🚀 Hojamalo Scanner — State-of-the-Art Web App Security Recon Tool

Hojamalo Scanner is a real-time, terminal-only web application security detection and reconnaissance tool. Built for security researchers, bug hunters, and DevOps engineers, it performs concurrent crawling, passive subdomain discovery, configuration auditing, DNS analysis, and active (non-intrusive) parameter checking—all straight to your terminal.

  ██╗  ██╗ ██████╗  ██████╗  █████╗ ███╗   ███╗ █████╗ ██╗      ██████╗ 
  ██║  ██║██╔═══██╗ ╚═══██║ ██╔══██╗████╗ ████║██╔══██╗██║     ██╔═══██╗
  ███████║██║   ██║    ██╔╝ ███████║██╔████╔██║███████║██║     ██║   ██║
  ██╔══██║██║   ██║██   ██║ ██╔══██║██║╚██╔╝██║██╔══██║██║     ██║   ██║
  ██║  ██║╚██████╔╝╚██████╔╝██║  ██║██║ ╚═╝ ██║██║  ██║███████╗╚██████╔╝
  ╚═╝  ╚═╝ ╚═════╝  ╚═════╝  ╚═╝  ╚═╝╚═╝     ╚═╝╚═╝  ╚═╝╚══════╝ ╚═════╝ 

⚡ Key Features

• 🏎️ High-Speed Concurrency: Fetch and audit multiple pages in parallel using a configurable worker pool.
• 🌐 Host Info & GeoIP Lookup: Automatically resolves the target host IP and queries geolocation data (Country, City, ISP/ASN Org) at startup.
• 🧱 Web Application Firewall (WAF) Detection: Scans response headers for signatures of Cloudflare, AWS WAF, Sucuri, Imperva, and Akamai.
• 🛡️ DNS Security Audit: Queries TXT records to check for Sender Policy Framework (SPF) and DMARC configurations, flagging missing or weak security policies.
• 🔑 JavaScript Secrets Scanner: Crawls inline and external script links, running regex audits to locate leaked AWS Keys, Google API Keys, Stripe Keys, Slack Webhooks, or JWTs.
• 🌳 Subdomain Takeover Detector: Cross-checks subdomains discovered via certificate transparency logs for orphaned configurations (GitHub Pages, AWS S3, Heroku, Shopify, Squarespace) returning 404 errors.
• 🔗 Broken Link Hijacker: Scans outbound links to check if any of the target's linked social media handles (Twitter/X, Medium, YouTube, GitHub, Facebook) are dead/returning 404, pointing to potential hijack risks.
• 🚀 Directory Buster (Wordlist Fuzzer): Feed in custom wordlists to brute-force hidden paths, detecting index listings or exposed endpoints asynchronously.
• 🕵️ WAF Bypass Spoofing: Automatically injects randomized origin headers (X-Forwarded-For, X-Real-IP, etc.) to evade simplistic IP-based rate limiting.
• 🧬 Safe Vulnerability Heuristics: Safely validates redirection routes on parameters (e.g. ?url=, ?redirect=) to confirm Open Redirect vulnerabilities.
• 🌿 ASCII Infrastructure Tree Map: Renders a clean tree visualization of the target's domain, live subdomains, and discovered paths at the end of the scan.

📦 Installation

To install Hojamalo Scanner globally on your system, ensure you have Node.js installed (version 18.0.0 or higher), then run:

npm install -g hojamalo-scanner

🚀 How to Run

Basic Scan

Perform a default scan with active crawling and security header validation:

hojamalo-scanner https://example.com

High-Speed Scanning

Increase the worker pool size to scan larger applications faster:

hojamalo-scanner https://example.com --concurrency 10 --max-pages 100

Directory Brute-Forcing

Scan the target domain using a custom directory wordlist:

hojamalo-scanner https://example.com --wordlist paths.txt

Skip Subdomain Search

If you only want to crawl the main application and skip cert logs lookup:

hojamalo-scanner https://example.com --no-subdomains

Auto-Update

Check the npm registry and update Hojamalo Scanner to the latest version automatically:

hojamalo-scanner --update

⚙️ CLI Reference Options

Use hojamalo-scanner --help to show all commands:

| Flag | Long Argument | Description | Default | | :--- | :--- | :--- | :--- | | -c | --concurrency | Number of pages to scan in parallel | 5 | | -w | --wordlist | Filepath to wordlist for directory brute-forcing | null | | -y | --yes | Skip the authorization confirmation prompt | false | | -u | --update | Update hojamalo-scanner to the latest version | false | | -v | --version | Print the current tool version | false | | -h | --help | Show the help interface | false | | | --max-pages | Max number of pages to crawl/scan | 40 | | | --delay | Delay between requests in seconds | 0.2 | | | --no-subdomains | Skip passive subdomain enumeration | false |

📋 Security Standards Audited

• HTTP Headers: Missing HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
• Information Leaks: Technology disclosure, CMS version metadata, verbose debug stack traces in HTML body.
• Cookie Defenses: Set-Cookie headers lacking HttpOnly or Secure attributes.
• Form Vulnerabilities: Form actions pointing to insecure http:// endpoints, password input tags allowing autocomplete.
• Network & SSL/TLS: expired certificates, expiring certificates (<21 days), non-HTTPS configurations.

⚠️ Important Disclaimer

• Detection Only: This tool is designed purely for reconnaissance and detection. It never sends exploits, dangerous injection payloads, or alters server states.
• Authorization: Only run scans against systems you own or have explicit written authorization to test. Scanning without permission is illegal and unethical.
• This tool does not replace a manual source-code audit or a fully certified penetration test.

📄 License

Distributed under the MIT License. See LICENSE for more information.