{"id":37149528,"url":"https://github.com/kraken-offsec/crowsnest","last_synced_at":"2026-01-14T17:39:20.305Z","repository":{"id":293529725,"uuid":"983834101","full_name":"Kraken-OffSec/CrowsNest","owner":"Kraken-OffSec","description":"CrowsNest is a CLI tool utilized for querying common OSINT API's including Dehashed and Hunter.io. It also gives you the ability to search the results offline using SQL syntax.","archived":false,"fork":false,"pushed_at":"2025-06-04T00:09:42.000Z","size":32440,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-04T06:37:00.409Z","etag":null,"topics":["cli","dehashed","dehashed-api","golang","hunter","hunterio","osint"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kraken-OffSec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-15T01:51:16.000Z","updated_at":"2025-06-04T00:09:44.000Z","dependencies_parsed_at":"2025-05-17T15:33:03.589Z","dependency_job_id":null,"html_url":"https://github.com/Kraken-OffSec/CrowsNest","commit_stats":null,"previous_names":["kraken-offsec/dehasher","kraken-offsec/crowsnest"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/Kraken-OffSec/CrowsNest","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kraken-OffSec%2FCrowsNest","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kraken-OffSec%2FCrowsNest/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kraken-OffSec%2FCrowsNest/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kraken-OffSec%2FCrowsNest/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kraken-OffSec","download_url":"https://codeload.github.com/Kraken-OffSec/CrowsNest/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kraken-OffSec%2FCrowsNest/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28428905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T16:38:47.836Z","status":"ssl_error","status_checked_at":"2026-01-14T16:34:59.695Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","dehashed","dehashed-api","golang","hunter","hunterio","osint"],"created_at":"2026-01-14T17:39:19.697Z","updated_at":"2026-01-14T17:39:20.293Z","avatar_url":"https://github.com/Kraken-OffSec.png","language":"Go","funding_links":["https://buymeacoffee.com/ehosinskiz"],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n    \u003cimg src=.img/crowsnest.png  style=\"width: 500px; height: auto\" alt=\"CrowsNest Logo\" title=\"CrowsNest Logo\"\u003e\n\u003c/div\u003e\n\n### A CLI tool for seamless interaction with the Dehashed and Hunter.io APIs.\n\n---\n\n## 🌟 Features\n- **Output Format Control**: JSON, YAML, XML, and TEXT support.\n- **Regex \u0026 Wildcard Matching**: Flexible query options.\n- **Local Database Storage**: Default or custom paths.\n- **Database Querying**: Raw SQL and filtered queries.\n- **Enhanced Logging**: Easy log parsing and rotation.\n- **Error Handling**: Intelligent API error management.\n- **WhoIs Lookups**: Domain, IP, MX, NS, and more.\n- **Subdomain Scanning**: Identify subdomains.\n- **Robust Logging**: Detailed logs for debugging.\n- **API Key Management**: Securely store and manage API keys.\n- **Formatted Output**: Easy to read and understand.\n- **Intuitive Database Querying**: Query for specific information.\n- **Person and Company Enrichment**: Retrieve detailed information about people and companies.\n- **Email Verification**: Verify the existence and quality of email addresses.\n\n---\n\n## 🔰 Getting Started\n\nTo begin, clone the repository\n``` bash-session\ngit clone https://github.com/Kraken-OffSec/CrowsNest.git\ncd crowsnest\ngo build crowsnest.go\n```\n\n---\n\n## 🗄️ Database Configuration\n\nCrowsNest supports two database storage options:\n\n1. **Default Path** (default): Stores the database at `~/.local/share/crowsnest/db/crowsnest.sqlite`\n2. **Local Path**: Stores the database in the current directory as `./crowsnest.sqlite`\n\nThe **Local Path** option allows for separate databases for different projects or engagements.\n\nTo configure the database location:\n\n```bash\n# Use local database in current directory\n./crowsnest set-local-db true\n\n# Use default database path\n./crowsnest set-local-db false\n```\n\n---\n\n## 🌐 Dehashed\n\n### Initial Setup\n\nCrowsNest requires an API key from Dehashed. Set it up with:\n![Alt text](.img/set-dehashed.png \"Set Dehashed Key\")\n```bash\nar1ste1a@kali:~$ crowsnest set-dehashed \u003credacted\u003e\n```\n\n### Simple Query\nCrowsNest can be used simply for example to query for credentials matching a given email domain.\n![Alt text](.img/simple_query.png \"Simple Query\")\n``` go\n# Provide credentials for domains matching target.com\ncrowsnest dehashed -D target.com\n```\n\n### Simple Credentials Query\nCrowsNest can also be used to return only credentials for a given query.\n![Alt text](.img/simple_creds_query.png \"Creds Only Query\")\n``` go\n# Provide credentials for emails matching @target.com\ncrowsnest dehashed -D @target.com -C\n```\n\n### Wildcard Query\nCrowsNest is capable of handling wildcard queries.  \nA wildcard query cannot begin with a wildcard.  \nThis is a limitation of the Dehashed API.\nAn asterisk can be used to denote multiple characters, and a question mark can be used to denote a single character.\n\u003cbr\u003e\n![Alt text](.img/wildcard_query.png \"Wildcard Query\")\n``` go\n# Provide credentials for emails matching @target.com and @target2.com\ncrowsnest dehashed -E @target?.com -C -W\n```\n\n### Email Query\nDehashed has dictated that emails should be searched in the following format:\n`email:target.name\u0026domain:target.com`.\nAs such, to query an email, please use the following format (note, wildcard is not required but can be useful):\n\u003cbr\u003e\n*see photo above in Wildcard Query*\n``` go\n# Provide credentials for emails matching target.*@target.com\ncrowsnest dehashed -W -E 'target*' -D target.com\n```\nYou may also query the domain and find emails as well\n``` go\n# Provide credentials for emails matching target.com\ncrowsnest dehashed -D target.com -C\n```\n\n### Combining Queries\nCrowsNest is capable of combining queries.  \nThis is useful for when you want to query for credentials matching a given email or domain, but only for a specific username.\n![Alt text](.img/combining_queries.png \"Combined Query\")\n``` go\n# Provide credentials for emails matching @target.com and username containing 'admin'\ncrowsnest dehashed -D target.com -U admin\n```\n\n### Regex Query\nCrowsNest is capable of handling regex queries.  \nSimply denote regex queries with the `-R` flag.\nPlace all regex queries in quotes with the corresponding query flag in single quotes.\n\u003cbr\u003e\n!!!! *Currently, the Regex Operators appear to be broken. I am waiting on a response from Dehashed* !!!!\n``` go\n# Return matches for emails matching this given regex query\ncrowsnest dehashed -R -E 'joh?n(ath[oa]n)' -D hotmail.com'\n```\n\n### Output Text (default JSON)\nCrowsNest is capable of handling output formats.  \nThe default output format is JSON.  \nTo change the output format, use the `-f` flag.  \nCrowsNest currently supports JSON, YAML, XML, and TEXT output formats.\n``` go\n# Return matches for usernames exactly matching \"admin\" and write to text file 'admins_file.txt'\ncrowsnest dehashed -U admin -o admins_file -f txt\n```\n\n---\n\n## 🌐 WhoIs Lookups\nCrowsNest supports WHOIS lookups, history searches, reverse WHOIS searches, IP lookups, MX lookups, NS lookups, and subdomain scans.\nThe WhoIs Lookups require a separate API Credit from the Dehashed API.\n\n### Domain Lookup\nCrowsNest can perform a domain lookup for a given domain.\nThis provides a tree view of the domain's WHOIS information.\n![Alt text](.img/whois_domain.png \"WhoIs Tree View\")\n```bash\n# Perform a WHOIS lookup for example.com\ncrowsnest whois -d example.com\n```\n\n### History Lookup\nHistory Lookups require 25 credits. \nThis is a Dehashed API limitation.\nThe history lookup is immediately written to file and not displayed in the terminal or stored in the database.\n```bash\n# Perform a WHOIS history search for example.com\ncrowsnest whois -d example.com -H\n```\n\n### Subdomain Scan\nCrowsNest can perform a subdomain scan for a given domain.  \nThis provides a list of all subdomains that match the given query.\n![Alt text](.img/whois_subdomain.png \"WhoIs Tree View\")\n```bash\n# Perform a WHOIS subdomain scan for google.com\ncrowsnest whois -d google.com -s\n```\n\n### Reverse WHOIS Lookup\nCrowsNest can perform a reverse WHOIS lookup for given criteria.  \nThis provides a list of all domains that match the given query.  \nThe reverse WHOIS lookup is immediately written to file and not stored in the database.\n![Alt text](.img/whois_reverse.png \"WhoIs Tree View\")\n```bash\n# Perform a reverse WHOIS lookup for example.com\ncrowsnest whois -I example.com\n```\n\n### IP Lookup\nCrowsNest can perform a reverse IP lookup for a given IP address.  \nThis provides a list of all domains that match the given query.\n![Alt text](.img/whois_ip.png \"WhoIs View\")\n```bash\n# Perform a reverse IP lookup for 8.8.8.8\ncrowsnest whois -i 8.8.8.8\n```\n\n### MX Lookup\nCrowsNest can perform an MX lookup for a given MX hostname.  \nThis provides a list of all domains that match the given query.\n![Alt text](.img/whois_mx.png \"WhoIs Tree View\")\n```bash\n# Perform a reverse MX lookup for google.com\ncrowsnest whois -m stmp.google.com\n```\n### NS Lookup\nCrowsNest can perform an NS lookup for a given NS hostname.  \nThis provides a list of all domains that match the given query.\nThe picture below also includes the --debug global flag.\n![Alt text](.img/whois_ns.png \"WhoIs Tree View\")\n```bash\n# Perform a reverse NS lookup for google.com\ncrowsnest whois -n google.com\n```\n\n\n---\n\n## 🌐 Hunter.io\nCrowsNest supports Hunter.io lookups.  \nHunter.io lookups require a separate API Key from the Dehashed API.\nThis can be set using the `set-hunter` command.\n![Alt text](.img/set-hunter.png \"Set Dehashed Key\")\n```bash\n# Set the Hunter.io API key\ncrowsnest set-hunter \u003credacted\u003e\n```\n\n### Domain Search\nCrowsNest can perform a domain search for a given domain.  \nThis provides information about  company including a description, social media information and any technologies in use.\u003cbr\u003e\n![Alt text](.img/hunter_domain.png \"Hunter.io Domain Search\")\n```bash\n# Perform a Hunter.io domain search for example.com\ncrowsnest hunter -d example.com -D\n```\n\n### Email Verification\nCrowsNest can perform an email verification search for a given email.  \nThis provides a verification and score of a given email address.\n![Alt text](.img/hunter_emailverification.png \"Hunter.io Email Verification\")\n```bash\n# Perform a Hunter.io email verification search for example@target.com\ncrowsnest hunter -e example@target.com -V\n```\n\n### Company Enrichment\nCrowsNest can perform a company enrichment search for a given domain.  \nThis provides information about a company given its domain.\n![Alt text](.img/hunter_company.png \"Hunter.io Company Enrichment\")\n```bash\n# Perform a Hunter.io company enrichment search for example.com\ncrowsnest hunter -d example.com -C\n```\n\n### Email Finder\nCrowsNest can perform an email finder search for a given domain, first name, and last name.  \nThis provides information about a user including a confidence score, and any social media accounts linked to a first name, last name and email.\n![Alt text](.img/hunter_emailfind.png \"Hunter.io Email Finder\")\n```bash\n# Perform a Hunter.io email finder search for example.com\ncrowsnest hunter -d example.com -F John -L Doe -E\n```\n\n### Person Enrichment\nCrowsNest can perform a person enrichment search for a given email.  \nThis provides information about a user given an email address..\n![Alt text](.img/hunter_person.png \"Hunter.io Person Enrichment\")\n```bash\n# Perform a Hunter.io person enrichment search for example@target.com\ncrowsnest hunter -e example@target.com -P\n```\n\n### Combined Enrichment\nCrowsNest can perform a combined enrichment search for a given email.  \nThis is a combination of the company and person enrichments given an email address.\n![Alt text](.img/combined_enrichment_1.png \"Hunter.io Combined Enrichment\")\n![Alt text](.img/combined_enrichment_2.png \"Hunter.io Combined Enrichment\")\n```bash\n# Perform a Hunter.io combined enrichment search for example@target.com\ncrowsnest hunter -e example@target.com -B\n```\n## Debugging\nCrowsNest supports debugging.  This can be enabled using the `--debug` flag in the root command.\n![Alt text](.img/crowsnest_debugging_global.png \"Debugging\")\n```bash\n# Perform a Hunter.io combined enrichment search for example@target.com with debugging enabled\ncrowsnest --debug hunter -e example@target.com -B\n```\n---\n## 📊 Database Querying\nCrowsNest stores query results in a local database.  \nThis database can be queried for previous results.\nThis is useful for when you want to query for specific information.\nThis database also includes WhoIs Information and Subdomain Scan results, but does **not** include historical lookups.\n\n## Simple Query\n#### It's possible to query the database using shorthand and without knowing any SQL at all.\n#### The following queries the results table where username is not null, only showing the username, email and password columns.\n![Alt text](.img/query_simple.png \"Simple Query\")\n#### You may also add in a simple query using the `-q` flag. The following displays a 'LIKE' clause on the email column.\n#### Note the '%\\\u003cclause\\\u003e%' is still required.\n![Alt text](.img/query_where.png \"Simple Query\")\n  \n```bash\n# Query the database for all results containing the word 'admin' in the username\ncrowsnest query -t results -q \"username LIKE '%admin%'\"\n```\n\n\n## Raw SQL Queries\n![Alt text](.img/query_raw.png \"Raw Query\")\n\nCrowsNest also supports raw SQL queries.  This is useful for when you want to query for specific information.\n```bash\n# Query the database for all results containing the word 'admin' in the username\ncrowsnest query -r \"SELECT * FROM results WHERE username LIKE '%admin%'\"\n```\n\n## Query Options\nCrowsNest supports a number of query options.  These options can be used to filter the results of a query.\n```bash\n# Query the database for all results containing the word 'admin' in the username\ncrowsnest query -t results -q \"username LIKE '%admin%'\" -n username,email,password\n```\n\n## Listing Tables and Columns\nCrowsNest supports listing all available tables and columns.  \nThis is useful for when you want to query for specific information.\n![Alt text](.img/query_alltables.png \"List All Tables\")\n```bash\n# List all available tables and columns\ncrowsnest query -a\n```\n\nThe current tables available for query are:\n- results\n  - Results from a dehashed query\n- creds\n  - Credentials parsed from dehashed results\n- whois\n  - Results from a whois record lookup\n- subdomains\n  - Subdomains discovered in a whois subdomain scan \n- runs\n  - Previous query runs to the dehashed API\n- lookup \n  - Results of any Whois NS, MX, or IP lookup\n- hunter_domain\n  - Results from a hunter.io domain search\n- hunter_email\n  - Results extracted from a domain saerch and email finder.\n\n---\n\n# Exporting Results\nCrowsNest supports exporting results to a file.  \nThis is useful for when you want to requery for specific information without touching the Dehashed API.\nThe export subcommand supports all the same options as the query subcommand.\nThe export subcommand also supports file naming and output format control.\n![Alt text](.img/export_raw.png \"Export Results\")\n```bash\n# Export all results containing the word 'admin' in the username to a text file\ncrowsnest export -t results -q \"username LIKE '%admin%'\" -o admins_file -f txt\n```\n\n## 🐛 Debugging\n\nCrowsNest uses the `zap` logging library for logging.  The logs are stored in `~/.local/share/crowsnest/logs`.\nThe logs can be easily queried from the crowsnest CLI.\n\n### Filtering by Date\n#### CrowsNest utilizes 'easy time' to determine the appropriate time for a given query.\n![Alt text](.img/easy_time_parsing.png \"Easy Time\")\n#### You may also used dates mixed with easy time to perform queries.\n![Alt text](.img/mixed_time_query.png \"Mixed Time\")\n#### The following formats are supported:\n- `last 24 hours`\n- `last 2 days`\n- `30 minutes ago`\n- `45 seconds ago`\n- `1 week ago`\n- `05-01-2025`\n- `05/01/2025`\n- `05/01/25`\n- `05-01-25`\n- `May 01, 2025`\n\n```bash\n# Show the last 10 logs\ncrowsnest logs -l 10\n\n# Show logs from the last 24 hours\ncrowsnest logs -s \"last 24 hours\"\n\n# Show logs from the last 24 hours with a severity of error or fatal\ncrowsnest logs -s \"05-01-2025\" -v error,fatal\n```\n\n## 🤝 Contributing\nContributions are welcome! Submit a pull request to help improve CrowsNest.\n\n## [Buy Me A Coffee](https://buymeacoffee.com/ehosinskiz)\n\n\u003cdiv align=\"center\"\u003e\n    \u003cimg src=.img/kraken_k.png style=\"width: 350px; height: auto\" alt=\"Ar1ste1a\" title=\"Ar1ste1a Offensive Security\"\u003e\n\u003c/div\u003e\n\n## **Release The Kraken**\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkraken-offsec%2Fcrowsnest","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkraken-offsec%2Fcrowsnest","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkraken-offsec%2Fcrowsnest/lists"}