Red Specter SHADOWMAP
Pure Python OSINT & Target Intelligence Engine — 8 modules. 930 tests. Zero external dependencies.
Overview
SHADOWMAP is a pure Python OSINT and target intelligence engine. Zero external API dependencies. No Shodan wrappers. No Censys API calls. No VirusTotal subscriptions. Every DNS resolver, WHOIS parser, fingerprinting engine, and correlation module built from scratch using Python stdlib. Before you attack, you see everything.
Eight modules. 930 tests. 624 subdomain signatures. 80+ WHOIS servers. 47+ framework fingerprints. 30 WAF signatures. Complete target intelligence from a single domain seed.
Installation
Also available as .deb and PKGBUILD (BlackArch).
Or from source:
Quick Start
DOMAIN Module
Complete DNS and domain intelligence. Enumerates all record types, discovers subdomains, parses WHOIS data across 80+ registrar servers, and detects zone transfer misconfigurations.
- DNS enumeration: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR records
- Subdomain discovery: 624 common subdomain signatures for passive enumeration
- WHOIS parsing: 80+ registrar WHOIS servers with structured data extraction
- Zone transfer detection: AXFR misconfiguration testing (UNLEASHED)
- Subdomain brute force: Active enumeration with 624-word dictionary (UNLEASHED)
NETWORK Module
Infrastructure mapping from IP addresses. ASN identification, hosting provider detection, CDN fingerprinting, and geolocation intelligence.
- ASN mapping: Autonomous System identification and ownership
- Hosting detection: 50+ hosting provider signatures (AWS, Azure, GCP, DigitalOcean, etc.)
- CDN detection: 18 CDN signatures (Cloudflare, Akamai, Fastly, CloudFront, etc.)
- IP geolocation: Country, region, city-level location intelligence
COMPANY Module
Corporate intelligence gathering. Organisational structure, subsidiary mapping, key personnel identification, and public filing extraction.
- Structure analysis: Parent company, subsidiaries, acquisitions
- Employee identification: Key personnel, roles, departments
- Public filings: Companies House, SEC, regulatory filings
- Extended profiling: Departure tracking, hiring patterns (UNLEASHED)
PEOPLE Module
Individual profiling for social engineering target selection. Role mapping, seniority analysis, and departure tracking for insider threat assessment.
- Individual profiling: Name, role, seniority, department
- Role mapping: Organisational hierarchy reconstruction
- Departure tracking: Former employees, role changes, insider threat indicators
- High-value targeting: Identifies executives, IT administrators, finance personnel
EMAIL Module
Email pattern discovery, validation, and breach correlation. Identifies naming conventions, validates deliverability, and checks credential exposure.
- Pattern discovery: 15 email pattern formats (firstname.lastname, f.lastname, etc.)
- SPF/DKIM/DMARC analysis: Email authentication policy assessment
- Breach correlation: Cross-reference discovered emails with breach databases
- SMTP validation: Active deliverability verification (UNLEASHED)
SOCIAL Module
Social media footprint mapping. Discovers platform presence, technology mentions, conference talks, and open-source contributions.
- Platform discovery: LinkedIn, GitHub, Twitter/X, Facebook, Instagram, YouTube
- Technology mentions: Stack references in posts, repos, and profiles
- Conference talks: Speaker appearances revealing internal architecture
- Open-source contributions: GitHub repos, npm packages, PyPI packages
BREACH Module
Breach data correlation and credential exposure assessment. Domain-wide impact scoring and password pattern analysis.
- Breach correlation: Domain-wide breach impact assessment
- Credential exposure: Count and severity of exposed credentials
- Password patterns: Common patterns from breach data analysis
- Individual exposure: Per-user credential exposure (UNLEASHED)
TECH Module
Technology stack fingerprinting with CVE mapping. Identifies frameworks, CMS platforms, WAFs, and maps known vulnerabilities to discovered versions.
- Framework fingerprinting: 47+ frameworks (React, Angular, Vue, Django, Rails, Spring, etc.)
- CMS detection: 20+ CMS platforms with version extraction
- WAF identification: 30 WAF signatures (Cloudflare, AWS WAF, Imperva, ModSecurity, etc.)
- CVE mapping: Version-to-CVE correlation for discovered technology
- Active probing: Deep fingerprinting with direct requests (UNLEASHED)
SHADOWMAP UNLEASHED
Cryptographic override. Private key controlled. One operator. Founder's machine only.
Standard mode is fully passive with zero target footprint. UNLEASHED mode enables active reconnaissance: DNS brute force, SMTP validation, subdomain enumeration at scale, and direct target interaction. The target will see your probes.
| Capability | Standard | UNLEASHED |
|---|---|---|
| DNS enumeration | Public records | Active brute force + zone transfers |
| Subdomain discovery | Passive sources | 624-word brute force + permutations |
| Email validation | Pattern detection | SMTP validation, deliverability |
| Breach correlation | Domain-level | Individual credential exposure |
| Tech fingerprinting | Header analysis | Active probing, deep fingerprinting |
| Target footprint | Zero | Active probes visible to target |
| Key required | No | Ed25519 |
UNLEASHED mode is restricted to authorised operators with Ed25519 private key access. Active reconnaissance against targets must only occur with explicit written authorisation. UNLEASHED mode generates network traffic visible to the target and may trigger security alerts.
CLI Reference
Commands
| Command | Description |
|---|---|
| shadowmap scan <target> | Full reconnaissance scan |
| shadowmap domain <target> | DNS & domain intelligence |
| shadowmap network <target> | Infrastructure mapping |
| shadowmap company <target> | Corporate intelligence |
| shadowmap people <target> | Personnel profiling |
| shadowmap email <target> | Email discovery & validation |
| shadowmap social <target> | Social footprint mapping |
| shadowmap breach <target> | Breach data correlation |
| shadowmap tech <target> | Technology fingerprinting |
| shadowmap report <session> | Generate report from session |
| shadowmap version | Show version information |
Options
| Flag | Description |
|---|---|
| --target | Target domain or organisation |
| --full | Run all modules |
| --override | UNLEASHED dry-run |
| --confirm-destroy | UNLEASHED live execution |
| --output | Output directory |
| --session | Session name |
| --format | Output format: json, html, text |
Pipeline Integration
SHADOWMAP is Tool 17 in the Red Specter offensive pipeline. It builds the target intelligence profile that feeds every downstream tool. SHADOWMAP discovers, WRAITH scans, REAPER exploits, GHOUL cracks, DOMINION owns, NEMESIS orchestrates.
Report Output
Every SHADOWMAP engagement produces JSON, HTML, and text reports with complete intelligence documentation.
Disclaimer
Red Specter SHADOWMAP is designed for authorised security testing, research, and educational purposes only. Standard mode performs passive reconnaissance using publicly available information. UNLEASHED mode performs active reconnaissance that generates network traffic to the target. You must have explicit written permission before running UNLEASHED mode against any target. Unauthorised reconnaissance may violate the Computer Misuse Act 1990 (UK), the Computer Fraud and Abuse Act (US), or equivalent legislation in your jurisdiction. The authors accept no liability for misuse or damage resulting from improper use.