura

# 3. Open the UI
#    http://127.0.0.1:8080

Then enter a target (e.g. example.com), pick a profile, and hit Start Scan. Results render as a readable report — risk gauge, findings, per-module tables — not raw JSON.

./bin/obscura --version          # build info
./bin/obscura --allow-internal   # permit private/loopback targets (authorized internal use)

Screenshots

CLI Startup

🖼️ View all screenshots (Dashboard, Scan Progress, Scheduled, Campaigns, Modules, Settings, Health API)

Dashboard — New Scan

Scan Progress (Live SSE)

Scheduled Scans

Campaigns

Modules Catalog

Settings

Health API

Documentation