loading
Loading content
loading
Recon
CLI client for the BeVigil OSINT API, keyed by domain or app package.
overview
bevigil queries the BeVigil OSINT API, a dataset built by indexing mobile apps. Start from --domain for subdomains and urls, or from --package for hosts, params, s3, and wordlist. That surfaces infrastructure domain-only recon often misses.
Asset-type selects the lookup. Pair it with --domain, --package, --subdomain, or --keyword as the type requires. Every request needs a BeVigil API key supplied as a file input.
Wire subdomains and URLs into httpx, or S3 names into a bucket scanner. The managed recon node takes the API key file plus --domain or --package and writes a file and a folder of results.
use cases
Query the subdomains or urls asset type for a domain to add app-sourced names and endpoints to a recon dataset that passive crawlers miss.
Look up hosts, parameters, and S3 buckets for an app package to map the infrastructure that mobile app talks to.
Request the s3 asset type by keyword or package to surface storage buckets tied to the target, then hand them to a bucket scanner.
Pull params and wordlist asset types for a package to seed fuzzing and parameter-discovery stages with target-specific values.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| asset-type | STRING | · | Asset type: hosts, packages, params, s3, subdomains, urls, or wordlist. |
| domain | STRING | --domain | Domain to query (asset-type packages, subdomains, or urls). |
| package | STRING | --package | App package to request hosts for (asset-type host, params, s3, or wordlist). |
| subdomain | STRING | --subdomain | Subdomain to query (asset-type packages). |
| keyword | STRING | --keyword | Keyword to request S3 bucket info for (asset-type s3). |
| api_key | FILE | · | BeVigil API key file that authorizes the requests. |
Showing key inputs. bevigil exposes 6 inputs in total.
example
# app-sourced subdomains for a domainbevigil subdomains --domain example.com # S3 buckets tied to a keywordbevigil s3 --keyword example[*] Requesting subdomains for example.com from the BeVigil OSINT API api.example.comassets.example.comm.example.comstaging.example.comvpn.example.com [*] 5 subdomains written to bevigil/subdomains.txtguidance
Use bevigil when you need app-sourced OSINT (subdomains, URLs, buckets, params) that domain-only tools miss. It requires a BeVigil API key. For passive subdomains without that API, use subfinder.
Passive subdomain discovery across many free sources. bevigil adds the mobile-app angle behind an API key.
Modular OSINT engine that chains many sources. bevigil is a focused client for one rich dataset.
Pulls URLs from an APK on disk. Local sibling to bevigil's app-sourced URL data.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
A domain feeds bevigil, which pulls app-sourced subdomains and URLs from the BeVigil API and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.