Ansferatu

Multifunctional tool for HTTP reconnaissance, web crawling and web directory bruteforce. Based on PSpider.

Features

• Fast multi-URL crawling
• Fast multi-URL directory bruteforce
• Discover new subdomains without DNS bruteforce (e.g. https://example.com → many *.example.com hosts)
• Optional headless browsing and automatic form fill-up (via patchright, a stealth Playwright fork)
• JSONL output (Nuclei/proxify-compatible)

Installation

Ansferatu is a regular Python package and requires Python 3.8+.

From PyPI:

pip3 install ansferatu

From source / GitHub:

pip3 install git+https://github.com/frostbits-security/ansferatu.git
# or, from a local checkout:
pip3 install .

Headless / form-filling support is optional. The --headless and --fill-forms modes rely on patchright, a drop-in Playwright fork with anti-bot patches (clears navigator.webdriver, suppresses CDP detection leaks). Install the extra and download the patched Chromium runtime:

pip3 install 'ansferatu[headless]'
patchright install chromium

Installing the package exposes an ansferatu console command (equivalent to python3 -m ansferatu).

How to run

Run via the ansferatu command. Use ansferatu --help (or ansferatu crawl --help) to see all options.

crawl

Crawl one or more web sites. The main parameter is --limit (requests per subdirectory).

ansferatu crawl --url https://example.com -o ./results/ --limit 1

crawl --headless

Same crawl, but with patchright headless extraction for qualifying pages. Requires the headless extra (pip install 'ansferatu[headless]' && patchright install chromium).

ansferatu crawl --headless --url https://example.com -o ./results/

crawl --fill-forms

Extends the headless crawl with form detection and interaction: detects <form> elements, fills fields with smart defaults (email, password, search, etc.), submits them, and captures the resulting responses and new URLs. Implies --headless.

ansferatu crawl --fill-forms --url https://example.com -o ./results/

brute

Classic web directory bruteforce. Needs a wordlist.

ansferatu brute --url https://example.com -w ./wordlists/fuzz_big.txt -o ./results/

Use as a library

The package can be imported into other Python tools:

from ansferatu import common_crawler, common_brute_from_file

common_crawler(
    url_list=["https://example.com"],
    scope=["example.com"],
    exclude_codes_list=[403, 404, 401],
    visit_count_limit=10,
    max_deep=2,
    threads=10,
    output_file="results.jsonl",
)

For lower-level control, build the spider directly:

from ansferatu.spider import WebSpider, TaskFetch

Docker

Build the image:

docker build -t ansferatu .

Run the container (the image's entrypoint is the ansferatu command):

docker run --rm -it -v /tmp/ansferatu_out:/ansferatu/results ansferatu \
  crawl --url https://example.com -o /ansferatu/results/ --limit 1

Development

Editable install (source changes are picked up immediately):

pip3 install -e '.[headless,dev]'
patchright install chromium

Run the test suite:

pytest

Building & publishing to PyPI

The project is configured with pyproject.toml (PEP 621). Build the distribution artifacts (source distribution + wheel):

pip3 install build
python3 -m build          # writes dist/ansferatu-<version>.tar.gz and .whl

Validate and upload with Twine:

pip3 install twine
twine check dist/*

# Test upload first (recommended): https://test.pypi.org
twine upload --repository testpypi dist/*

# Real upload
twine upload dist/*

Notes:

• Bump version in pyproject.toml (and __version__ in ansferatu/__init__.py) before each release; PyPI rejects re-uploads of an existing version.
• Uploading requires a PyPI account and an API token (configured via ~/.pypirc or the TWINE_USERNAME=__token__ / TWINE_PASSWORD=<token> environment variables).

Roadmap

• Dynamic dictionary generation for bruteforce
• Improved deduplication (Simhash / page-hash similarity)
• HTML reports alongside JSONL output
• Collect query parameters (GET and POST)

License

MIT — see LICENSE.