is-it-safe 6.0.0

Stealthy Security Layer Detector (WAF/IDS/IPS/Fail2Ban)

is-it-safe 🛡️

Stealthy Security Layer Fingerprinting & Detection v5.0

is-it-safe is a modern, high-performance security utility designed to map and identify protective layers surrounding a target without triggering aggressive defense mechanisms. It provides deep visibility into infrastructure security by fingerprinting WAFs, IDS/IPS, and automated blocking systems.

Key Features

• 🛡️ WAF Fingerprinting: Identifies 10+ major WAF vendors (Cloudflare, Akamai, AWS, Imperva, etc.) via signature-based and behavioral analysis.
• 🕵️ Stealth-First Detection: Implements adaptive jitter, randomized headers, and low-signal request patterns to bypass basic rate-limiters and heuristics.
• 🚦 IDS/IPS Probing: Uses low-level TCP signals and HTTP response anomalies to detect deep packet inspection and network-level interception.
• 🚫 Fail2Ban Discovery: Safely identifies SSH tarpits, "honey-pots," and active ban policies through non-destructive authentication probing.
• 📊 Risk Scoring: Intelligent scoring system that evaluates detected security layers and provides a "Safe to Scan" recommendation.
• 🎨 Modern Interface: Built with rich for professional, structured terminal output and high-visibility results.
• 🤖 Automation Ready: Native JSON output mode for seamless integration into larger security pipelines.

Installation

The Modern Way (Recommended)

Use uv for the fastest experience:

# Run instantly without installing
uvx is-it-safe example.com

# Or install it
uv pip install is-it-safe

The Traditional Way

pip install is-it-safe

From Source

git clone https://github.com/your-username/is-it-safe.git
cd is-it-safe
pip install .

🛠 Usage

# Basic scan
is-it-safe example.com

# Verbose scan with stealth enabled
is-it-safe example.com --stealth --verbose

# Scan specific SSH port for Fail2Ban
sudo is-it-safe example.com --ssh-port 2222

# Output results as JSON
is-it-safe example.com --json > results.json

[!IMPORTANT] Some IDS/IPS detection features require root privileges for raw socket access.

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.