Skip to content

Maintained by nulsie

     __,---.__
  ,-'         `-.__
&/           `._\ _\
 /               ''._
 |   ,             (") -snorts-
 |__,'`-..--|__|--''    
                          (-)
                            (+)
  
  --.--          ,---.,---.|         
    |  ,---..   .|__. |__. |    ,---.
    |  |    |   ||    |    |    |---'
    `  `    `---'`    `    `---'`---'
    ,---.o
    |---'.,---.,---.  
    |    ||   ||   |
    `    ``---|`---|
          `---'`---'
  
   Version 1.0 (Modularized) - Ready for sniffing...

================================================

Enter target (or "exit" to quit, "guide" for help): example.com

========================================
[*] TARGET: example.com
========================================

--- [ WHOIS ENRICHMENT ] ---
  [+] Organization: Example Inc.
  [+] Created On  : 1995-08-14T04:00:00Z
  [+] Nameservers : a.iana-servers.net, b.iana-servers.net
  [+] Source: RDAP

--- [ DNS INTELLIGENCE ] ---
  [+] No Wildcard DNS detected. Precision mode: High.

[*] Scanning DNS TXT Records for SaaS Fingerprints...
  [!] IDENTIFIED SaaS: Google Workspace
      └─ Record: google-site-verification=abc123xyz
  [+] TXT Record: v=spf1 include:_spf.google.com ~all

[*] Checking for AXFR (Zone Transfer) Vulnerabilities...
  [*] Attempting AXFR on: a.iana-servers.net...
      [-] TCP Port 53 closed on a.iana-servers.net. AXFR unlikely.
  [*] Attempting AXFR on: b.iana-servers.net...
      [-] TCP Port 53 closed on b.iana-servers.net. AXFR unlikely.
[*] Resolving domain...
  [+] Resolved via A Record: 93.184.216.34

[*] Querying Passive Sources Concurrently...
  [+] Found: www.example.com
  [+] Found: dev.example.com

[*] Checking 2 subdomains for takeover vulnerabilities...
  [-] No vulnerable CNAME configurations detected.

[*] Checking Mail Configuration...
  [+] MX Records:
      - aspmx.l.google.com (Priority: 1)
      - alt1.aspmx.l.google.com (Priority: 5)
  [+] SPF Record: v=spf1 include:_spf.google.com ~all...
  [+] DMARC: Configured

[*] Fetching Geo/ISP...
  [+] Location: Norwell, United States (US)
  [+] ISP:      EdgeCast Networks, Inc.
  [+] ASN:      AS15133

[*] Scanning 17 Ports...

[*] Running Heuristic Analysis...
  [+] No obvious honeypot signatures found.
  [+] Port 80    open -> Web Server (v: Unknown)
  [+] Port 443   open -> Web Server (v: Unknown)

[*] Checking for known vulnerabilities (CVEs)...
  [-] Port 80: Insufficient version data (Web Server v: Unknown), skipping.
  [-] Port 443: Insufficient version data (Web Server v: Unknown), skipping.

[*] Analyzing HTTP Security Headers...
  [+] Port 80 Header Config:
      [-] Strict-Transport-Security: MISSING
      [-] Content-Security-Policy: MISSING
      [-] X-Frame-Options: MISSING
      [-] X-Content-Type-Options: MISSING

      [*] TLS/SSL Certificate Intel:
          [+] Issuer:     DigiCert Inc
          [+] Expires:    Oct 25 23:59:59 2024 GMT
          [+] SAN:        www.example.com, example.com
      [*] Detected Technologies: None identified

      [*] Executing Advanced Discovery (Robots/Sitemaps) on Port 80...
          [+] robots.txt FOUND! (125 bytes)
          [?] Do you want to save this robots.txt to a file? (y/n): n
          [*] Skipped saving file.

          [*] Parsing Sitemaps...
          [!] SUCCESS: Extracted 15 unique URLs from sitemaps.
              -> Found 2 potentially sensitive URLs in sitemap:
                 └─ http://example.com/admin-login
                 └─ http://example.com/api/v1/users

      [*] Fuzzing Port 80 with concurrency limit...
          [*] Establishing Triple-Probe Baseline for /...
          [+] Baseline established. Avg Length: 1256 | Stability: 100.00%
          [+] PROTECTED: admin/                    (403 Forbidden)
          [!] EXPOSED:   .env                      (200 OK)

          [*] Recursing into directory: /admin/
          [*] Establishing Triple-Probe Baseline for /admin/...
          [+] Baseline established. Avg Length: 404 | Stability: 100.00%
          [!] Found 1 exposed files. (Interactive mode disabled)


      [*] Crawling client-side JS for secrets on Port 80...
          [!] Secrets discovered in: http://example.com/js/app.js
              -> [Google API Key]: AIzaSyB_1234567890abcdefghijklmnopqrst (Entropy: 4.15)
          [*] Scan complete: 1 sensitive items identified.

      [*] Executing Shadow-Trust Dependency Analysis on Port 80...
          [*] Discovered 2 unique external dependencies. Hunting for broken links...
          [!!!] CRITICAL SHADOW-TRUST ALERT: Abandoned Dependency Found!
                └─ Dead Host: abandoned-tracker-domain.com
          [*] Shadow-Trust Analysis complete.
      [*] Breadcrumb Crawling is disabled. Use --breadcrumb to enable.
========================================

[?] Scan complete. Download full report to .txt? (y/n):
  

how a usual scan looks like

Usage

Running the tool without arguments will execute a default scan using the built-in toolsets and settings.

trufflepigg

(When prompted, enter your target domain).

Command Line Arguments

Argument Description
--guide, -h Display the help guide (what else do you think it'll do?).
--mode [web, infra, both] Set the scan mode. (Default: web).
--ports [p1,p2,...] Specify custom ports to scan (e.g., --ports 80,443,8080).
--breadcrumb Enable breadcrumb crawling to discover and analyze internal links.
--hops [num] Set the maximum depth for breadcrumb crawling. (Default: 3).
--protate Enable automatic proxy rotation via ProxyScrape.
--tor [url] Enable Tor routing. Defaults to socks5h://127.0.0.1:9050 if no URL is provided.
--fuzzlist [path] Load a custom wordlist for directory fuzzing.
--concurrency [num] Set maximum concurrent tasks to avoid dropping connections. (Default: 10).
--depth [num] Set web directory fuzzing recursion depth. (Default: 2).
--sleep [min,max] Set a random delay range in ms between requests (e.g., --sleep 100,500).
--signatures [path] Load a custom JSON file for technology detection signatures.

Examples

  1. The "I want everything" Scan:
  2. ./TrufflePigg.js --mode both --breadcrumb --concurrency 20
    
  3. The Stealth Scan (Tor + High Sleep):
  4. ./TrufflePigg.js --tor --sleep 500,1500 --depth 1
    
  5. Targeted Infrastructure Scan:
  6. ./TrufflePigg.js --mode infra --ports 21,22,25,445,3306,6379