OpenDoor — OWASP Web Recon & Directory Discovery Platform

OpenDoor is an open-source CLI Recon Platform for authorized web reconnaissance, directory discovery, subdomain enumeration, fingerprints, WAF detection, bypass probing, response filtering, reporting, open-redirect checks, bounded crawl and transport-based scanning workflows.

It helps security researchers, penetration testers, bug bounty hunters, DevSecOps engineers, and developers identify exposed paths, login panels, directory listings, restricted resources, backup files, web shells, subdomains, and other potentially sensitive web assets.

Use OpenDoor only on systems you own or have explicit permission to test.

✅ Project status

🧪 CI matrix

Platform	Python 3.12	Python 3.13	Python 3.14
Linux
macOS
Windows

🚀 Quick links

• Documentation
• Quickstart
• Installation and update
• Usage guide
• Practical examples
• Changelog
• PyPI package
• Homebrew formulae
• Docker image
• AUR package
• BlackArch package
• Issues
• Contributors

✨ Features

• directory discovery;
• recursive directory discovery;
• bounded same-origin crawl;
• redirects following;
• subdomain enumeration;
• multi-threading scans for faster lookups;
• single target, target file, stdin, IPv4 CIDR, and IPv4 range input modes;
• custom wordlists, prefixes, shuffling to break scan patterns and extension filters, remote wordlists supports;
• custom request headers, cookies forwarding, and raw HTTP request templates;
• response filters by status, size, text, regex, and body length;
• response sniffers for detecting directory listings, empty responses, known file exposures, active shadow-copy probes, collation, possible exposed secrets, client-exposed endpoints, errors, exposed debug stack traces, and verified open redirect vulnerabilities;
• smart auto-calibration for soft-404, wildcard, catch-all, semantic response-diff, and DNS wildcard cases;
• technology fingerprint detection for CMS, ecommerce platforms, frameworks, runtime stacks, infrastructure, and HSTS posture;
• passive privacy-risk checks in --fingerprint, including possible HSTS, ETag/cache, and supercookie surfaces.
• passive WAF detection and bypass in secure scanning mode;
• WAF guard stop condition for ending low-value scans when initial classified responses are overwhelmingly WAF-blocked;
• controlled header and path bypass probes for blocked 401 and 403 resources;
• fault-tolerant scan runtime with retries, fail-streak protection, transport failure handling, resumable sessions, and runtime pause/resume controls;
• CI/CD fail-on result bucket rules;
• differential report comparison for previous/current JSON or SQLite reports;
• reports in terminal, text, JSON, CSV, HTML, SARIF and SQLite formats;
• proxy, OpenVPN, WireGuard, legacy TLS, and mTLS client-certificate transport support;
• sequential per-target transport rotation for batch workflows;
• configuration wizard for repeatable scan profiles;
• built-in wordlists (upd. 2026-08)

🧭 Where does OpenDoor make sense?

It is designed for real targets where speed alone is not enough: WAFs, CDNs, soft-404 pages, wildcard routes, restricted resources, authenticated areas, unstable networks, multi-target batches, and transport-controlled scans. Since it first launch in 2016 to the present day, the OpenDoor has changed dramatically, growing from a primitive brute forcer into a new adaptive discovery framework. Became DevOps and QA friendly. OpenDoor focuses on context-aware discovery instead of blind enumeration.

What makes OpenDoor different

🧬 Recognized technologies

OpenDoor includes a heuristic fingerprint engine for detecting probable application stacks, CMS platforms, frameworks, site builders, static-site tooling, infrastructure providers, HSTS / preload readiness, and WAF / anti-bot systems.

Full list of supported technologies: Fingerprinting technologies

Run fingerprint detection:

opendoor --host https://example.com --fingerprint

After the fingerprint pass finishes, OpenDoor prints a compact pre-scan summary before dictionary enumeration starts:

Fingerprint result: cms/WordPress (95%)
Web stack: WordPress | PHP | Cloudflare
Security posture: HSTS preload-ready

Read more:

• Fingerprinting guide
• WAF detection guide

📦 Installation

pipx

Recommended for most CLI users:

pipx install opendoor

pip

python3 -m pip install --upgrade opendoor

Windows / Chocolatey

OpenDoor is available from the Chocolatey Community Package Repository:

choco install opendoor -y

Chocolatey packages can lag the latest GitHub/PyPI release while community moderation completes.

Arch Linux / AUR

OpenDoor is available in the Arch User Repository:

yay -S opendoor

Homebrew

OpenDoor is also available in the Brew package manager:

brew install opendoor

Docker

OpenDoor is available as an official project Docker image via GitHub Container Registry.

docker pull ghcr.io/stanislav-web/opendoor:latest
docker run --rm -it ghcr.io/stanislav-web/opendoor:latest --version

Run a scan and write reports to the host:

mkdir -p reports

docker run --rm \
  -v "$PWD/reports:/work/reports" \
  ghcr.io/stanislav-web/opendoor:latest \
  --host https://example.com \
  --reports json,html \
  --reports-dir reports

BlackArch Linux

OpenDoor is available in BlackArch Linux:

sudo pacman -Syu
sudo pacman -S opendoor

From source

git clone https://github.com/stanislav-web/OpenDoor.git
cd OpenDoor

python3 -m pip install -r requirements.txt
python3 opendoor.py --help

See the full installation guide.

🚀 Quick usage

Basic directory scan

opendoor --host https://example.com

Crawl same-origin links

opendoor --host https://example.com --crawl

--crawl is opt-in and only works with directory scans. It uses GET, extracts conservative HTML attributes from already scanned responses, keeps same-origin URLs only, respects ignored extensions, skips POST forms and external origins, and reports discovered URLs through the normal result buckets.

Subdomain scan

opendoor --host example.com --scan subdomains

Target list

opendoor --hostlist targets.txt

Target files may mix URLs, domains, IPv4 addresses, IPv4 CIDR blocks, and inclusive IPv4 ranges:

https://example.com
app.example.com
192.168.1.10
192.168.1.0/24
192.168.1.10-192.168.1.50

Standard input

cat targets.txt | opendoor --stdin

The same mixed target format is supported through STDIN.

Low-noise scan

opendoor \
  --host https://example.com \
  --method GET \
  --auto-calibrate \
  --include-status 200-299,301,302,403 \
  --exclude-status 404,429,500-599 \
  --exclude-size-range 0-256 \
  --sniff endpoint,secret,shadow,openredirect,malware,skipempty,collation,indexof,file,stacktrace \
  --reports std,json,csv,sarif

Response sniffers

Response sniffers classify interesting response bodies during discovery. They are useful when status code and size are not enough to understand what was found.

opendoor \
  --host https://example.com \
  --method GET \
  --sniff endpoint,secret,shadow,openredirect,malware,stacktrace,indexof,file,collation \
  --reports std,json,csv,html,sqlite,sarif

Useful sniffers include:

Body-dependent sniffers automatically force GET internally when the configured method is HEAD.

Read more: Sniffers reference

Authenticated scan from raw request

opendoor \
  --raw-request request.txt \
  --scheme https \
  --method GET \
  --auto-calibrate \
  --reports json,html,sqlite,sarif

WAF-safe scan

opendoor \
  --host https://example.com \
  --waf-safe-mode \
  --timeout 60 \
  --retries 5 \
  --delay 0.5

Fault-tolerant scan

Use a more conservative runtime profile for unstable targets, slow networks, temporary WAF blocks, proxy instability, or long-running authorized scans.

opendoor \
  --host https://example.com \
  --method GET \
  --timeout 60 \
  --retries 5 \
  --retries-fail-streak 25 \
  --auto-calibrate \
  --waf-detect \
  --waf-guard \
  --session-save session.json \
  --reports std,json,html

This profile makes scans more resilient by increasing per-request timeout and retry tolerance, limiting aborts to repeated exhausted paths, filtering soft-404 and catch-all responses with auto-calibration, stopping low-value scans when WAF-blocked responses dominate, and saving checkpoint state for later resume.

Resume the scan later:

opendoor --session-load session.json

During an active scan, press Ctrl+C once to pause workers, then choose C to continue or E to abort.

Header and path bypass probes

Use this only on systems you are authorized to test. The feature is opt-in and probes blocked resources with controlled temporary headers and safe path variants.

opendoor \
  --host https://example.com \
  --method GET \
  --waf-detect \
  --header-bypass \
  --header-bypass-limit 32 \
  --reports std,json,csv,sarif,sqlite

When --header-bypass is enabled, OpenDoor first tries configured header-injection variants and then safe path-manipulation variants such as trailing slash, dot segment, semicolon suffix, case variation, and URL-encoded segment. Customize trigger statuses, trusted IP values, and headers:

opendoor \
  --host https://example.com \
  --method GET \
  --header-bypass \
  --header-bypass-status 401,403 \
  --header-bypass-ips 127.0.0.1,10.0.0.1 \
  --header-bypass-headers X-Original-URL,X-Rewrite-URL,X-Forwarded-For,X-Real-IP \
  --reports json,html,sqlite,sarif,csv

Proxy routing

Use a single explicit proxy:

opendoor --host https://example.com --proxy socks5://127.0.0.1:9050

Use the bundled rotating proxy pool:

opendoor --host https://example.com --proxy-pool

Use a custom rotating proxy list:

opendoor --host https://example.com --proxy-list proxies.txt

OpenVPN transport

opendoor \
  --host https://example.com \
  --transport openvpn \
  --transport-profile ./profile.ovpn

If OpenVPN is installed outside PATH, pass the backend explicitly:

opendoor \
  --host https://example.com \
  --transport openvpn \
  --transport-profile ./profile.ovpn \
  --transport-bin /opt/homebrew/sbin/openvpn

On Windows, --transport-bin can point to C:\Program Files\OpenVPN\bin\openvpn.exe. If a GUI client or corporate VPN agent already owns the tunnel, start that VPN outside OpenDoor and run OpenDoor in direct mode.

WireGuard transport

opendoor \
  --host https://example.com \
  --transport wireguard \
  --transport-profile ./profile.conf

More examples:

• Basic scans
• Batch scans
• Authenticated scans
• WAF-safe scans
• Header-bypass scans
• VPN transport scans
• CI/CD examples

Differential report comparison

OpenDoor can compare exactly two previous/current reports without running a new scan. Use this when you want to see what appeared, disappeared, or changed between two authorized scan results.

Supported input pairs are SQLite-to-SQLite and JSON-to-JSON only. Mixed formats, missing files, invalid reports, and unsupported report types fail with a graceful validation error.

opendoor --diff reports/baseline/example.com.sqlite:reports/current/example.com.sqlite --reports std,json
opendoor --diff reports/baseline/example.com.json:reports/current/example.com.json --reports std,json --reports-dir ./diff

SARIF reports for CI/CD

OpenDoor can export findings as SARIF 2.1.0 for GitHub Code Scanning and SARIF-compatible security pipelines.

opendoor \
  --host https://example.com \
  --reports sarif,json \
  --reports-dir ./reports

GitHub Actions upload example:

- name: Upload OpenDoor SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: reports/example.com/example.com.sarif
    category: opendoor

🎓 Mastering OpenDoor

Hands-on article series for learning OpenDoor through reproducible, authorized web reconnaissance workflows.

• Part 1 — Context-Aware Web Recon Beyond Directory Brute Force
• Part 2 — Low-Noise Recon with Redirects, Endpoint Sniffing, and Bounded Crawl
• Series companion page

📚 Documentation

The full documentation is available on ReadTheDocs:

• Home
• Quickstart
• Installation and update
• Usage guide
• Target input
• Reports
• Fingerprinting
• WAF detection and safe mode
• WAF guard
• Header Injection Bypass
• Auto-calibration
• Network transports
• TLS compatibility and mTLS
• OpenVPN transport
• WireGuard transport
• Practical examples
• Testing
• Contribution

🧪 Development

Install development dependencies:

python3 -m venv .venv
source .venv/bin/activate

python -m pip install --upgrade pip setuptools wheel
python -m pip install -r requirements-dev.txt
python -m pip install -e .

Run tests:

python -m unittest

Run coverage:

coverage run -m unittest discover -s tests -p "test_*.py"
coverage report -m

Build documentation:

python3 -m venv .docs-venv
source .docs-venv/bin/activate
python -m pip install -r docs/requirements.txt
python -m mkdocs build --strict

Build package artifacts:

python -m build

See the full testing guide and contribution guide.

🔐 Security and secret hygiene

Do not commit real secrets or private transport profiles.

Never publish:

• real OpenVPN profiles;
• WireGuard private keys;
• mTLS client certificates and private keys;
• auth-user-pass files;
• cookies;
• bearer tokens;
• customer target lists;
• private scan reports;
• sensitive CI artifacts.

Use placeholder examples only.

⚖️ Responsible use

OpenDoor is a security testing tool.

Use it only against systems you own or have explicit permission to test.

Features such as WAF detection, WAF-safe scanning, raw request replay, transport profiles, and Header Injection Bypass probes are intended for authorized security testing, defensive validation, and exposure regression checks.

The project does not grant permission to scan third-party systems, organizations, commercial services, or public infrastructure without authorization.

🧾 Changelog

See CHANGELOG.md and GitHub Releases.

🤝 Contributing

Pull requests are welcome.

Before contributing, read the contribution guide and run the relevant tests. OpenDoor improves through code contributions, documentation updates, testing, issue reports, security feedback, feature ideas, and community validation. Thanks to everyone who has helped improve the project.

📄 License

OpenDoor is released under the GNU General Public License v3.0 only.

See LICENSE.

Support

If OpenDoor helps your authorized security work, you can support ongoing maintenance through Giveth.

Support OpenDoor on Giveth