Pricing

Rating

Developer

Actor stats

Categories

Share

Ghost-Target: Shadow Discovery

Actor 1 of 3 in the Ghost-Target Autonomous Red Team Pipeline.

Performs fully passive external reconnaissance against a target domain. Pulls data from certificate transparency logs, Wayback Machine archives, passive subdomain enumeration, live HTTP probing, GitHub code search, and optional Shodan/Censys enrichment — building a structured "Ghost Inventory" of every asset the target has ever exposed on the internet.

No active scanning. No packets sent to the target. Pure intelligence gathering.

What It Does

Phase 1 — Subdomain Enumeration

Queries three independent passive sources in parallel:

Phase 2 — GitHub Leak Detection

Searches GitHub for public repositories containing sensitive references to the target domain using 9 dorks:

• Exposed .env files with credentials
• docker-compose.yml files with passwords
• .npmrc files with auth tokens
• API keys, secret keys, access tokens
• PEM certificates

Phase 3 — Live HTTP Probing

Probes every discovered subdomain over both HTTP and HTTPS using native Node.js:

• HTTP status codes and redirect chains
• Page titles
• Web server headers (Server, X-Powered-By)
• Technology fingerprinting (WordPress, Jenkins, Jira, Confluence, GitLab, phpMyAdmin)

Phase 4 — Shodan Enrichment (Optional)

If a Shodan API key is provided, resolves each live host's IP and fetches:

• Open ports
• Operating system
• Organization
• Known CVEs (Shodan's own database)

Phase 5 — Risk Scoring

Each asset gets a 0–100 risk score:

Phase 6 — Recursive OSINT (Optional)

When recursiveDepth > 0, newly discovered high-risk subdomains (riskScore ≥ 30) automatically trigger sub-recon. Useful for discovering deeply nested infrastructure (e.g. dev.api.internal.example.com).

Input

Tip: When running Actor 1 manually and chaining to Actor 2, pass your apifyApiToken so that downstream actors can access the shared KVS.

Output

Dataset

One row per discovered subdomain:

{
"subdomain":"dev.example.com",
"isLive":true,
"ip":"1.2.3.4",
"sources":["crt.sh","wayback","subfinder"],
"statusCode":200,
"title":"Dev Portal - Example Inc",
"webServer":"nginx/1.18.0",
"technologies":["nginx/1.18.0","PHP/7.4"],
"openPorts":[22,80,443,3306],
"shodanVulns":["CVE-2021-44228"],
"org":"Example Inc",
"highValuePaths":["/.env","/admin"],
"isNew":true,
"firstSeen":"2026-05-15T09:44:56.000Z",
"lastSeen":"2026-05-15T09:44:56.000Z",
"riskScore":85
}

Key-Value Store (ghost-target-brain)

Saves the full brain state to surface__{domain}:

{
"domain":"example.com",
"subdomains":{"dev.example.com":{"firstSeen":"...","riskScore":85}},
"waybackPaths":["/.env","/admin/login","/api/v2/users"],
"githubLeaks":[{"repo":"user/leaked-repo","file":".env","url":"..."}],
"lastRunSummary":{
"totalSubdomains":47,
"newAssets":3,
"liveAssets":31,
"highRiskAssets":5
},
"runCount":2
}

Actor Output (OUTPUT)

{
"domain":"example.com",
"totalSubdomains":47,
"newAssets":3,
"liveAssets":31,
"highRiskAssets":5,
"githubLeakRefs":2,
"waybackPathsIndexed":4821,
"kvsKey":"surface__example.com"
}

Automatic Pipeline Chaining

When logicEngineActorId is set, this actor automatically triggers Actor 2 (Logic Engine) via the Apify API as soon as it completes — passing the targetDomain, globalKvsName, and apifyApiToken so the scan continues without manual intervention.

Actor 1 finishes → webhook → Actor 2 starts → webhook → Actor 3 starts

Prerequisites

This actor uses two Go binaries bundled in the Docker image:

• subfinder v2.6.6 — passive subdomain enumeration
• httpx v1.6.10 — HTTP probing and tech fingerprinting

Both are downloaded as pre-built binaries at Docker build time — no Go compiler needed at runtime.

Usage Example

Standalone run

{
"targetDomain":"example.com",
"waybackLimit":5000,
"recursiveDepth":1,
"githubToken":"ghp_xxxxxxxxxxxx",
"shodanApiKey":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"globalKvsName":"ghost-target-brain"
}

With full pipeline chaining

{
"targetDomain":"example.com",
"logicEngineActorId":"YOUR_USERNAME/ghost-logic-engine",
"globalKvsName":"ghost-target-brain",
"apifyApiToken":"apify_api_xxxxxxxxxxxxxxxxxxxxxxxx",
"githubToken":"ghp_xxxxxxxxxxxx",
"shodanApiKey":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Safe Test Targets

Legal Notice

This tool is for authorized penetration testing and security research only. Always obtain written permission before running reconnaissance against any domain. Unauthorized use may violate computer fraud and abuse laws in your jurisdiction.