Advanced, modular, CLI-based reconnaissance framework for red teams.
Built by Yash Javiya
Overview •
Features •
Integrated Arsenal •
Installation •
Usage
Runtime Control •
Reports •
Support •
Disclaimer
KESTREL is an advanced, modular reconnaissance automation engine designed for red teamers and penetration testers. Unlike simple wrapper scripts, KESTREL orchestrates a multi-stage intelligence gathering pipeline—from passive OSINT to active scanning—within a single, interactive CLI environment.
It eliminates the need for manual tool chaining by handling dependencies, directory structures, and report generation automatically, allowing you to focus on analyzing the results rather than running commands.
- Multi-Layered Pipeline: Seamlessly chains Whois → Subdomains → Live Host Probing → Port Scanning → Screenshots.
- Modular Design: A plugin-based architecture (located in
Modules/) allowing for easy extensibility. - Smart Dependencies: Auto-detects and installs missing external binaries (Nmap, Amass, Subfinder) on first run.
- Batch Processing: Supports
@targets.txtinput to process hundreds of domains sequentially.
- Interactive Menu: A robust CLI menu system for selecting specific modules or running full automation.
- Runtime Interception: Unique feature allowing users to Skip (
s) or Quit (q) specific modules manually while they are running, without killing the entire session.
- Professional HTML Reports: Generates interactive, dashboard-style HTML reports containing all findings.
- Visual Evidence: Embeds automated screenshots of live web services directly into the report.
KESTREL unifies the following industry-standard tools into its workflow:
| Tool | Purpose |
|---|---|
| Kestrel Engine | Custom Python core for multi-threaded module orchestration. |
| Runtime Control | Real-time process management (Skip/Quit) without session kill. |
| Tool | Purpose |
|---|---|
| Whois | Domain registration intelligence & ownership details. |
| Dig | DNS Record enumeration (A, MX, NS, TXT, SOA). |
| Tool | Purpose |
|---|---|
| Subfinder | Fast passive subdomain enumeration using online sources. |
| Amass | Deep, comprehensive subdomain mapping and OSINT. |
| Tool | Purpose |
|---|---|
| HTTPX-Toolkit | Active probing to identify live web servers and status codes. |
| Tool | Purpose |
|---|---|
| Nmap | Advanced port scanning & service version detection. |
| Tool | Purpose |
|---|---|
| Eyewitness | Automated visual reconnaissance of web applications. |
- OS: Linux (Kali, Debian, Ubuntu recommended)
- Python: Version 3.8+
# Clone the repository
git clone https://github.com/instroyer/KESTREL.git
# Navigate to directory
cd KESTREL
# Install dependencies
pip install -r requirements.txtNote: KESTREL will automatically attempt to install external tools (like Subfinder, Amass) if they are missing from your system path during the first run.
Simply run the main script to start the interactive wizard:
python3 kestrel.py| Option | Mode | Description |
|---|---|---|
| 0 | Run All | 🚀 Recommended. Executes the full pipeline (Whois → Visual). |
| 1 | Whois | Basic domain registration info. |
| 2 | Dig | DNS record analysis (A, MX, NS, TXT). |
| 3 | Subfinder | Passive subdomain gathering only. |
| 4 | Amass | Deep subdomain enumeration only. |
| 5 | HTTPX | Check for live web servers. |
| 6 | Nmap | Network mapping with various intensity levels. |
| 7 | Visual | Eyewitness Screenshot capture. |
You can run combinations of modules by entering numbers separated by spaces:
1 2 5: Runs Whois, Dig, and HTTPX sequentially.3 5: Runs Subfinder and then probes for live hosts.
KESTREL features a unique runtime controller that lets you manage scans dynamically.
Trigger: Type 00 and hit ENTER while a module is running.
| Command | Action |
|---|---|
s |
Skip: Aborts the current module (e.g., stops a long Amass scan) and moves instantly to the next step. |
q |
Quit: Safely terminates the entire KESTREL session. |
All results are organized automatically by target:
Results/
└── example.com/
├── reports/ # Final HTML Reports
├── scans/ # Raw tool logs (nmap.xml, amass.txt)
└── screenshots/ # Eyewitness captures
If you find KESTREL useful for your red team operations, please consider supporting:
- ⭐ Star the repository on GitHub.
- ☕ Tip the Developer: Buy me a Coffee on Ko-fi!
KESTREL is a powerful reconnaissance tool designed for authorized security testing ONLY.
By downloading and using this software, you agree that:
- ✅ You will use it only on systems you own or have explicit written permission to test.
- ❌ The developers assume NO LIABILITY for misuse or damage caused by this software.
- ❌ Unauthorized access to computer systems is illegal.
Built for Red Teams, by Yash Javiya
