Kraken chains reconnaissance, port scanning, web enumeration, vulnerability checks and reporting into one interactive Bash menu. Pure Bash, no Python runtime, structured per-session output, and every module degrades gracefully when a tool is missing so you install only what you need.
📖 Full docs (install, usage, per-module guides, configuration, output layout, extending) live in the Kraken Wiki. This README is the quick overview.
git clone https://github.com/WhiteMuush/kraken.git
cd kraken && chmod +x kraken.sh
sudo ./kraken.sh # sudo lets nmap run SYN scans nativelyRuns natively on Debian/Kali. On any other distro it runs inside a shared
Debian box (podman/docker), reused across toolkits; there nmap falls back to an
unprivileged connect scan automatically, so a scan never dies on a missing raw
socket. See docs/DISTRO_COMPAT.md. --help and
--version are also available.
| Key | Module | What it does |
|---|---|---|
| 1 | Reconnaissance | DNS records, subdomain enumeration, WHOIS, reverse DNS |
| 2 | Port scanning | nmap quick scan + service detection, /dev/tcp fallback when nmap is absent |
| 3 | Web enumeration | HTTP headers, common directories, technology detection, robots.txt |
| 4 | Vulnerability | SSL/TLS, allowed methods, missing security headers |
| 5 | Report | Aggregate the current session into a single text report |
Each run writes one folder per session, one subfolder per module/target, and a final aggregated report.
kraken.sh entry point (~100 lines)
lib/
core.sh version, globals, TTY-aware colors
logger.sh log_step / log_info / log_warn / log_error / log_success
installer.sh ensure_command, ensure_repo, prompts, raw-socket helpers
ui.sh banner, info panel, main menu, config view
session.sh session bootstrap, connectivity test
modules/ recon, scan, web, vuln, report
docs/ ARCHITECTURE.md, ADDING_A_MODULE.md
Bash >= 4.0, plus only the tools you plan to use, Kraken degrades gracefully when one is missing. Common external tools: Nmap, Masscan, Amass, Subfinder, dnsenum, theHarvester, ffuf, Gobuster, Wapiti, Nikto, Nuclei, SSLyze, WPScan. Full list in requirements.txt.
PRs, issues and module requests welcome. See CONTRIBUTING.md for conventions and the checklist, and docs/ADDING_A_MODULE.md to add a new tentacle in a few lines. Security issues go private via SECURITY.md, not public issues.
MIT. Use, modify and redistribute freely, keep the attribution to Melvin PETIT / WhiteMuush.
For educational and authorized security testing only. Always get explicit written permission before testing systems you do not own. The maintainers are not responsible for misuse.