yellow

~ opinionated web scanning pipeline for pentesters in a hurry

git clone https://github.com/djnnvx/yellow.git

commit 7322a4e40a1296e912356685208ca20f701f4c21
parent ae462b97621c1b14481e69b115df0e1c732b3d68
Author: djnn <[email protected]>
Date: Mon, 10 Nov 2025 01:20:58 +0100

fix(docs): README

Diffstat:

A	README.md	\|	162	+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
D	README.txt	\|	161	-------------------------------------------------------------------------------

2 files changed, 162 insertions(+), 161 deletions(-)

diff --git a/README.md b/README.md
@@ -0,0 +1,162 @@
+~ yellow
+
+```
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣤⣤⣤⣤⣤⣤⣄⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+    ⠀              ⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠛⠻⠿⢿⣿⣿⣿⣿⣿⣶⣤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+   Y E L L O W ⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⣿⣿⣿⣿⣿⣿⣶⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣷⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀
+      --------  ⠀⠀⢸⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⣀⣀⣙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀
+        ⠀⠀⠀⠀  ⠀⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠻⣿⣿⣿⣿⣿⣿⣿⣄⠀⠀⠀⠀
+        djnn.sh⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⢹⣿⣿⣿⣿⣿⣿⣿⣆⠀⠀⠀
+        ⠀v0.0.5  ⠀⠀⢠⣿⣿⣿⣿⡟⠹⠿⠟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡿⠋⡬⢿⣿⣷⣤⣤⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠰⡇⢸⡇⢸⣿⣿⣿⠟⠁⢀⣬⢽⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣧⣈⣛⣿⣿⣿⡇⠀⠀⣾⠁⢀⢻⣿⣿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿⣿⣿⣿⣿⣧⣄⣀⠙⠷⢋⣼⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+        ⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+        ⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁
+        ⣿⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀
+        ⠸⣿⣿⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀
+        ⠀⢹⣿⣿⣧⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣄⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀
+        ⠀⠀⠹⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀
+        ⠀⠀⠀⠙⣿⣿⣿⣿⣿⣶⣤⣀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿s/o jenaye :)~⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀
+        ⠀⠀⠀⠀⠈⠻⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣾⣿⣿⣿⣿⣿⣿⣿⣿matro7sh⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠉⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠋⠅⠀⠀⠀⠀⠀⠀⠀⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠈⠂⠀⠀⠀
+        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠛⠛⠛⠛⠛⠛⠛⠋⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+
+    <=[ Pentest companion for scanning, OSINT, and quick wins ]=>
+```
+
+**yellow** is a tiny golang CLI to quickly set up scanning at the beginning of a pentest. :)~
+
+Based on yelaa: https://github.com/matro7sh/Yelaa.
+
+# 1. Disclaimer
+
+This software is provided as-is, at the discretion of professionals.
+Developpers assume no responsability for your lack of morals or overall stupidity.
+Please use at your own risk, in a controlled environnement. Thanks<3
+
+
+# 2. Roadmap
+
+For next version, i want to take care of at least two items described here:
+
+* scan: integrate browser-dependant tools (katana, ...) (still TBD),
+* osint: add support for more dorks
+
+## 2.a Bugfixes
+
+* sitemap should be stored to a file & fetch robots.txt
+
+feel free to suggest more ideas. :)~
+if you'd like to do so, reach me by mail or on social media: https://djnn.sh/pgp
+
+## 2.b Contributing
+
+This software's code is public, but not open to contributions.
+The reason for that is that if something is integrated, I want to make sure I
+am able to maintain it afterwards.
+
+# 3. Installing
+
+Using go v1.25.
+
+```bash
+git clone https://evil.djnn.sh/yellow.git
+
+cd yellow/
+
+make
+```
+
+## 3.a Using docker
+
+```bash
+cd yellow/
+
+make docker
+```
+
+# 4. Running
+
+## 4.a Create your directory tree
+
+At the beginning of your mission, you might want to have a nice little dir tree.
+Easy enough:
+
+```bash
+./yellow -d djnn.sh
+
+# example tree output for djnn.sh/
+djnn.sh
+├── extracted
+│   ├── assets
+│   ├── code
+│   └── creds
+├── scans
+│   ├── infra
+│   ├── nessus
+│   ├── screenshots
+│   └── ssl
+└── www
+    ├── exploits
+    └── tools
+
+13 directories, 0 files
+```
+
+## 4.b Run passive enumeration
+
+Run various scans to retrieve more targets, using OSINT techniques.
+
+```bash
+./yellow osint --help
+
+# or, if in a hurry
+./yellow osint -d djnn.sh
+```
+
+## 4.c Run active scans
+
+Run scans against the target actively. (You might want to use a proxy for this !)
+
+```bash
+./yellow scan --help
+
+# run scan on ports 80, 443, 8080 & 8443
+nmap -T4 -Pn -p 80,443,8080,8443 --open -oA domains -iL djnn.sh/scans/domains.txt
+cat *.gnmap | grep -i "open/tcp" | cut -d " " -f2 | sort -u > djnn.sh/scans/web-targets.txt
+
+# you can also just run the domains.txt file directly
+
+./yellow scan -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
+```
+
+#### Filter inactive web domains from a list of domains:
+
+The `osint` subcommand is nice, but as it retrieves historical domains, it means there are
+some domains that are not reachable anymore. To filter them out, you can run:
+
+```bash
+./yellow prune -f djnn.sh/scans/domains.txt -o djnn.sh/scans/cleaned-web-targets.txt
+```
+
+#### Retrieving CVEs automatically:
+
+We use vulnx( https://github.com/projectdiscovery/cvemap) under the hood to query CVEs based on
+initial fingerprinting. To get this feature working, you will need to create an account
+on ProjectDiscovery (https://cloud.projectdiscovery.io/) and retrieve an API key.
+
+Then you should set this key in your .bashrc (or equivalent) to VULNX_API_KEY.
+
+#### Running fingerprinting
+
+If you don't want to scan the whole website, but just run the fingerprint and retrieve the CVEs,
+you can also run this:
+
+```bash
+./yellow fingerprint -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
+```

diff --git a/README.txt b/README.txt
@@ -1,161 +0,0 @@
-~ yellow
-
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣤⣤⣤⣤⣤⣤⣄⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
-    ⠀              ⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠛⠻⠿⢿⣿⣿⣿⣿⣿⣶⣤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
-   Y E L L O W ⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⣿⣿⣿⣿⣿⣿⣶⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣷⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀
-      --------  ⠀⠀⢸⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⣀⣀⣙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀
-        ⠀⠀⠀⠀  ⠀⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠻⣿⣿⣿⣿⣿⣿⣿⣄⠀⠀⠀⠀
-        djnn.sh⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⢹⣿⣿⣿⣿⣿⣿⣿⣆⠀⠀⠀
-        ⠀v0.0.5  ⠀⠀⢠⣿⣿⣿⣿⡟⠹⠿⠟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡿⠋⡬⢿⣿⣷⣤⣤⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠰⡇⢸⡇⢸⣿⣿⣿⠟⠁⢀⣬⢽⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣧⣈⣛⣿⣿⣿⡇⠀⠀⣾⠁⢀⢻⣿⣿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿⣿⣿⣿⣿⣧⣄⣀⠙⠷⢋⣼⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
-        ⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
-        ⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁
-        ⣿⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀
-        ⠸⣿⣿⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀
-        ⠀⢹⣿⣿⣧⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣄⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀
-        ⠀⠀⠹⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀
-        ⠀⠀⠀⠙⣿⣿⣿⣿⣿⣶⣤⣀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿s/o jenaye :)~⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀
-        ⠀⠀⠀⠀⠈⠻⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣾⣿⣿⣿⣿⣿⣿⣿⣿matro7sh⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠉⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠋⠅⠀⠀⠀⠀⠀⠀⠀⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠈⠂⠀⠀⠀
-        ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠛⠛⠛⠛⠛⠛⠛⠋⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
-
-    <=[ Pentest companion for scanning, OSINT, and quick wins ]=>
-
-
-**yellow** is a tiny golang CLI to quickly set up scanning at the beginning of a pentest. :)~
-
-Based on yelaa: https://github.com/matro7sh/Yelaa.
-
-1. Disclaimer
-
-This software is provided as-is, at the discretion of professionals.
-Developpers assume no responsability for your lack of morals or overall stupidity.
-Please use at your own risk, in a controlled environnement. Thanks<3
-
-
-2. Roadmap
-
-For next version, i want to take care of at least two items described here:
-
-* scan: integrate browser-dependant tools (katana, ...) (still TBD),
-* osint: add support for more dorks
-
-2.a Bugfixes
-
-* sitemap should be stored to a file & fetch robots.txt
-
-feel free to suggest more ideas. :)~
-if you'd like to do so, reach me by mail or on social media: https://djnn.sh/pgp
-
-2.b Contributing
-
-This software's code is public, but not open to contributions.
-The reason for that is that if something is integrated, I want to make sure I
-am able to maintain it afterwards.
-
-3. Installing
-
-Using go v1.25.
-
-```bash
-git clone https://evil.djnn.sh/yellow.git
-
-cd yellow/
-
-make
-```
-
-3.a Using docker
-
-```bash
-cd yellow/
-
-make docker
-```
-
-4. Running
-
-4.a Create your directory tree
-
-At the beginning of your mission, you might want to have a nice little dir tree.
-Easy enough:
-
-```bash
-./yellow -d djnn.sh
-
-# example tree output for djnn.sh/
-djnn.sh
-├── extracted
-│   ├── assets
-│   ├── code
-│   └── creds
-├── scans
-│   ├── infra
-│   ├── nessus
-│   ├── screenshots
-│   └── ssl
-└── www
-    ├── exploits
-    └── tools
-
-13 directories, 0 files
-```
-
-4.b Run passive enumeration
-
-Run various scans to retrieve more targets, using OSINT techniques.
-
-```bash
-./yellow osint --help
-
-# or, if in a hurry
-./yellow osint -d djnn.sh
-```
-
-4.c Run active scans
-
-Run scans against the target actively. (You might want to use a proxy for this !)
-
-```bash
-./yellow scan --help
-
-# run scan on ports 80, 443, 8080 & 8443
-nmap -T4 -Pn -p 80,443,8080,8443 --open -oA domains -iL djnn.sh/scans/domains.txt
-cat *.gnmap | grep -i "open/tcp" | cut -d " " -f2 | sort -u > djnn.sh/scans/web-targets.txt
-
-# you can also just run the domains.txt file directly
-
-./yellow scan -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
-```
-
-[+] Filter inactive web domains from a list of domains:
-
-The `osint` subcommand is nice, but as it retrieves historical domains, it means there are
-some domains that are not reachable anymore. To filter them out, you can run:
-
-```bash
-./yellow prune -f djnn.sh/scans/domains.txt -o djnn.sh/scans/cleaned-web-targets.txt
-```
-
-[+] Retrieving CVEs automatically:
-
-We use vulnx( https://github.com/projectdiscovery/cvemap) under the hood to query CVEs based on
-initial fingerprinting. To get this feature working, you will need to create an account
-on ProjectDiscovery (https://cloud.projectdiscovery.io/) and retrieve an API key.
-
-Then you should set this key in your .bashrc (or equivalent) to VULNX_API_KEY.
-
-[+] Running fingerprinting
-
-If you don't want to scan the whole website, but just run the fingerprint and retrieve the CVEs,
-you can also run this:
-
-```bash
-./yellow fingerprint -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
-```