[opensourcedex]

scilla is a free, open source threat detection & response project written in Go and released under GPL-3.0. It has 1,274 GitHub stars, 143 forks and 6 open issues, and was last pushed 2 days ago. On this registry it ranks #59 of 71 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available.

What is scilla?

scilla is a GPL-3.0, Go-based command-line information gathering tool for security testers, bug bounty hunters, and penetration testers who need DNS, subdomain, port, and directory enumeration from one utility.

What it is

scilla is an information gathering tool written in Go and released under GPL-3.0. It sits in the Security & Privacy / Threat Detection & Response category, with topics covering bug bounty, DNS enumeration, directory enumeration, information gathering, network operations, penetration testing, and pentesting. The project provides a command-line interface with dedicated dns, subdomain, dir, port, and report subcommands, and it can be installed through Homebrew, Snap, Go, source builds, or Docker.

The concrete problem it solves is fragmentation in early-stage reconnaissance. Instead of moving between separate DNS, subdomain, directory, and port enumeration steps, an operator can run scilla dns -target example.com, scilla subdomain -target example.com, scilla dir -target example.com, scilla port -target example.com, or scilla report -target example.com against the same target. It therefore replaces a collection of separate command-line enumeration workflows with one Go binary and a consistent set of output options.

Key capabilities

  • DNS enumeration is available through scilla dns -target example.com, with JSON, HTML, text, and plain output selected by -oj, -oh, -ot, and -plain.
  • Subdomain enumeration supports custom wordlists with -w wordlist.txt, status-code filters such as -i 400 and -i 4**, concurrency with -c, database-backed mode with -db, additional source flags -vt and -bw, custom or random user agents with -ua and -rua, a chosen resolver with -dns 8.8.8.8, and an -alive check.
  • Directory enumeration through scilla dir accepts custom wordlists, status filters such as -i 500,401 and -i 5**,401, concurrency with -c, no-redirect mode with -nr, user-agent controls with -ua and -rua, and JSON, HTML, or plain output.
  • Port enumeration through scilla port can scan the default full range, a range with -p 20-90, an open-ended range with -p 20- or -p -90, multiple ports with -p 21,25,80, common ports with -common, or a single port with -p 80.
  • A combined scilla report subcommand produces a full report and accepts port selection with -p, including range, open-ended range, and single-port forms shown in the README.
  • API keys can be configured in ~/.config/scilla/keys.yaml on Linux or in a keys.yaml file on Windows.
  • Docker usage is documented as docker build -t scilla . followed by docker run scilla help.

Who uses it and how

  • Bug bounty and penetration testing engagements use the dns, subdomain, dir, and port subcommands as a single reconnaissance toolkit against a target domain.
  • Subdomain discovery workflows can begin with the default run or a supplied -w wordlist.txt, then narrow results with -i status filters and confirm live hosts with -alive.
  • Directory and port checks can be tuned for assessment work, using status filters such as -i 500,401 for directories and -common or explicit -p selections for ports.
  • Handoff and reporting workflows can emit JSON, HTML, or plain text with -oj, -oh, -ot, or -plain, or use scilla report for a combined run.
  • Deployment environments include Linux and Windows source builds, Homebrew and Snap installs, Go installs, and Docker containers; the README notes that the Windows executable works only in the cariddi folder.

Getting started

Install with brew install scilla, sudo snap install scilla, or go install -v github.com/edoardottt/scilla/cmd/scilla@latest; building from source requires Go 1.23 or later and uses make linux or .\make.bat windows. Docker users can run docker build -t scilla . followed by docker run scilla help.

How it compares

The available facts name no similar or competing tools, so scilla stands alone in this registry. No paid-product replacement list is supplied, and no licence, self-hosting, data-ownership, or cost comparison with another named product can be drawn from the available material.

When to use it — and when not to

scilla is appropriate when a security tester wants a self-contained Go CLI for DNS, subdomain, directory, and port enumeration and is prepared to manage the binary, wordlists, and optional API key files. It is not a fit for anyone seeking a managed or hosted service, because the supplied material documents only local installation, source builds, Homebrew, Snap, Go install, and Docker use. A self-hoster must create ~/.config/scilla/keys.yaml or keys.yaml if API keys are needed, and should note the README’s Windows caveat that the executable works only in the cariddi folder; the full report examples are also only partially documented.

project readme (upstream, from github) — read inline


🏴‍☠️ Information Gathering tool 🏴‍☠️ - DNS / Subdomains / Ports / Directories enumeration

workflows
Coded with 💙 by edoardottt

Share on Twitter!

Install • Get Started • Examples • Changelog • Contributing • License

Installation 📡

Homebrew

brew install scilla

Snap

sudo snap install scilla

Golang

go install -v github.com/edoardottt/scilla/cmd/scilla@latest

Building from source

You need Go (>=1.23)

Building from source for Linux and Windows
Linux
git clone https://github.com/edoardottt/scilla.git
cd scilla
go get ./...
make linux # (to install)
make unlinux # (to uninstall)

Edit the ~/.config/scilla/keys.yaml file if you want to use API keys.

One-liner: git clone https://github.com/edoardottt/scilla.git && cd scilla && go get ./... && make linux

Windows

Note that the executable works only in cariddi folder (Alias?).

git clone https://github.com/edoardottt/scilla.git
cd scilla
.\make.bat windows # (to install)
.\make.bat unwindows # (to uninstall)

Create a keys.yaml file if you want to use API keys.

Using Docker

docker build -t scilla .
docker run scilla help

Examples 💡

  • DNS enumeration:

    • scilla dns -target example.com
    • scilla dns -oj output -target example.com
    • scilla dns -oh output -target example.com
    • scilla dns -ot output -target example.com
    • scilla dns -plain -target example.com

  • Subdomains enumeration:

    • scilla subdomain -target example.com
    • scilla subdomain -w wordlist.txt -target example.com
    • scilla subdomain -oj output -target example.com
    • scilla subdomain -oh output -target example.com
    • scilla subdomain -ot output -target example.com
    • scilla subdomain -i 400 -target example.com
    • scilla subdomain -i 4** -target example.com
    • scilla subdomain -c -target example.com
    • scilla subdomain -db -target example.com
    • scilla subdomain -plain -target example.com
    • scilla subdomain -db -no-check -target example.com
    • scilla subdomain -db -vt -target example.com
    • scilla subdomain -db -bw -target example.com
    • scilla subdomain -ua "CustomUA" -target example.com
    • scilla subdomain -rua -target example.com
    • scilla subdomain -dns 8.8.8.8 -target example.com
    • scilla subdomain -alive -target example.com

  • Directories enumeration:

    • scilla dir -target example.com
    • scilla dir -w wordlist.txt -target example.com
    • scilla dir -oj output -target example.com
    • scilla dir -oh output -target example.com
    • scilla dir -ot output -target example.com
    • scilla dir -i 500,401 -target example.com
    • scilla dir -i 5**,401 -target example.com
    • scilla dir -c -target example.com
    • scilla dir -plain -target example.com
    • scilla dir -nr -target example.com
    • scilla dir -ua "CustomUA" -target example.com
    • scilla dir -rua -target example.com

  • Ports enumeration:

    • Default (all ports, so 1-65635) scilla port -target example.com
    • Specifying ports range scilla port -p 20-90 -target example.com
    • Specifying starting port (until the last one) scilla port -p 20- -target example.com
    • Specifying ending port (from the first one) scilla port -p -90 -target example.com
    • Specifying multiple ports scilla port -p 21,25,80 -target example.com
    • Specifying common ports scilla port -common -target example.com
    • Specifying single port scilla port -p 80 -target example.com
    • Specifying output format (json)scilla port -oj output -target example.com
    • Specifying output format (html)scilla port -oh output -target example.com
    • Specifying output format (txt)scilla port -ot output -target example.com
    • Print only results scilla port -plain -target example.com

  • Full report:

    • Default (all ports, so 1-65635) scilla report -target example.com
    • Specifying ports range scilla report -p 20-90 -target example.com
    • Specifying starting port (until the last one) scilla report -p 20- -target example.com
    • Specifying ending port (from the first one) scilla report -p -90 -target example.com
    • Specifying single port scilla report -p 80 -target example.com
    • Specifying multiple ports scilla report -p 21,25,80 -target example.com
    • Specifying output format (json)scilla report -oj output -target example.com
    • Specifying output format (html)scilla report -oh output -target example.com
    • Specifying output format (txt)scilla report -ot output -target example.com
    • Specifying directories wordlist scilla report -wd dirs.txt -target example.com
    • Specifying subdomains wordlist scilla report -ws subdomains.txt -target example.com
    • Specifying status codes to be ignored in directories scanning scilla report -id 500,501,502 -target example.com
    • Specifying status codes to be ignored in subdomains scanning scilla report -is 500,501,502 -target example.com
    • Specifying status codes classes to be ignored in directories scanning scilla report -id 5**,4** -target example.com
    • Specifying status codes classes to be ignored in subdomains scanning scilla report -is 5**,4** -target example.com
    • Use also a web crawler for directories enumeration scilla report -cd -target example.com
    • Use also a web crawler for subdomains enumeration scilla report -cs -target example.com
    • Use also a public database for subdomains enumeration scilla report -db -target example.com
    • Specifying common ports scilla report -common -target example.com
    • No follow redirects scilla report -nr -target example.com
    • Use VirusTotal as subdomains source scilla report -db -vt -target example.com
    • Set the User Agent scilla report -ua "CustomUA" -target example.com
    • Generate a random user agent for each request scilla report -rua -target example.com
    • Set DNS IP to resolve the subdomains scilla report -dns 8.8.8.8 -target example.com
    • Check also if the subdomains are alive scilla report -alive -target example.com

Get Started 🎉

scilla help prints the help in the command line.

usage: scilla subcommand { options }

   Available subcommands:
       - dns [-oj JSON output file]
             [-oh HTML output file]
             [-ot TXT output file]
             [-plain Print only results]
             -target <target (URL/IP)> REQUIRED
       - port [-p <start-end> or ports divided by comma]
              [-oj JSON output file]
              [-oh HTML output file]
              [-ot TXT output file]
              [-common scan common ports]
              [-plain Print only results]
              -target <target (URL/IP)> REQUIRED
       - subdomain [-w wordlist]
                   [-oj JSON output file]
                   [-oh HTML output file]
                   [-ot TXT output file]
                   [-i ignore status codes]
                   [-c use also a web crawler]
                   [-db use also a public database]
                   [-plain Print only results]
                   [-db -no-check Don't check status codes for subdomains]
                   [-db -vt Use VirusTotal as subdomains source]
                   [-db -bw Use BuiltWith as subdomains source]
                   [-ua Set the User Agent]
                   [-rua Generate a random user agent for each request]
                   [-dns Set DNS IP to resolve the subdomains]
                   [-alive Check also if the subdomains are alive]
                   -target <target (URL)> REQUIRED
       - dir [-w wordlist]
             [-oj JSON output file]
             [-oh HTML output file]
             [-ot TXT output file]
             [-i ignore status codes]
             [-c use also a web crawler]
             [-plain Print only results]
             [-nr No follow redirects]
             [-ua Set the User Agent]
             [-rua Generate a random user agent for each request]
             -target <target (URL/IP)> REQUIRED
       - report [-p <start-end> or ports divided by comma]
                [-ws subdomains wordlist]
                [-wd directories wordlist]
                [-oj JSON output file]
                [-oh HTML output file]
                [-ot TXT output file]
                [-id ignore status codes in directories scanning]
                [-is ignore status codes in subdomains scanning]
                [-cd use also a web crawler for directories scanning]
                [-cs use also a web crawler for subdomains scanning]
                [-db use also a public database for subdomains scanning]
                [-common scan common ports]
                [-nr No follow redirects]
                [-db -vt Use VirusTotal as subdomains source]
                [-ua Set the User Agent]
                [-rua Generate a random user agent for each request]
                [-dns Set DNS IP to resolve the subdomains]
                [-alive Check also if the subdomains are alive]
                -target <target (URL)> REQUIRED
       - help
       - examples

Changelog 📌

Detailed changes for each release are documented in the release notes.

Contributing 🛠

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

In the news 📰

License 📝

This repository is under GNU General Public License v3.0.
edoardottt.com to contact me.

Frequently asked questions

Is scilla free to use?

scilla is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does scilla do?

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

What is scilla written in?

scilla is primarily written in Go. Its source is publicly available at https://github.com/edoardottt/scilla, and it has 1,274 GitHub stars.