Photon Web Crawler: OSINT для извлечения данных с сайтов — Полное руководство 2026

URL → Queue Manager → Thread Pool → HTTP Client → Parser → Extractors → Storage

/

├── urls.txt          # All discovered URLs

├── files.txt         # File references

├── keys.txt          # API keys и secrets

├── emails.txt        # Email addresses

├── social.txt        # Social media links

├── scripts.txt       # JavaScript files

├── dns.txt           # DNS information

├── wayback.txt       # Wayback URLs

├── intel.txt         # Intelligence summary

└── report.html       # HTML report

<h2 id="update-system">Update system</h2>

sudo apt update && sudo apt upgrade



<h2 id="install-python-and-pip">Install Python and pip</h2>

sudo apt install python3 python3-pip git



<h2 id="clone-repository">Clone repository</h2>

git clone https://github.com/s0md3v/Photon.git

cd Photon



<h2 id="install-dependencies">Install dependencies</h2>

pip3 install -r requirements.txt



<h2 id="update-to-latest-version">Update to latest version</h2>

python3 photon.py --update



<h2 id="verify-installation">Verify installation</h2>

python3 photon.py --help

<h2 id="install-homebrew-if-not-installed">Install Homebrew (if not installed)</h2>

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"



<h2 id="install-python">Install Python</h2>

brew install python git



<h2 id="clone-and-setup">Clone and setup</h2>

git clone https://github.com/s0md3v/Photon.git

cd Photon

pip3 install -r requirements.txt

python3 photon.py --update



<h2 id="add-to-path-optional">Add to PATH (optional)</h2>

echo 'export PATH="$PWD:$PATH"' >> ~/.zshrc

<h2 id="install-python-3-8-from-python-org">Install Python 3.8+ from python.org</h2>

<h2 id="download-and-install-git-from-git-scm-com">Download and install Git from git-scm.com</h2>




<h2 id="open-command-prompt-or-powershell">Open Command Prompt or PowerShell</h2>

git clone https://github.com/s0md3v/Photon.git

cd Photon

pip install -r requirements.txt

python photon.py --update



<h2 id="verify">Verify</h2>

python photon.py --help

<h2 id="pull-latest-image">Pull latest image</h2>

docker pull s0md3v/photon



<h2 id="verify-installation">Verify installation</h2>

docker run --rm s0md3v/photon --help

FROM python:3.10-slim



<h2 id="install-system-dependencies">Install system dependencies</h2>

RUN apt-get update && apt-get install -y \

    git \

    curl \

    && rm -rf /var/lib/apt/lists/*



<h2 id="clone-photon">Clone Photon</h2>

RUN git clone https://github.com/s0md3v/Photon.git /opt/photon



<h2 id="install-python-dependencies">Install Python dependencies</h2>

WORKDIR /opt/photon

RUN pip install --no-cache-dir -r requirements.txt



<h2 id="create-volume-for-output">Create volume for output</h2>

VOLUME ["/output"]



<h2 id="set-entrypoint">Set entrypoint</h2>

ENTRYPOINT ["python3", "photon.py"]

CMD ["--help"]

<h2 id="build-custom-image">Build custom image</h2>

docker build -t photon-custom .



<h2 id="run-with-volume-mount">Run with volume mount</h2>

docker run -v $(pwd)/output:/output photon-custom -u https://example.com -o /output

<h2 id="update-kali">Update Kali</h2>

sudo apt update



<h2 id="install-photon">Install Photon</h2>

sudo apt install photon



<h2 id="verify">Verify</h2>

photon --help

<h2 id="standard-git-installation-works-perfectly-on-kali">Standard Git installation works perfectly on Kali</h2>

git clone https://github.com/s0md3v/Photon.git

cd Photon

pip3 install -r requirements.txt

python3 photon.py --update

<h2 id="requests-http-client">requests - HTTP client</h2>

pip3 install requests



<h2 id="tldextract-domain-parsing">tldextract - domain parsing</h2>

pip3 install tldextract



<h2 id="dnspython-dns-operations">dnspython - DNS operations</h2>

pip3 install dnspython



<h2 id="beautifulsoup4-html-parsing">beautifulsoup4 - HTML parsing</h2>

pip3 install beautifulsoup4



<h2 id="lxml-xml-processing">lxml - XML processing</h2>

pip3 install lxml

<h2 id="selenium-javascript-rendering">selenium - JavaScript rendering</h2>

pip3 install selenium



<h2 id="webdriver-manager-browser-automation">webdriver-manager - browser automation</h2>

pip3 install webdriver-manager



<h2 id="aiohttp-async-http-performance">aiohttp - async HTTP (performance)</h2>

pip3 install aiohttp

<h2 id="create-config-file">Create config file</h2>

cat > photon_config.json << EOF

{

    "threads": 8,

    "timeout": 10,

    "user_agent": "Photon/2026 (OSINT Research)",

    "delay": 0.1,

    "max_depth": 3

}

EOF

<h2 id="environment-variables">Environment variables</h2>

export PHOTON_THREADS=16

export PHOTON_TIMEOUT=15

export PHOTON_DELAY=0.05



<h2 id="system-optimization-linux">System optimization (Linux)</h2>

echo 'net.core.somaxconn=1024' >> /etc/sysctl.conf

echo 'net.ipv4.tcp_max_syn_backlog=2048' >> /etc/sysctl.conf

sysctl -p

<h2 id="use-proxy-for-all-requests">Use proxy for all requests</h2>

export HTTP_PROXY=http://proxy.company.com:8080

export HTTPS_PROXY=http://proxy.company.com:8080



<h2 id="certificate-verification">Certificate verification</h2>

export PHOTON_VERIFY_SSL=true

<h2 id="check-python-version">Check Python version</h2>

python3 --version



<h2 id="upgrade-if-needed">Upgrade if needed</h2>

sudo apt install python3.10

<h2 id="fix-permissions">Fix permissions</h2>

chmod +x photon.py



<h2 id="run-with-sudo-if-needed-for-network-access">Run with sudo if needed for network access</h2>

sudo python3 photon.py -u https://example.com

<h2 id="install-all-requirements">Install all requirements</h2>

pip3 install --upgrade pip

pip3 install -r requirements.txt --force-reinstall

<h2 id="use-https-instead-of-ssh">Use HTTPS instead of SSH</h2>

git clone https://github.com/s0md3v/Photon.git



<h2 id="or-use-proxy">Or use proxy</h2>

git config --global http.proxy http://proxy.company.com:8080

<h2 id="check-docker-installation">Check Docker installation</h2>

docker --version



<h2 id="pull-image-manually">Pull image manually</h2>

docker pull python:3.10-slim

docker build -t photon-custom .

<h2 id="run-help-command">Run help command</h2>

python3 photon.py --help



<h2 id="test-basic-functionality">Test basic functionality</h2>

python3 photon.py -u https://httpbin.org -l 1



<h2 id="check-output">Check output</h2>

ls -la httpbin.org/

<h2 id="test-all-major-features">Test all major features</h2>

python3 photon.py -u https://example.com --keys --dns --wayback --clone -t 4



<h2 id="verify-output-files">Verify output files</h2>

find example.com/ -type f -exec wc -l {} \;

<h2 id="time-a-crawl">Time a crawl</h2>

time python3 photon.py -u https://example.com -l 2 -t 8



<h2 id="check-resource-usage">Check resource usage</h2>

top -p $(pgrep -f photon.py)

python3 photon.py [options] -u URL

<h2 id="show-all-options">Show all options</h2>

python3 photon.py --help



<h2 id="show-examples">Show examples</h2>

python3 photon.py --examples



<h2 id="show-version">Show version</h2>

python3 photon.py --version

<h2 id="basic-crawling">Basic crawling</h2>

python3 photon.py -u https://example.com



<h2 id="output-example-com-folder-with-results">Output: example.com/ folder with results</h2>

<h2 id="detailed-output">Detailed output</h2>

python3 photon.py -u https://example.com -v



<h2 id="shows-progress-found-urls-etc">Shows progress, found URLs, etc.</h2>

<h2 id="crawl-3-levels-deep">Crawl 3 levels deep</h2>

python3 photon.py -u https://example.com -l 3

.com/

├── urls.txt         # All discovered URLs

├── urls.csv         # CSV format

├── files.txt        # File references

├── intel.txt        # Intelligence summary

├── report.html      # HTML report

└── logs/

    └── crawl.log    # Detailed logs

://example.com/

https://example.com/about

https://example.com/contact

https://example.com/products

https://example.com/api/v1/users

https://example.com/admin/login

Report for example.com

===================================



Total URLs: 247

Total Files: 89

Total Emails: 3

Total Keys: 2

Total Subdomains: 5



Potential Vulnerabilities:

- Admin panel found: /admin/

- API endpoints: /api/v1/

- Debug mode: ?debug=1



Extracted Data:

Emails: admin@example.com, support@example.com

Keys: aws_key_123, api_token_456

<h2 id="define-target-and-scope">Define target and scope</h2>

TARGET="https://example.com"

DEPTH=3

THREADS=8



<h2 id="create-output-directory">Create output directory</h2>

mkdir -p reconnaissance/$(date +%Y%m%d)

<h2 id="basic-reconnaissance">Basic reconnaissance</h2>

python3 photon.py -u $TARGET -l $DEPTH -t $THREADS -o reconnaissance/$(date +%Y%m%d)/basic

<h2 id="check-findings">Check findings</h2>

cat reconnaissance/$(date +%Y%m%d)/basic/example.com/intel.txt

head reconnaissance/$(date +%Y%m%d)/basic/example.com/urls.txt

<h2 id="add-advanced-features">Add advanced features</h2>

python3 photon.py -u $TARGET --keys --dns --wayback -o reconnaissance/$(date +%Y%m%d)/advanced

<h2 id="handle-timeouts">Handle timeouts</h2>

python3 photon.py -u https://slowsite.com --timeout 30



<h2 id="retry-failed-requests">Retry failed requests</h2>

python3 photon.py -u https://unreliable.com --delay 1

<h2 id="create-output-directory-first">Create output directory first</h2>

mkdir -p /path/to/output

python3 photon.py -u https://example.com -o /path/to/output

<h2 id="reduce-threads-for-low-power-systems">Reduce threads for low-power systems</h2>

python3 photon.py -u https://example.com -t 2



<h2 id="add-delays-to-avoid-rate-limiting">Add delays to avoid rate limiting</h2>

python3 photon.py -u https://example.com --delay 0.5

<h2 id="verbose-logging">Verbose logging</h2>

python3 photon.py -u https://example.com -v > crawl.log 2>&1



<h2 id="monitor-progress">Monitor progress</h2>

tail -f crawl.log

<h2 id="run-in-background-with-progress">Run in background with progress</h2>

python3 photon.py -u https://example.com &

PID=$!



<h2 id="monitor">Monitor</h2>

watch -n 1 "ps -p $PID -o pid,ppid,cmd,pcpu,pmem"



<h2 id="kill-if-needed">Kill if needed</h2>

kill $PID

<h2 id="begin-with-simple-targets">Begin with simple targets</h2>

python3 photon.py -u https://httpbin.org -l 1



<h2 id="understand-output-before-complex-scans">Understand output before complex scans</h2>

python3 photon.py -u https://example.com -l 1 -t 1

<h2 id="respect-robots-txt">Respect robots.txt</h2>

<h2 id="add-delays-between-requests">Add delays between requests</h2>

python3 photon.py -u https://example.com --delay 1



<h2 id="check-terms-of-service">Check terms of service</h2>

<h2 id="use-appropriate-user-agent">Use appropriate user agent</h2>

<h2 id="monitor-system-resources">Monitor system resources</h2>

python3 photon.py -u https://example.com &

htop  # or top



<h2 id="clean-up-after-scanning">Clean up after scanning</h2>

rm -rf example.com/

python3 photon.py -u https://example.com

python3 photon.py -u https://example.com -l 3

python3 photon.py -u https://example.com -t 8

python3 photon.py -u https://example.com -v

python3 photon.py -u https://example.com -q

python3 photon.py -u https://example.com -o /custom/path

python3 photon.py -u https://example.com --overwrite

echo "https://example.com" > urls.txt

python3 photon.py --file urls.txt

echo "https://example.com" | python3 photon.py --stdin

python3 photon.py --update

python3 photon.py -u https://example.com --keys

python3 photon.py -u https://example.com --dns

python3 photon.py -u https://example.com --wayback

python3 photon.py -u https://example.com --clone

python3 photon.py -u https://example.com --regex "password|token|key"

python3 photon.py -u https://example.com --emails

python3 photon.py -u https://example.com --social

python3 photon.py -u https://example.com --scripts

python3 photon.py -u https://example.com --css

python3 photon.py -u https://example.com --images

python3 photon.py -u https://example.com --ninja

python3 photon.py -u https://example.com --exclude google.com,facebook.com

python3 photon.py -u https://example.com --only-urls

python3 photon.py -u https://example.com --user-agent "Custom Bot/1.0"

python3 photon.py -u https://example.com --cookie "session=abc123"

python3 photon.py -u https://example.com --headers "X-API-Key: secret"

python3 photon.py -u https://example.com --proxy http://proxy:8080

python3 photon.py -u https://example.com --timeout 15

python3 photon.py -u https://example.com --delay 0.5

python3 photon.py -u https://example.com --max-requests 1000

python3 photon.py -u https://example.com --csv

python3 photon.py -u https://example.com --json

python3 photon.py -u https://example.com --xml

python3 photon.py -u https://example.com --html

python3 photon.py -u https://example.com --sqlite

python3 photon.py -u https://example.com --elasticsearch

python3 photon.py -u https://example.com --format custom

python3 photon.py -u https://example.com --compress

python3 photon.py -u https://example.com --split 1000

python3 photon.py -u https://example.com --incremental

python3 photon.py -u https://api.example.com --api-discovery

python3 photon.py -u https://example.com --vulns

python3 photon.py -u https://example.com --content-analysis

python3 photon.py -u https://example.com --link-analysis

python3 photon.py -u https://example.com --metadata

python3 photon.py -u https://example.com --archive

python3 photon.py -u https://onion.site --tor

python3 photon.py -u https://example.com --cloud-assets

python3 photon.py -u http://iot-device.local --iot

python3 photon.py -u https://example.com --compliance gdpr

python3 photon.py -u https://example.com -l 3 -t 8 --keys --dns --wayback --clone --emails --social

python3 photon.py -u https://example.com --ninja --delay 2 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

python3 photon.py -u https://api.example.com --only-urls --regex "api|endpoint|service" --json

python3 photon.py -u https://example.com --clone --metadata --content-analysis --vulns

python3 photon.py -u https://target.com --keys --emails --social --wayback --dns --cloud-assets

<h2 id="basic-domain-information">Basic domain information</h2>

python3 photon.py -u https://target-corp.com --dns -v

<h2 id="comprehensive-web-crawling">Comprehensive web crawling</h2>

python3 photon.py -u https://target-corp.com -l 3 -t 8 --keys --emails --social --wayback

<h2 id="focus-on-api-endpoints">Focus on API endpoints</h2>

python3 photon.py -u https://api.target-corp.com --only-urls --regex "api|v[0-9]|endpoint" --json

<h2 id="look-for-potential-vulnerabilities">Look for potential vulnerabilities</h2>

python3 photon.py -u https://target-corp.com --regex "admin|login|test|debug|backup" --clone

<h2 id="correlate-with-external-sources">Correlate with external sources</h2>

python3 photon.py -u https://target-corp.com --social --wayback

<h2 id="cross-reference-with-linkedin-github-etc">Cross-reference with LinkedIn, GitHub, etc.</h2>

<h2 id="map-complete-site-structure">Map complete site structure</h2>

python3 photon.py -u https://compromised-site.com --clone --dns --wayback -l 4

<h2 id="search-for-exposed-data">Search for exposed data</h2>

python3 photon.py -u https://compromised-site.com --regex "password|ssn|credit|database" --keys

<h2 id="look-for-user-data-leaks">Look for user data leaks</h2>

python3 photon.py -u https://compromised-site.com --emails --social --metadata

<h2 id="search-for-malware-signs">Search for malware signs</h2>

python3 photon.py -u https://compromised-site.com --regex "eval|base64|obfuscate|shell" --scripts

<h2 id="check-integrations-that-might-be-compromised">Check integrations that might be compromised</h2>

python3 photon.py -u https://compromised-site.com --regex "api\.|webhook|oauth|jwt" --headers

<h2 id="map-all-associated-domains">Map all associated domains</h2>

python3 photon.py -u https://crime-site.onion --dns --wayback --social --tor

<h2 id="look-for-payment-integrations">Look for payment integrations</h2>

python3 photon.py -u https://crime-site.onion --regex "bitcoin|crypto|paypal|stripe|payment" --keys

<h2 id="find-communication-methods">Find communication methods</h2>

python3 photon.py -u https://crime-site.onion --emails --social --regex "telegram|discord|irc|jabber"

<h2 id="look-for-opsec-failures">Look for OPSEC failures</h2>

python3 photon.py -u https://crime-site.onion --metadata --headers --scripts

<h2 id="document-victim-data-exposure">Document victim data exposure</h2>

python3 photon.py -u https://crime-site.onion --regex "victim|data|breach|leak" --clone

<h2 id="analyze-tech-stack">Analyze tech stack</h2>

python3 photon.py -u https://competitor.com --scripts --css --headers --metadata

<h2 id="map-content-structure">Map content structure</h2>

python3 photon.py -u https://competitor.com --images --social --wayback -l 3

<h2 id="find-data-apis">Find data APIs</h2>

python3 photon.py -u https://competitor.com --regex "api|json|graphql|rest" --keys

<h2 id="identify-partners-and-vendors">Identify partners and vendors</h2>

python3 photon.py -u https://competitor.com --dns --social --regex "partner|vendor|supplier"

<h2 id="track-company-evolution">Track company evolution</h2>

python3 photon.py -u https://competitor.com --wayback --archive --social

<h2 id="map-iot-device-network">Map IoT device network</h2>

python3 photon.py -u http://smart-home.local --dns --iot --headers

<h2 id="analyze-device-apis">Analyze device APIs</h2>

python3 photon.py -u http://smart-hub.local --regex "api|endpoint|device" --keys --json

<h2 id="look-for-firmware-updates-and-downloads">Look for firmware updates and downloads</h2>

python3 photon.py -u https://iot-manufacturer.com --regex "firmware|update|download" --clone

<h2 id="analyze-cloud-connectivity">Analyze cloud connectivity</h2>

python3 photon.py -u https://iot-cloud.com --regex "device|telemetry|sensor" --wayback

<h2 id="look-for-security-issues">Look for security issues</h2>

python3 photon.py -u http://iot-device.local --regex "admin|root|debug|test" --scripts --vulns

python3 photon.py -u https://target.com --ninja

<h2 id="custom-proxy-list">Custom proxy list</h2>

python3 photon.py -u https://target.com --ninja --proxy-list proxies.txt



<h2 id="multiple-proxy-rotation">Multiple proxy rotation</h2>

python3 photon.py -u https://target.com --ninja --proxy-rotate 10



<h2 id="tor-integration">Tor integration</h2>

python3 photon.py -u https://target.com --ninja --tor

python3 photon.py -u https://target.com --wayback

<h2 id="specific-time-range">Specific time range</h2>

python3 photon.py -u https://target.com --wayback --start-date 2020-01-01 --end-date 2024-01-01



<h2 id="only-recent-changes">Only recent changes</h2>

python3 photon.py -u https://target.com --wayback --last-month



<h2 id="compare-versions">Compare versions</h2>

python3 photon.py -u https://target.com --wayback --compare-versions

python3 photon.py -u https://target.com --clone

<h2 id="custom-clone-directory">Custom clone directory</h2>

python3 photon.py -u https://target.com --clone --clone-dir /custom/path



<h2 id="selective-cloning">Selective cloning</h2>

python3 photon.py -u https://target.com --clone --clone-only "important-page"



<h2 id="clone-with-assets">Clone with assets</h2>

python3 photon.py -u https://target.com --clone --clone-assets



<h2 id="clone-with-javascript">Clone with JavaScript</h2>

python3 photon.py -u https://target.com --clone --clone-js

python3 photon.py -u https://target.com --regex "password|token|key"

<h2 id="email-patterns">Email patterns</h2>

python3 photon.py -u https://target.com --regex "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b"



<h2 id="api-keys">API keys</h2>

python3 photon.py -u https://target.com --regex "api[_-]?key|apikey|access[_-]?token"



<h2 id="aws-credentials">AWS credentials</h2>

python3 photon.py -u https://target.com --regex "AKIA[0-9A-Z]{16}"



<h2 id="database-connections">Database connections</h2>

python3 photon.py -u https://target.com --regex "mysql://|postgresql://|mongodb://"



<h2 id="private-keys">Private keys</h2>

python3 photon.py -u https://target.com --regex "--BEGIN.*PRIVATE KEY--"

<h2 id="create-regex-file">Create regex file</h2>

cat > custom_patterns.txt << EOF

password|passwd|pwd

token|auth|bearer

key|secret|credential

aws_|azure_|gcp_

EOF



python3 photon.py -u https://target.com --regex-file custom_patterns.txt

python3 photon.py -u https://target.com --ninja --wayback --clone --regex "breach|leak|exposed" --delay 3

python3 photon.py -u https://target.com -l 4 -t 4 --keys --dns --wayback --clone --emails --social --regex "intel|secret|internal"

<h2 id="create-monitoring-script">Create monitoring script</h2>

cat > monitor.sh << 'EOF'

#!/bin/bash

TARGET=$1

OUTPUT_DIR="./monitoring/$(date +%Y%m%d)"



mkdir -p "$OUTPUT_DIR"



<h2 id="daily-comprehensive-scan">Daily comprehensive scan</h2>

python3 photon.py -u "$TARGET" --ninja --wayback --keys --dns -o "$OUTPUT_DIR/daily"



<h2 id="weekly-deep-clone">Weekly deep clone</h2>

if [ $(date +%u) -eq 7 ]; then

    python3 photon.py -u "$TARGET" --clone -o "$OUTPUT_DIR/weekly"

fi



<h2 id="alert-on-new-findings">Alert on new findings</h2>

python3 compare_results.py "$OUTPUT_DIR/daily" "$OUTPUT_DIR/previous" > changes.txt

if [ -s changes.txt ]; then

    mail -s "New Intelligence Findings" analyst@company.com < changes.txt

fi

EOF



chmod +x monitor.sh

./monitor.sh https://target.com

<h2 id="multi-target-scanning">Multi-target scanning</h2>

cat targets.txt | parallel --no-notice 'python3 photon.py -u {} --ninja --keys --dns -o results/{}'



<h2 id="results-aggregation">Results aggregation</h2>

python3 aggregate_results.py results/ > comprehensive_report.html



<h2 id="automated-alerting">Automated alerting</h2>

python3 check_alerts.py comprehensive_report.html | mail -s "OSINT Alert" security@company.com

#!/bin/bash

TARGET_URL=$1

OUTPUT_BASE="/opt/photon/results/$(date +%Y%m%d_%H%M%S)"

LOG_FILE="/var/log/photon_scans.log"



<h2 id="validate-input">Validate input</h2>

if [ -z "$TARGET_URL" ]; then

    echo "Usage: $0 <target_url>"

    exit 1

fi



<h2 id="create-output-directory">Create output directory</h2>

mkdir -p "$OUTPUT_BASE"



<h2 id="log-start">Log start</h2>

echo "$(date): Starting Photon scan of $TARGET_URL" >> "$LOG_FILE"



<h2 id="run-basic-scan">Run basic scan</h2>

python3 photon.py -u "$TARGET_URL" -o "$OUTPUT_BASE/basic" -v >> "$LOG_FILE" 2>&1



<h2 id="check-for-keys">Check for keys</h2>

if [ -f "$OUTPUT_BASE/basic/${TARGET_URL#https://}/keys.txt" ]; then

    KEY_COUNT=$(wc -l < "$OUTPUT_BASE/basic/${TARGET_URL#https://}/keys.txt")

    echo "Found $KEY_COUNT potential keys" >> "$LOG_FILE"

fi



<h2 id="run-advanced-scan">Run advanced scan</h2>

python3 photon.py -u "$TARGET_URL" --keys --dns --wayback -o "$OUTPUT_BASE/advanced" >> "$LOG_FILE" 2>&1



<h2 id="generate-report">Generate report</h2>

python3 generate_report.py "$OUTPUT_BASE" > "$OUTPUT_BASE/report.html"



<h2 id="cleanup-old-scans-keep-last-30-days">Cleanup old scans (keep last 30 days)</h2>

find /opt/photon/results -type d -mtime +30 -exec rm -rf {} +



echo "$(date): Photon scan completed for $TARGET_URL" >> "$LOG_FILE"

#!/bin/bash

TARGET_LIST="targets.txt"

THREADS=4

OUTPUT_BASE="/opt/photon/batch_$(date +%Y%m%d)"



mkdir -p "$OUTPUT_BASE"



<h2 id="process-targets-in-parallel">Process targets in parallel</h2>

cat "$TARGET_LIST" | xargs -n 1 -P "$THREADS" -I {} bash -c '

    TARGET="$1"

    OUTPUT_DIR="'"$OUTPUT_BASE"'/${TARGET#https://}"

    

    echo "Scanning $TARGET..."

    python3 photon.py -u "$TARGET" --keys --dns --wayback -o "$OUTPUT_DIR" -q

    

    if [ -d "$OUTPUT_DIR" ]; then

        echo "✓ $TARGET completed"

    else

        echo "✗ $TARGET failed"

    fi

' _ {}



<h2 id="aggregate-results">Aggregate results</h2>

python3 aggregate_batch_results.py "$OUTPUT_BASE" > "$OUTPUT_BASE/batch_report.html"



echo "Batch processing completed. Results in $OUTPUT_BASE"

import subprocess

import json

import os

from pathlib import Path

from typing import Dict, List, Optional

import logging



logging.basicConfig(level=logging.INFO)

logger = logging.getLogger(__name__)



class PhotonScanner:

    def __init__(self, photon_path: str = "python3 photon.py"):

        self.photon_path = photon_path

        

    def scan_target(self, url: str, output_dir: str, options) -> Dict:

        """Perform Photon scan with custom options"""

        

        cmd = [self.photon_path, "-u", url, "-o", output_dir]

        

        # Add options

        if options.get("keys"):

            cmd.append("--keys")

        if options.get("dns"):

            cmd.append("--dns")

        if options.get("wayback"):

            cmd.append("--wayback")

        if options.get("clone"):

            cmd.append("--clone")

        if options.get("ninja"):

            cmd.append("--ninja")

        if options.get("threads"):

            cmd.extend(["-t", str(options["threads"])])

        if options.get("depth"):

            cmd.extend(["-l", str(options["depth"])])

        if options.get("regex"):

            cmd.extend(["--regex", options["regex"]])

            

        # Execute scan

        logger.info(f"Starting scan: {' '.join(cmd)}")

        result = subprocess.run(cmd, capture_output=True, text=True)

        

        return {

            "success": result.returncode == 0,

            "stdout": result.stdout,

            "stderr": result.stderr,

            "output_dir": output_dir

        }

    

    def parse_results(self, output_dir: str) -> Dict:

        """Parse Photon output files"""

        

        domain_dir = None

        for item in os.listdir(output_dir):

            if os.path.isdir(os.path.join(output_dir, item)):

                domain_dir = os.path.join(output_dir, item)

                break

        

        if not domain_dir:

            return {}

            

        results = {}

        

        # Parse URLs

        urls_file = os.path.join(domain_dir, "urls.txt")

        if os.path.exists(urls_file):

            with open(urls_file, 'r') as f:

                results["urls"] = [line.strip() for line in f if line.strip()]

        

        # Parse keys

        keys_file = os.path.join(domain_dir, "keys.txt")

        if os.path.exists(keys_file):

            with open(keys_file, 'r') as f:

                results["keys"] = [line.strip() for line in f if line.strip()]

        

        # Parse intel

        intel_file = os.path.join(domain_dir, "intel.txt")

        if os.path.exists(intel_file):

            with open(intel_file, 'r') as f:

                results["intel"] = f.read()

        

        return results

    

    def batch_scan(self, urls: List[str], base_output_dir: str, options) -> Dict[str, Dict]:

        """Scan multiple targets"""

        

        results = {}

        base_path = Path(base_output_dir)

        

        for url in urls:

            domain = url.replace("https://", "").replace("http://", "").split("/")[0]

            output_dir = str(base_path / domain)

            

            scan_result = self.scan_target(url, output_dir, options)

            parsed_results = self.parse_results(output_dir)

            

            results[url] = {

                "scan": scan_result,

                "parsed": parsed_results

            }

            

            logger.info(f"Completed scan of {url}")

        

        return results



<h2 id="usage-example">Usage example</h2>

scanner = PhotonScanner()



<h2 id="single-target-scan">Single target scan</h2>

result = scanner.scan_target(

    "https://example.com",

    "/tmp/photon_results",

    keys=True, dns=True, wayback=True, threads=4

)



<h2 id="batch-scan">Batch scan</h2>

urls = ["https://site1.com", "https://site2.com", "https://site3.com"]

batch_results = scanner.batch_scan(

    urls, "/tmp/batch_results",

    keys=True, ninja=True, depth=3

)

import json

import re

from collections import defaultdict

from pathlib import Path



def analyze_photon_results(results_dir: str) -> Dict:

    """Analyze Photon scan results for insights"""

    

    analysis = {

        "summary": {},

        "security_findings": [],

        "intelligence": {},

        "recommendations": []

    }

    

    results_path = Path(results_dir)

    

    # Process each domain

    for domain_dir in results_path.iterdir():

        if not domain_dir.is_dir():

            continue

            

        domain_name = domain_dir.name

        

        # Analyze URLs

        urls_file = domain_dir / "urls.txt"

        if urls_file.exists():

            with open(urls_file, 'r') as f:

                urls = [line.strip() for line in f if line.strip()]

                

            analysis["summary"][f"{domain_name}_urls"] = len(urls)

            

            # Check for sensitive URLs

            sensitive_patterns = [

                r"admin|login|auth|password|config|backup|test|debug",

                r"\.env|\.git|phpinfo|server-status",

                r"api.*key|secret|token|credential"

            ]

            

            for url in urls:

                for pattern in sensitive_patterns:

                    if re.search(pattern, url, re.IGNORECASE):

                        analysis["security_findings"].append({

                            "type": "sensitive_url",

                            "domain": domain_name,

                            "url": url,

                            "pattern": pattern

                        })

        

        # Analyze keys

        keys_file = domain_dir / "keys.txt"

        if keys_file.exists():

            with open(keys_file, 'r') as f:

                keys = [line.strip() for line in f if line.strip()]

                

            analysis["summary"][f"{domain_name}_keys"] = len(keys)

            

            # Classify keys

            aws_keys = [k for k in keys if "AKIA" in k]

            api_keys = [k for k in keys if any(x in k.lower() for x in ["api", "key", "token"])]

            

            analysis["intelligence"][f"{domain_name}_aws_keys"] = aws_keys

            analysis["intelligence"][f"{domain_name}_api_keys"] = api_keys

        

        # Generate recommendations

        if analysis["summary"].get(f"{domain_name}_keys", 0) > 0:

            analysis["recommendations"].append(f"Review {analysis['summary'][f'{domain_name}_keys']} exposed keys for {domain_name}")

        

        if len(analysis["security_findings"]) > 0:

            analysis["recommendations"].append(f"Investigate {len([f for f in analysis['security_findings'] if f['domain'] == domain_name])} security findings for {domain_name}")

    

    return analysis



<h2 id="usage">Usage</h2>

analysis = analyze_photon_results("/tmp/photon_results")

print(json.dumps(analysis, indent=2))

<h2 id="etc-cron-daily-photon-daily-scan">/etc/cron.daily/photon-daily-scan</h2>

#!/bin/bash



TARGET_FILE="/etc/photon/targets.txt"

OUTPUT_BASE="/var/photon/scans/$(date +%Y%m%d)"

LOG_FILE="/var/log/photon/daily_scan.log"



mkdir -p "$OUTPUT_BASE"



<h2 id="read-targets">Read targets</h2>

while IFS= read -r target; do

    if [[ -n "$target" && ! "$target" =~ ^# ]]; then

        domain=$(echo "$target" | sed 's|https*://||' | cut -d'/' -f1)

        output_dir="$OUTPUT_BASE/$domain"

        

        echo "$(date): Scanning $target" >> "$LOG_FILE"

        

        # Run scan with error handling

        if python3 photon.py -u "$target" --keys --dns --wayback -o "$output_dir" -q 2>>"$LOG_FILE"; then

            echo "$(date): ✓ Completed $target" >> "$LOG_FILE"

        else

            echo "$(date): ✗ Failed $target" >> "$LOG_FILE"

        fi

    fi

done < "$TARGET_FILE"



<h2 id="generate-daily-report">Generate daily report</h2>

python3 /usr/local/bin/photon_daily_report.py "$OUTPUT_BASE" > "$OUTPUT_BASE/daily_report.html"



<h2 id="email-report">Email report</h2>

mail -s "Photon Daily Scan Report $(date +%Y%m%d)" security@company.com < "$OUTPUT_BASE/daily_report.html"



<h2 id="cleanup-keep-30-days">Cleanup (keep 30 days)</h2>

find /var/photon/scans -type d -mtime +30 -exec rm -rf {} +

<h2 id="etc-cron-weekly-photon-weekly-deep">/etc/cron.weekly/photon-weekly-deep</h2>

#!/bin/bash



TARGET_FILE="/etc/photon/weekly_targets.txt"

OUTPUT_DIR="/var/photon/weekly/$(date +%Y%m%d)"

LOG_FILE="/var/log/photon/weekly_scan.log"



mkdir -p "$OUTPUT_DIR"



<h2 id="deep-scan-with-all-features">Deep scan with all features</h2>

for target in $(grep -v '^#' "$TARGET_FILE"); do

    domain=$(echo "$target" | sed 's|https*://||' | cut -d'/' -f1)

    

    echo "$(date): Deep scanning $target" >> "$LOG_FILE"

    

    python3 photon.py -u "$target" -l 4 -t 8 --keys --dns --wayback --clone --ninja \

        --regex "password|token|key|secret|credential" \

        -o "$OUTPUT_DIR/$domain" >> "$LOG_FILE" 2>&1 &

    

    # Limit concurrent scans

    while [ $(jobs -r | wc -l) -ge 3 ]; do

        sleep 10

    done

done



wait



<h2 id="generate-comprehensive-report">Generate comprehensive report</h2>

python3 /usr/local/bin/photon_weekly_report.py "$OUTPUT_DIR" > "$OUTPUT_DIR/weekly_report.html"



<h2 id="archive-results">Archive results</h2>

tar -czf "$OUTPUT_DIR.tar.gz" "$OUTPUT_DIR"

<h2 id="usr-local-nagios-libexec-check-photon-scan">/usr/local/nagios/libexec/check_photon_scan</h2>

#!/bin/bash



TARGET=$1

WARNING=$2

CRITICAL=$3



if [ -z "$TARGET" ]; then

    echo "UNKNOWN: No target specified"

    exit 3

fi



<h2 id="run-quick-scan">Run quick scan</h2>

OUTPUT_DIR=$(mktemp -d)

SCAN_START=$(date +%s)



python3 photon.py -u "$TARGET" -l 2 -t 2 -o "$OUTPUT_DIR" -q --timeout 30



SCAN_END=$(date +%s)

SCAN_TIME=$((SCAN_END - SCAN_START))



<h2 id="check-results">Check results</h2>

URL_COUNT=$(find "$OUTPUT_DIR" -name "urls.txt" -exec wc -l {} \; 2>/dev/null | awk '{sum += $1} END {print sum+0}')



if [ "$SCAN_TIME" -gt "$CRITICAL" ]; then

    echo "CRITICAL: Photon scan took ${SCAN_TIME}s (> ${CRITICAL}s)"

    exit 2

elif [ "$SCAN_TIME" -gt "$WARNING" ]; then

    echo "WARNING: Photon scan took ${SCAN_TIME}s (> ${WARNING}s)"

    exit 1

else

    echo "OK: Photon scan completed in ${SCAN_TIME}s, found ${URL_COUNT} URLs"

    exit 0

fi



<h2 id="cleanup">Cleanup</h2>

rm -rf "$OUTPUT_DIR"

from prometheus_client import start_http_server, Gauge

import time

import subprocess



<h2 id="metrics">Metrics</h2>

photon_scan_duration = Gauge('photon_scan_duration_seconds', 'Time taken for Photon scan', ['target'])

photon_urls_found = Gauge('photon_urls_found', 'Number of URLs found', ['target'])

photon_keys_found = Gauge('photon_keys_found', 'Number of keys found', ['target'])



def run_scan(target):

    start_time = time.time()

    

    # Run scan

    result = subprocess.run([

        'python3', 'photon.py', '-u', target, 

        '--keys', '--dns', '-o', '/tmp/photon_metrics'

    ], capture_output=True)

    

    duration = time.time() - start_time

    

    # Parse results (simplified)

    urls_count = 100  # Parse actual results

    keys_count = 5    # Parse actual results

    

    # Update metrics

    photon_scan_duration.labels(target=target).set(duration)

    photon_urls_found.labels(target=target).set(urls_count)

    photon_keys_found.labels(target=target).set(keys_count)



if __name__ == '__main__':

    start_http_server(8000)

    

    while True:

        run_scan('https://example.com')

        time.sleep(300)  # Scan every 5 minutes

<h2 id="export-photon-results-for-maltego">Export Photon results for Maltego</h2>

python3 photon.py -u https://target.com --keys --emails --social --json



<h2 id="maltego-transform">Maltego transform</h2>

<h2 id="create-custom-transform-to-import-photon-json">Create custom transform to import Photon JSON</h2>

<h2 id="map-entities-urls-emails-social-profiles-keys">Map entities: URLs, emails, social profiles, keys</h2>

<h2 id="import-photon-results-into-recon-ng">Import Photon results into Recon-ng</h2>

python3 photon.py -u https://target.com --dns --emails -o recon_import



<h2 id="in-recon-ng">In Recon-ng</h2>

recon-ng

marketplace install all

workspaces create photon_import

db insert domains

<h2 id="import-from-photon-output">Import from Photon output</h2>

<h2 id="photon-as-spiderfoot-module">Photon as SpiderFoot module</h2>

python3 photon.py -u https://target.com --keys --dns --json



<h2 id="spiderfoot-correlation">SpiderFoot correlation</h2>

<h2 id="import-photon-json-as-seed-data">Import Photon JSON as seed data</h2>

<h2 id="run-correlation-modules">Run correlation modules</h2>

import pymisp

import json



def upload_photon_to_misp(photon_results_file, misp_url, misp_key):

    misp = pymisp.PyMISP(misp_url, misp_key, False)

    

    with open(photon_results_file, 'r') as f:

        results = json.load(f)

    

    # Create event

    event = pymisp.MISPEvent()

    event.info = f"Photon OSINT Results for {results.get('domain', 'unknown')}"

    

    # Add URLs as attributes

    for url in results.get('urls', []):

        attr = pymisp.MISPAttribute()

        attr.type = 'url'

        attr.value = url

        event.add_attribute(attr)

    

    # Add keys as attributes

    for key in results.get('keys', []):

        attr = pymisp.MISPAttribute()

        attr.type = 'comment'

        attr.value = f"Potential key: {key}"

        attr.category = 'External analysis'

        event.add_attribute(attr)

    

    # Upload event

    misp.add_event(event)

    return event.uuid



<h2 id="usage">Usage</h2>

upload_photon_to_misp('photon_results.json', 'https://misp.example.com', 'misp_api_key')

<?xml version="1.0" encoding="utf-8"?>

<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="photon-generated-ioc" last-modified="2026-01-15T10:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">

  <short_description>Photon OSINT Findings</short_description>

  <description>Automatically generated IOCs from Photon scan</description>

  <definition>

    <Indicator operator="OR">

      <IndicatorItem condition="contains" id="photon-urls">

        <Context document="URL" search="URL" type="mir" />

        <Content type="string">https://target.com/admin</Content>

      </IndicatorItem>

      <IndicatorItem condition="contains" id="photon-keys">

        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />

        <Content type="md5">API_KEY_FOUND_IN_SCAN</Content>

      </IndicatorItem>

    </Indicator>

  </definition>

</ioc>

<h2 id="photon-results-to-splunk">Photon results to Splunk</h2>

python3 photon.py -u https://target.com --json --keys --emails



<h2 id="send-to-splunk-http-event-collector">Send to Splunk HTTP Event Collector</h2>

curl -k "https://splunk-server:8088/services/collector" \

  -H "Authorization: Splunk $HEC_TOKEN" \

  -d '{"event": "'$(cat photon_results.json)'", "sourcetype": "photon-osint"}'



<h2 id="splunk-search-queries">Splunk search queries</h2>

index=photon-osint sourcetype="photon-osint" | spath | search keys{}="AKIA*"

index=photon-osint sourcetype="photon-osint" | spath | search emails{}="*@target.com"

<h2 id="photon-to-elasticsearch">Photon to Elasticsearch</h2>

python3 photon.py -u https://target.com --json -o photon_output



<h2 id="logstash-configuration">Logstash configuration</h2>

input {

  file {

    path => "/opt/photon/output/*/photon_results.json"

    start_position => "beginning"

    sincedb_path => "/dev/null"

  }

}



filter {

  json {

    source => "message"

  }

}



output {

  elasticsearch {

    hosts => ["localhost:9200"]

    index => "photon-osint-%{+YYYY.MM.dd}"

  }

}



<h2 id="kibana-dashboard-creation">Kibana dashboard creation</h2>

<h2 id="visualize-urls-by-domain-keys-by-type-emails-by-domain">Visualize URLs by domain, keys by type, emails by domain</h2>

<h2 id="custom-dsm-for-photon-logs">Custom DSM for Photon logs</h2>

python3 photon.py -u https://target.com -v > photon_scan.log



<h2 id="send-to-qradar">Send to QRadar</h2>

rsyslog -f photon_scan.log -t qradar-server:514



<h2 id="qradar-parsing-rules">QRadar parsing rules</h2>

<h2 id="extract-urls-regex-found-url-url-http">Extract URLs: regex &quot;Found URL: (?&lt;url&gt;http.*)&quot;</h2>

<h2 id="extract-keys-regex-found-key-key">Extract keys: regex &quot;Found key: (?&lt;key&gt;.*)&quot;</h2>

<h2 id="extract-emails-regex-found-email-email">Extract emails: regex &quot;Found email: (?&lt;email&gt;.*@.*)&quot;</h2>

<h2 id="photon-to-burp">Photon to Burp</h2>

python3 photon.py -u https://target.com --only-urls > burp_targets.txt



<h2 id="burp-suite-crawler-seed">Burp Suite crawler seed</h2>

<h2 id="import-burp-targets-txt-as-site-map">Import burp_targets.txt as site map</h2>

<h2 id="configure-crawling-scope">Configure crawling scope</h2>

<h2 id="run-active-scanning">Run active scanning</h2>

<h2 id="photon-urls-as-zap-context">Photon URLs as ZAP context</h2>

python3 photon.py -u https://target.com --json



<h2 id="zap-api-import">ZAP API import</h2>

curl "http://localhost:8080/JSON/context/action/includeInContext/" \

  -d "contextName=photon_targets" \

  -d "regex=$(jq -r '.urls[]' photon_results.json | tr '\n' '|')"



<h2 id="run-zap-spider">Run ZAP spider</h2>

curl "http://localhost:8080/JSON/spider/action/scan/" \

  -d "url=https://target.com" \

  -d "contextName=photon_targets"

<h2 id="photon-for-target-discovery">Photon for target discovery</h2>

python3 photon.py -u https://target.com --dns --keys



<h2 id="metasploit-database-import">Metasploit database import</h2>

msfconsole

db_import photon_results.xml

hosts

services

import boto3

import subprocess

import json

import os



def lambda_handler(event, context):

    target_url = event['target_url']

    

    # Run Photon scan

    result = subprocess.run([

        'python3', 'photon.py', '-u', target_url, 

        '--keys', '--dns', '--json', '-o', '/tmp/photon'

    ], capture_output=True, text=True)

    

    # Upload results to S3

    s3 = boto3.client('s3')

    bucket = 'photon-osint-results'

    

    for root, dirs, files in os.walk('/tmp/photon'):

        for file in files:

            local_path = os.path.join(root, file)

            s3_path = os.path.relpath(local_path, '/tmp/photon')

            s3.upload_file(local_path, bucket, f"{target_url}/{s3_path}")

    

    return {

        'statusCode': 200,

        'body': json.dumps({

            'target': target_url,

            'scan_completed': result.returncode == 0,

            'results_bucket': bucket

        })

    }

version: '3.8'

services:

  photon-scanner:

    image: photon-osint:latest

    volumes:

      - ./results:/app/results

      - ./targets.txt:/app/targets.txt

    command: ["python3", "batch_scan.py", "/app/targets.txt", "/app/results"]

    deploy:

      replicas: 3

      resources:

        limits:

          memory: 2G

        reservations:

          memory: 1G

    networks:

      - osint-network



  result-aggregator:

    image: python:3.9

    volumes:

      - ./results:/app/results

    command: ["python3", "aggregate_results.py", "/app/results"]

    depends_on:

      - photon-scanner

    networks:

      - osint-network



networks:

  osint-network:

    driver: bridge

apiVersion: apps/v1

kind: Deployment

metadata:

  name: photon-osint-cluster

spec:

  replicas: 5

  selector:

    matchLabels:

      app: photon-scanner

  template:

    metadata:

      labels:

        app: photon-scanner

    spec:

      containers:

      - name: photon

        image: photon-osint:latest

        command: ["python3", "photon.py", "-u", "$(TARGET_URL)", "--keys", "--dns"]

        env:

        - name: TARGET_URL

          valueFrom:

            configMapKeyRef:

              name: photon-config

              key: target-url

        volumeMounts:

        - name: results-storage

          mountPath: /app/results

      volumes:

      - name: results-storage

        persistentVolumeClaim:

          claimName: photon-results-pvc

import requests

import subprocess

import json

from typing import Dict, List, Optional



class PhotonAPI:

    def __init__(self, base_url: str = "http://localhost:5000"):

        self.base_url = base_url

    

    def scan_target(self, url: str, options: Dict = None) -> Dict:

        """REST API call to Photon scan"""

        

        payload = {"url": url}

        if options:

            payload.update(options)

        

        response = requests.post(f"{self.base_url}/scan", json=payload)

        return response.json()

    

    def get_results(self, scan_id: str) -> Dict:

        """Retrieve scan results"""

        

        response = requests.get(f"{self.base_url}/results/{scan_id}")

        return response.json()

    

    def batch_scan(self, urls: List[str], options: Dict = None) -> List[Dict]:

        """Batch scanning multiple targets"""

        

        results = []

        for url in urls:

            result = self.scan_target(url, options)

            results.append(result)

        

        return results



class PhotonLocal:

    def __init__(self, photon_path: str = "python3 photon.py"):

        self.photon_path = photon_path

    

    def scan(self, url: str, kwargs) -> Dict:

        """Local Photon execution"""

        

        cmd = [self.photon_path, "-u", url]

        

        # Add options

        for key, value in kwargs.items():

            if isinstance(value, bool) and value:

                cmd.append(f"--{key}")

            elif isinstance(value, str):

                cmd.extend([f"--{key}", value])

            elif isinstance(value, int):

                cmd.extend([f"--{key}", str(value)])

        

        # Execute

        result = subprocess.run(cmd, capture_output=True, text=True)

        

        return {

            "success": result.returncode == 0,

            "stdout": result.stdout,

            "stderr": result.stderr

        }



<h2 id="usage">Usage</h2>

api = PhotonAPI()

local = PhotonLocal()



<h2 id="api-scan">API scan</h2>

api_result = api.scan_target("https://example.com", {"keys": True, "dns": True})



<h2 id="local-scan">Local scan</h2>

local_result = local.scan("https://example.com", keys=True, dns=True, threads=4)

<h2 id="initial-osint-on-target">Initial OSINT on target</h2>

<h2 id="use-public-sources-whois-dns-social-media">Use public sources: WHOIS, DNS, social media</h2>

<h2 id="identify-primary-domains-and-ip-ranges">Identify primary domains and IP ranges</h2>

<h2 id="gather-known-subdomains-and-assets">Gather known subdomains and assets</h2>

<h2 id="setup-photon-environment">Setup Photon environment</h2>

mkdir -p ~/photon_scans/$(date +%Y%m%d)

cd ~/photon_scans/$(date +%Y%m%d)



<h2 id="create-target-list">Create target list</h2>

cat > targets.txt << EOF

https://primary-target.com

https://api.primary-target.com

https://blog.primary-target.com

EOF



<h2 id="configure-options">Configure options</h2>

cat > scan_config.json << EOF

{

    "depth": 3,

    "threads": 4,

    "use_ninja": true,

    "extract_keys": true,

    "dns_enum": true,

    "wayback": true,

    "custom_regex": "api_key|secret|token|password"

}

EOF

<h2 id="quick-overview-scan">Quick overview scan</h2>

python3 photon.py -u https://primary-target.com -l 2 -t 2 -v



<h2 id="check-initial-findings">Check initial findings</h2>

cat primary-target.com/intel.txt

head primary-target.com/urls.txt

<h2 id="identify-additional-targets-from-initial-scan">Identify additional targets from initial scan</h2>

<h2 id="add-discovered-subdomains-to-targets-txt">Add discovered subdomains to targets.txt</h2>

<h2 id="check-for-related-domains">Check for related domains</h2>

<h2 id="scan-all-targets-simultaneously">Scan all targets simultaneously</h2>

cat targets.txt | xargs -n 1 -P 3 python3 photon.py -u

<h2 id="full-feature-scan">Full feature scan</h2>

python3 photon.py -u https://primary-target.com \

    -l 4 -t 8 \

    --keys --dns --wayback --clone \

    --ninja \

    --regex "api|key|token|secret|password" \

    --emails --social

<h2 id="cross-reference-findings">Cross-reference findings</h2>

python3 correlate_findings.py primary-target.com/ > correlations.txt



<h2 id="identify-patterns">Identify patterns</h2>

grep "AKIA" */keys.txt  # AWS keys

grep "api" */urls.txt   # API endpoints

grep "@target.com" */emails.txt  # Company emails

<h2 id="check-for-exposed-sensitive-data">Check for exposed sensitive data</h2>

python3 vulnerability_check.py primary-target.com/ > vulnerabilities.txt



<h2 id="flag-potential-security-issues">Flag potential security issues</h2>

grep -i "admin\|login\|config\|backup" */urls.txt > sensitive_urls.txt

<h2 id="structure-findings-by-category">Structure findings by category</h2>

mkdir -p findings/{credentials,assets,infrastructure,intelligence}



<h2 id="move-relevant-files">Move relevant files</h2>

mv */keys.txt findings/credentials/

mv */emails.txt findings/credentials/

mv */urls.txt findings/assets/

mv */dns.txt findings/infrastructure/

<h2 id="check-against-known-threat-feeds">Check against known threat feeds</h2>

python3 ti_correlation.py findings/ > ti_matches.txt



<h2 id="identify-known-malicious-indicators">Identify known malicious indicators</h2>

grep -f known_bad_domains.txt findings/assets/urls.txt > malicious_urls.txt

<h2 id="map-technical-findings-to-business-impact">Map technical findings to business impact</h2>

python3 business_impact.py findings/ > business_context.txt



<h2 id="identify-critical-assets">Identify critical assets</h2>

grep -E "admin|root|api" findings/assets/urls.txt > critical_assets.txt

<h2 id="create-comprehensive-report">Create comprehensive report</h2>

python3 generate_report.py findings/ > final_report.html



<h2 id="executive-summary">Executive summary</h2>

python3 exec_summary.py findings/ > executive_summary.pdf

<h2 id="document-methodology">Document methodology</h2>

cat > methodology.txt << EOF

Photon OSINT Reconnaissance Methodology v2.0

Date: $(date)

Tool Version: Photon 2026

Targets: $(wc -l < targets.txt)

Scan Parameters: Depth 4, 8 threads, full feature set

Analysis Time: $(date -r .)

EOF



<h2 id="preserve-evidence">Preserve evidence</h2>

tar -czf evidence_$(date +%Y%m%d).tar.gz .

<h2 id="prepare-findings-presentation">Prepare findings presentation</h2>

python3 create_presentation.py findings/ > osint_findings.pptx



<h2 id="generate-actionable-recommendations">Generate actionable recommendations</h2>

python3 recommendations.py findings/ > security_recommendations.txt

<h2 id="setup-ongoing-scans">Setup ongoing scans</h2>

crontab -e

<h2 id="add-0-6-path-to-monitor-script-sh">Add: 0 */6 * * * /path/to/monitor_script.sh</h2>




<h2 id="monitor-script">Monitor script</h2>

cat > monitor_script.sh << 'EOF'

#!/bin/bash

TARGET="https://primary-target.com"

LAST_SCAN=$(find /opt/photon/scans -name "*${TARGET#https://}*" -type d | sort | tail -1)



<h2 id="run-new-scan">Run new scan</h2>

python3 photon.py -u "$TARGET" --keys --wayback -o "/tmp/new_scan"



<h2 id="compare-with-last-scan">Compare with last scan</h2>

python3 compare_scans.py "$LAST_SCAN" "/tmp/new_scan" > changes.txt



<h2 id="alert-on-significant-changes">Alert on significant changes</h2>

if [ -s changes.txt ]; then

    mail -s "OSINT Changes Detected for $TARGET" security@company.com < changes.txt

fi

EOF

<h2 id="track-changes-over-time">Track changes over time</h2>

python3 trend_analysis.py /opt/photon/scans/ > trend_report.html



<h2 id="identify-emerging-threats">Identify emerging threats</h2>

python3 emerging_threats.py /opt/photon/scans/ > threat_trends.txt

#!/bin/bash

TARGET=$1

OUTPUT_BASE="./recon_$(date +%Y%m%d_%H%M%S)"

LOG_FILE="$OUTPUT_BASE/recon.log"



<h2 id="phase-1-setup">Phase 1: Setup</h2>

mkdir -p "$OUTPUT_BASE"

echo "Starting OSINT reconnaissance for $TARGET" > "$LOG_FILE"



<h2 id="phase-2-initial-discovery">Phase 2: Initial discovery</h2>

echo "Phase 2: Initial discovery" >> "$LOG_FILE"

python3 photon.py -u "$TARGET" -l 2 -t 4 -o "$OUTPUT_BASE/initial" -v >> "$LOG_FILE" 2>&1



<h2 id="phase-3-deep-analysis">Phase 3: Deep analysis</h2>

echo "Phase 3: Deep analysis" >> "$LOG_FILE"

python3 photon.py -u "$TARGET" -l 4 -t 8 --keys --dns --wayback --clone --ninja \

    --regex "api|key|token|secret|password" --emails --social \

    -o "$OUTPUT_BASE/deep" >> "$LOG_FILE" 2>&1



<h2 id="phase-4-analysis-and-correlation">Phase 4: Analysis and correlation</h2>

echo "Phase 4: Analysis and correlation" >> "$LOG_FILE"

python3 analyze_findings.py "$OUTPUT_BASE" >> "$LOG_FILE" 2>&1



<h2 id="phase-5-reporting">Phase 5: Reporting</h2>

echo "Phase 5: Reporting" >> "$LOG_FILE"

python3 generate_report.py "$OUTPUT_BASE" > "$OUTPUT_BASE/final_report.html" 2>> "$LOG_FILE"



echo "Reconnaissance completed for $TARGET" >> "$LOG_FILE"

<h2 id="check-system-resources">Check system resources</h2>

top -p $(pgrep -f photon)



<h2 id="reduce-thread-count">Reduce thread count</h2>

python3 photon.py -u https://target.com -t 2



<h2 id="increase-timeout">Increase timeout</h2>

python3 photon.py -u https://target.com --timeout 60



<h2 id="check-network-connectivity">Check network connectivity</h2>

ping -c 3 target.com

<h2 id="monitor-memory-usage">Monitor memory usage</h2>

vmstat 1



<h2 id="reduce-depth-for-large-sites">Reduce depth for large sites</h2>

python3 photon.py -u https://target.com -l 2



<h2 id="use-streaming-output">Use streaming output</h2>

python3 photon.py -u https://target.com --stream

<h2 id="check-available-space">Check available space</h2>

df -h



<h2 id="use-compression">Use compression</h2>

python3 photon.py -u https://target.com --compress



<h2 id="clean-temporary-files">Clean temporary files</h2>

find /tmp -name "photon*" -type d -mtime +1 -exec rm -rf {} \;

<h2 id="increase-timeout-values">Increase timeout values</h2>

python3 photon.py -u https://target.com --timeout 120



<h2 id="check-firewall-rules">Check firewall rules</h2>

iptables -L

ufw status



<h2 id="test-connectivity">Test connectivity</h2>

curl -I https://target.com

<h2 id="add-delays-between-requests">Add delays between requests</h2>

python3 photon.py -u https://target.com --delay 2



<h2 id="reduce-thread-count">Reduce thread count</h2>

python3 photon.py -u https://target.com -t 1



<h2 id="use-different-user-agents">Use different user agents</h2>

python3 photon.py -u https://target.com --user-agent "Photon Recon/1.0"

<h2 id="handle-ssl-errors">Handle SSL errors</h2>

python3 photon.py -u https://target.com --ignore-ssl-errors



<h2 id="check-certificate">Check certificate</h2>

openssl s_client -connect target.com:443 -servername target.com



<h2 id="update-ca-certificates">Update CA certificates</h2>

sudo update-ca-certificates

<h2 id="check-if-javascript-rendering-needed">Check if JavaScript rendering needed</h2>

python3 photon.py -u https://target.com --js-render



<h2 id="verify-regex-patterns">Verify regex patterns</h2>

python3 photon.py -u https://target.com --regex "test_pattern" --debug



<h2 id="check-for-anti-crawling-measures">Check for anti-crawling measures</h2>

curl -A "Mozilla/5.0" https://target.com/robots.txt

<h2 id="enable-debug-output">Enable debug output</h2>

python3 photon.py -u https://target.com --debug



<h2 id="check-html-structure">Check HTML structure</h2>

curl https://target.com | head -50



<h2 id="test-with-different-user-agent">Test with different user agent</h2>

python3 photon.py -u https://target.com --user-agent "Googlebot/2.1"

<h2 id="increase-crawl-depth">Increase crawl depth</h2>

python3 photon.py -u https://target.com -l 5



<h2 id="add-more-time-for-javascript">Add more time for JavaScript</h2>

python3 photon.py -u https://target.com --js-timeout 30



<h2 id="check-for-spa-single-page-application">Check for SPA (Single Page Application)</h2>

python3 photon.py -u https://target.com --spa-mode

<h2 id="check-python-dependencies">Check Python dependencies</h2>

pip3 list | grep -E "(requests|tldextract|beautifulsoup4)"



<h2 id="reinstall-requirements">Reinstall requirements</h2>

pip3 install -r requirements.txt --force-reinstall



<h2 id="check-python-version-compatibility">Check Python version compatibility</h2>

python3 --version

<h2 id="check-photon-location">Check Photon location</h2>

which python3

ls -la $(which python3)



<h2 id="add-to-path">Add to PATH</h2>

export PATH=$PATH:/path/to/photon



<h2 id="make-executable">Make executable</h2>

chmod +x photon.py

<h2 id="check-file-permissions">Check file permissions</h2>

ls -la photon.py requirements.txt



<h2 id="run-with-proper-permissions">Run with proper permissions</h2>

sudo -u photon_user python3 photon.py -u https://target.com



<h2 id="check-directory-write-permissions">Check directory write permissions</h2>

mkdir -p test_output

python3 photon.py -u https://target.com -o test_output

<h2 id="enable-full-debug-output">Enable full debug output</h2>

python3 photon.py -u https://target.com --debug --log-level DEBUG



<h2 id="redirect-to-file">Redirect to file</h2>

python3 photon.py -u https://target.com --debug > debug.log 2>&1



<h2 id="analyze-log">Analyze log</h2>

grep -i "error\|exception\|failed" debug.log

<h2 id="monitor-photon-network-activity">Monitor Photon network activity</h2>

tcpdump -i eth0 port 80 or port 443 -w photon_traffic.pcap &

PHOTON_PID=$!



python3 photon.py -u https://target.com

kill $PHOTON_PID



<h2 id="analyze-with-wireshark">Analyze with Wireshark</h2>

wireshark photon_traffic.pcap

<h2 id="profile-photon-execution">Profile Photon execution</h2>

python3 -m cProfile -s time photon.py -u https://target.com > profile.txt



<h2 id="analyze-bottlenecks">Analyze bottlenecks</h2>

head -20 profile.txt

<h2 id="test-proxy-connectivity">Test proxy connectivity</h2>

curl --proxy http://proxy.example.com:8080 https://httpbin.org/ip



<h2 id="check-proxy-list">Check proxy list</h2>

python3 photon.py --list-proxies



<h2 id="use-different-proxy-service">Use different proxy service</h2>

python3 photon.py -u https://target.com --ninja --proxy-service tor

<h2 id="monitor-for-blocking">Monitor for blocking</h2>

python3 photon.py -u https://target.com --ninja --monitor-detection



<h2 id="change-fingerprints">Change fingerprints</h2>

python3 photon.py -u https://target.com --ninja --random-fingerprint

<h2 id="split-scanning-by-sections">Split scanning by sections</h2>

python3 photon.py -u https://target.com/section1 --clone

python3 photon.py -u https://target.com/section2 --clone



<h2 id="use-incremental-scanning">Use incremental scanning</h2>

python3 photon.py -u https://target.com --incremental --last-scan 2024-01-01

<h2 id="optimize-for-memory">Optimize for memory</h2>

export PHOTON_MEMORY_LIMIT=1024MB

python3 photon.py -u https://target.com



<h2 id="optimize-for-cpu">Optimize for CPU</h2>

export PHOTON_THREAD_LIMIT=4

python3 photon.py -u https://target.com

<h2 id="use-connection-pooling">Use connection pooling</h2>

export PHOTON_CONNECTION_POOL=10

python3 photon.py -u https://target.com



<h2 id="configure-dns-resolution">Configure DNS resolution</h2>

export PHOTON_DNS_TIMEOUT=5

python3 photon.py -u https://target.com

<h2 id="increase-timeout">Increase timeout</h2>

python3 photon.py -u https://target.com --timeout 300



<h2 id="check-network-connectivity">Check network connectivity</h2>

traceroute target.com

<h2 id="skip-ssl-verification">Skip SSL verification</h2>

python3 photon.py -u https://target.com --no-ssl-verify



<h2 id="update-certificates">Update certificates</h2>

sudo apt update && sudo apt install ca-certificates

<h2 id="check-robots-txt">Check robots.txt</h2>

curl https://target.com/robots.txt



<h2 id="respect-crawl-delays">Respect crawl delays</h2>

python3 photon.py -u https://target.com --delay 5



<h2 id="use-different-user-agent">Use different user agent</h2>

python3 photon.py -u https://target.com --user-agent "Photon Research Bot"

<h2 id="reduce-scope">Reduce scope</h2>

python3 photon.py -u https://target.com -l 2 -t 2



<h2 id="use-streaming-mode">Use streaming mode</h2>

python3 photon.py -u https://target.com --stream



<h2 id="increase-system-memory">Increase system memory</h2>

<h2 id="or-use-swap-file">Or use swap file</h2>

sudo fallocate -l 2G /swapfile

sudo chmod 600 /swapfile

sudo mkswap /swapfile

sudo swapon /swapfile

<h2 id="cross-verify-with-multiple-tools">Cross-verify with multiple tools</h2>

python3 photon.py -u https://target.com --keys

<h2 id="compare-with-gobuster-or-dirb-results">Compare with gobuster or dirb results</h2>




<h2 id="statistical-validation">Statistical validation</h2>

python3 validate_results.py photon_output/ > validation_report.txt



<h2 id="manual-spot-checking">Manual spot checking</h2>

head -10 photon_output/*/urls.txt

grep "admin" photon_output/*/urls.txt

<h2 id="create-scan-manifest">Create scan manifest</h2>

cat > scan_manifest.txt << EOF

Photon OSINT Scan Manifest

Date: $(date)

Target: https://target.com

Scope: Full reconnaissance

Tools: Photon v2026

Parameters: -l 4 -t 8 --keys --dns --wayback --clone

Authorization: Approved by [authority]

Operator: [name]

EOF



<h2 id="include-in-all-reports">Include in all reports</h2>

cp scan_manifest.txt photon_output/

<h2 id="structured-findings-format">Structured findings format</h2>

cat > findings_template.md << EOF

<h2 id="osint-findings-report">OSINT Findings Report</h2>




<h2 id="executive-summary">Executive Summary</h2>

- Total URLs discovered: [count]

- Critical findings: [summary]



<h2 id="methodology">Methodology</h2>

- Tools used: Photon v2026

- Scan parameters: [details]

- Timeframe: [dates]



<h2 id="detailed-findings">Detailed Findings</h2>




<h3 id="credentials">Credentials</h3>

- Location: [file:line]

- Type: [HTTP Basic, API key, etc.]

- Risk level: [High/Medium/Low]



<h3 id="sensitive-urls">Sensitive URLs</h3>

- URL: [full URL]

- Exposure: [public, authenticated, etc.]

- Risk level: [High/Medium/Low]



<h3 id="infrastructure">Infrastructure</h3>

- Domains: [list]

- IP ranges: [ranges]

- Technologies: [stack]



<h2 id="recommendations">Recommendations</h2>

1. [Actionable items]

2. [Priorities]

3. [Timelines]



<h2 id="appendices">Appendices</h2>

- Raw scan data

- Methodology details

- Contact information

EOF

<h2 id="optimal-photon-configuration">Optimal Photon configuration</h2>

[Optimization]

threads = 8

depth = 3

timeout = 30

delay = 0.1

memory_limit = 2048MB

disk_cache = true

connection_pool = 20

class PhotonMetrics:

    def __init__(self):

        self.metrics = {

            'scan_time': 0,

            'urls_found': 0,

            'keys_found': 0,

            'errors': 0,

            'coverage': 0.0

        }

    

    def record_scan(self, results_dir):

        # Parse results and calculate metrics

        # Store for trend analysis

        pass

    

    def generate_report(self):

        # Create performance report

        # Identify improvement areas

        pass



metrics = PhotonMetrics()

<h2 id="integrate-into-scanning-workflow">Integrate into scanning workflow</h2>

<h2 id="risk-assessment-before-scanning">Risk assessment before scanning</h2>

python3 risk_assessment.py https://target.com > risk_report.txt



<h2 id="implement-safe-scanning-practices">Implement safe scanning practices</h2>

python3 photon.py -u https://target.com --safe-mode --monitor



<h2 id="have-incident-response-plan">Have incident response plan</h2>

<h2 id="document-all-activities">Document all activities</h2>

<h2 id="maintain-professional-liability-insurance">Maintain professional liability insurance</h2>