web-scanner 2.0.0

An async Textual TUI for website reconnaissance — DNS, WHOIS, TLS, security, tech-stack and SEO, with no paid APIs.

WebScanner

An async Textual TUI for website reconnaissance. Point it at a domain and it concurrently gathers DNS, WHOIS, TLS, security, tech-stack and SEO intelligence, then lays it out across tabs — with a live country map and a server-status panel that stay pinned in place.

No paid APIs. Everything runs off free, public endpoints and the standard library: ip-api.com for geolocation, Cloudflare/Google DoH and dig against public filtering resolvers for blocklist checks, the system whois, and stdlib ssl/socket. Country borders are embedded (Natural Earth), so even the map needs no tile service.

Features

Nine tabs, scanned concurrently and rendered live as each module finishes:

• DNS — A / AAAA / NS / CNAME / SOA / MX / TXT / CAA / DS / DNSKEY records, plus email authentication folded in: DMARC (_dmarc) and DKIM (probes ~40 common selectors).
• Whois — parsed system whois, with rich gTLD and ccTLD field support (registrar, dates, nameservers, per-contact details).
• Subdomains — discovered natively from TLS certificate SANs and socket probes of common subdomains — no third-party enumeration services.
• SSL — certificate issuer, subject, SANs, validity window, trust and expiry, parsed from the live TLS handshake.
• Security — TCP connect port scan, presence of HTTP security headers (CSP, HSTS, X-Frame-Options, …), and blocklist status across public filtering resolvers (AdGuard, CleanBrowsing, Cloudflare, Google, OpenDNS, Quad9).
• Headers — the full set of HTTP response headers.
• Tech — technology-stack detection via Wappalyzer: name, category, confidence, groups and version.
• SEO — page content (title/description with length hints, H1–H3, social links), top keyword n-grams, robots.txt and sitemaps, and JSON-LD structured data.
• Links — internal and external links, with their anchor text.

Alongside the tabs, two fixed panels:

• Country map — real country outlines auto-framed around the server's location, drawn with braille characters (+ / - to zoom).
• Server — online status and response time, IP, geolocation, ISP, AS, hosting provider and detected tech.

Installation

Requires Python 3.11+.

The easiest way is with pipx (or uv), which installs webscan into its own isolated environment:

pipx install git+https://github.com/iamramizk/web-scanner
# or
uv tool install git+https://github.com/iamramizk/web-scanner

From source (development)

git clone https://github.com/iamramizk/web-scanner.git
cd web-scanner
python3 -m venv .venv
source .venv/bin/activate     # Unix/macOS  (.venv\Scripts\activate on Windows)
pip install -e .

Usage

webscan example.com

You can also run it as a module (python -m webscanner example.com), or from a source checkout without installing (python app.py example.com).

Press s inside the app to save every tab to CSV. When installed, results are written to a ./<domain>_<timestamp>/ folder in your current directory.

Updating

Once it's on PyPI:

pipx upgrade web-scanner

For a Git install, pipx upgrade won't see new commits (the version is unchanged), so reinstall from the source:

pipx install --force git+https://github.com/iamramizk/web-scanner

Keys

Key	Action
← / → Tab	Switch tabs
r	Rescan
s	Save — export every tab to CSV under output/<domain>_<timestamp>/
esc	Edit the domain and scan a new one
q	Quit