argus/
├── sources/          Certificate Transparency, passive DNS, brute force
├── correlators/      DNS resolution, CDN bypass, port scanning
├── intelligence/     43 analysis modules
│   ├── Core          TLS, HTTP, email, content discovery, JS secrets
│   ├── Graph         Attack paths, compliance, CVE, anomaly detection
│   ├── Advanced      SSRF chains, OAuth/GraphQL/WebSocket, BGP, stealth
│   └── Intelligence  Deep CVE, API enumeration, cloud storage, threat intel
├── ontology/         Knowledge graph (NetworkX), entity model, pivot engine
├── output/           HTML report, executive report, CSV, JSON, terminal
└── web/              FastAPI real-time dashboard with WebSocket

git clone https://github.com/DozerMx/Argus
cd Argus
pip install -r requirements.txt

pip install fastapi uvicorn websockets

python argus.py -d TARGET [OPTIONS]

# CT log collection + DNS resolution + anomaly detection
python argus.py -d target.com

# Full 43-phase scan
python argus.py -d target.com --full

# Full scan with executive report
python argus.py -d target.com --full --output executive

# Full scan with authentication and fuzzing
python argus.py -d target.com --full --fuzz --auth

# Scan with known credentials
python argus.py -d target.com --full --auth --user admin --password admin123

# Subdomain brute force + AXFR
python argus.py -d target.com --brute --axfr

# Deep infrastructure: ASN + CDN bypass + ports
python argus.py -d target.com --deep --cdn-bypass --ports

# Stealth scan (paranoid jitter profile)
python argus.py -d target.com --full --stealth-profile paranoid

# Through Tor
python argus.py -d target.com --full --proxy socks5://127.0.0.1:9050

# Bulk scan from file
python argus.py -f targets.txt --full --output json

# Continuous monitoring with Slack alerts
python argus.py -d target.com --daemon --webhook https://hooks.slack.com/...

# Web UI dashboard
python argus.py --serve --ui-port 8080

Target:
  -d DOMAIN             Single target domain
  -f FILE               File with one domain per line

Scan Modules:
  --full                Enable all modules
  --deep                ASN, cloud detection, Wayback, reverse IP
  --brute               Subdomain brute force + permutations
  --axfr                DNS zone transfer
  --cdn-bypass          CDN/WAF origin IP discovery
  --ports               TCP port scan + banner grab (178 ports)
  --jarm                JARM TLS fingerprinting
  --fuzz                Parameter fuzzing (SQLi, XSS, SSRF, IDOR, traversal)
  --auth                Authentication analysis
  --user USER           Username for authenticated scanning
  --password PASS       Password for authenticated scanning

Output:
  --output FORMAT       terminal | html | executive | json | csv
  --outfile PATH        Output file path
  -v                    Verbose logging
  -q                    Quiet mode

Performance:
  --threads N           Concurrent threads (default: 30)
  --timeout N           Request timeout in seconds (default: 10)
  --proxy URL           Proxy (socks5://host:port or http://host:port)
  --no-cache            Disable disk cache
  --stealth-profile     paranoid | careful | normal | aggressive

Web UI:
  --serve               Launch real-time web dashboard
  --ui-port N           Web UI port (default: 8080)

Daemon:
  --daemon              Continuous monitoring mode
  --webhook URL         Webhook URL for alerts (Slack/Telegram)
  --interval N          Scan interval in hours (default: 6)

Domain ── resolves_to ──> IP ── belongs_to ──> ASN
  |                              |
  +── has_cert ──> Certificate   +── hosts ──> Domain
  |
  +── runs ──> Technology ── has_cve ──> CVE

aiohttp>=3.9.0
dnspython>=2.4.0
networkx>=3.2.0
rich>=13.7.0
python-dateutil>=2.8.2

fastapi>=0.110.0
uvicorn[standard]>=0.29.0
websockets>=12.0