Open a site, click the icon, and Kumo maps everything reachable about that
domain: DNS and email security, certificates and subdomains from CT
logs, open ports, technology fingerprints, leaked credentials,
cloud buckets, and 420 vulnerability checks. Twenty-seven modules run in
parallel, each streaming its own card the moment it lands.
It all happens inside your browser. No server to start, no API key, no
account.
This is the browser edition of
Kumo, the Python CLI
and dashboard. Same engine, same rules, same four themes.
📑 Table of contents
📦 Install
Requirements
| |
|---|
| Browser | Chrome, Brave, Edge, Opera, Vivaldi, or Firefox |
| Python | only to build, or grab a release zip |
| Server | none |
| API keys | none |
Build and load
git clone https://github.com/karim852/kumo-recon-browser-extension
cd kumo-recon-browser-extension
./build.sh
Chrome, Brave, Edge, Opera, Vivaldi
chrome://extensions → turn on Developer mode → Load unpacked →
pick build/chrome
Firefox
about:debugging#/runtime/this-firefox → Load Temporary Add-on →
pick build/firefox/manifest.json
Prebuilt zips are attached to every release.
🚀 Your first scan
Open any site you are allowed to test, then click the Kumo icon. The domain of
the tab is already in the box, subdomain included.
| |
|---|
| SCAN | run the selected modules |
| ⚡ | fast mode, skips the slow modules |
| TAB | re-read the domain from the current tab |
| ⭳ json | download the raw scan |
| ⧉ copy | one line per module, for notes |
| right click | Kumo: scan this site, or a link's domain |
Alt+K | open on the current tab |
Close the panel and the scan keeps going. Reopen it later and every card is
waiting. The toolbar badge counts modules while it runs, then turns red,
orange, yellow or green for the worst thing it found.
🎨 Themes
The same four palettes as the dashboard, switched from the dots in the header.
🧩 Modules
27 modules, all running in parallel. Click any one to see what it returns.
Network & Infrastructure
Full DNS enumeration with a verdict on email protection. Flags missing DMARC,
weak SPF policies and absent DKIM.
Resolves the domain, geolocates each IP, and pulls ASN, ISP and hosting status.
Creation date, expiry, registrar and nameservers, resolved through the IANA
RDAP registry. Registries with no RDAP service say so plainly instead of
showing an error.
Issuer, validity, serial and every Subject Alternative Name, pulled from
Certificate Transparency. A browser cannot read a live cipher, so for the
negotiated protocol use the CLI.
A browser has no TCP sockets, so this reports what Shodan InternetDB last
saw open, labelled with the CLI's own service and risk table. A port missing
here means not seen, never closed, and the card says so.
Every hostname ever certified for the domain, resolved and flagged when the
name looks sensitive: vpn, staging, jenkins, internal.
Ports, tags and known CVEs per IP, coloured by CVSS band. Free and keyless.
Web Surface
Every security header checked and scored A to F, plus any version disclosure
the server volunteers.
CMS, framework, language, CDN, analytics and versions, from headers and body.
Fingerprints 30 WAFs. Each signature is matched only against the part of the
response it belongs to, so a word in the page body never names a vendor.
Final URL, allowed methods with dangerous ones flagged, cookie flags, and
leaky headers.
Disallowed paths with the sensitive ones highlighted, because what a site hides
is usually what is worth looking at.
Title, description, CMS and final URL.
The mmh3 hash Shodan indexes, with ready-made Shodan and FOFA pivots to find
every other host running the same app.
Exposure & Vulnerabilities
The full rule set from the CLI, matched in the browser. Findings are verified
against the site's own soft 404 before being reported, so a site that answers
200 for everything produces nothing.
Config files, backups, admin panels, dotfiles. Same soft 404 verification.
69 patterns across every script the page loads: AWS keys, GitHub tokens,
Stripe keys, database URLs, hardcoded passwords. Always redacted on screen.
Finds API bases, Swagger and OpenAPI specs, and flags GraphQL endpoints with
introspection left on.
Identifies WordPress, Joomla or Drupal from 18 weighted structural signals —
asset paths, generator meta, headers — then runs only that platform's checks,
so a Drupal site is never probed for WordPress paths. Reads the version, probes
34 CMS-specific sensitive paths, and on WordPress enumerates users via the REST
API plus plugins and themes with versions.
Detection never matches a product name in page text, so a blog that writes
about WordPress is not reported as running it. Fingerprinting covers 20
platforms; anything without deep checks is named as such rather than returning
an empty card that would read as clean.
cPanel, WHM, Plesk, DirectAdmin, Webmin, Virtualmin, CyberPanel, aaPanel,
Hestia, VestaCP, CentOS Web Panel, ISPConfig, Froxlor, Cockpit, Ajenti and more
— 17 panels across 20 ports.
Passive first, like ports. A page cannot open a TCP socket, and the panels
that answer on 2083, 8443 or 10000 almost always present a self-signed
certificate that fetch() refuses with no way to continue. So this asks Shodan
which panel ports are open, then confirms the login interface over HTTP where it
can. A port Shodan saw but the browser could not read is reported as exactly
that, never as a confirmed panel — and panels are matched by their interface,
not their name, so a hosting company's own site reports none of the products it
sells.
Hundreds of name permutations against S3, Google Cloud Storage and Azure Blob.
Pulls internal hostnames, API routes, emails, cloud URLs and database strings
out of the JavaScript the site ships.
Intelligence
Infostealer infections and leaked employee credentials, via Hudson Rock. Tells
you the difference between "nothing found" and "the lookup failed".
How far back the site goes, and the archived URLs worth a second look: backups,
debug pages, internal APIs.
Addresses from the homepage, contact pages and archived URLs.
Certificates and host pivots. Also brute for subdomain brute forcing over
DNS-over-HTTPS.
🧪 Tests
./test/run_all.sh ../kumo-domain-recon-tool
The engine ships engine.py's own rules and tables, generated by
tools/build_tables.py rather than retyped, so the risk is not a wrong table —
it is the two engines quietly disagreeing. Three of the four suites are parity
checks against the main repo, and they regenerate their cases from engine.py
before running:
| Suite | What it proves |
|---|
rule_parity.mjs | all 420 rules reach engine.py's verdict, across a synthesised positive and six benign response shapes — 2,940 cases |
version_parity.mjs | the version matcher agrees on every boundary, patched releases and unparseable input included |
fingerprint_parity.mjs | no signature fires on a page that merely names the products, in body or headers |
render_smoke.mjs | every card renders with real data, an error and an empty object, and none says the wrong thing |
If engine.py's detection logic changes and the port is not updated, the parity
suites fail. That is the point of them.
🔐 What it never does
- It never sends your cookies. Every request goes out with credentials
omitted. Probing
/admin while you are logged in would be a self inflicted
CSRF.
- It never phones home. There is no backend, no analytics and no account.
Results live in the extension and nowhere else.
- It never starts on its own. The domain is pre-filled; nothing runs until
you press SCAN.
- It never shows a secret in full. Found credentials are always redacted.
A full scan is a few hundred requests. The ⚙ page lets you lower the
concurrency and add a delay, so you can be gentle with a fragile target.
🙏 Credits
Built on top of Kumo
by k0r1m. The rules, wordlists and
signatures in this extension are generated from that project's engine, so the
two stay in step. If you find this useful, star the main repo.
Kumo collects and correlates. The data belongs to the sources below, and they
deserve the credit far more than this repo does:
Respect each source's own terms of use and rate limits.
🌐 Ecosystem
| Tool | Domain |
|---|
| ☁️ | Kumo 蜘蛛 | domain OSINT & reconnaissance, CLI + dashboard · demo |
| 🧩 | Kumo browser extension | the same engine, in your browser |
| 🌍 | Demo site | Kumo & Kage showcase |
| 🌑 | Kage 影 | DFIR host triage |
⚠️ For authorized security testing only.
Only scan domains you own or have explicit written permission to test.
Free to use, modify and share for educational and personal purposes. Please
credit the work. Commercial use requires explicit permission from the author.
