Recon
Pull app-linked hosts without holding the APK
CLI client for the BeVigil OSINT API, keyed by domain or app package.
overview
What bevigil does
bevigil queries the BeVigil OSINT API, a dataset built by indexing mobile apps. Start from --domain for subdomains and urls, or from --package for hosts, params, s3, and wordlist. That surfaces infrastructure domain-only recon often misses.
Asset-type selects the lookup. Pair it with --domain, --package, --subdomain, or --keyword as the type requires. Every request needs a BeVigil API key supplied as a file input.
Wire subdomains and URLs into httpx, or S3 names into a bucket scanner. The managed recon node takes the API key file plus --domain or --package and writes a file and a folder of results.
use cases
Where bevigil fits
Pull subdomains and URLs for a domain
Query the subdomains or urls asset type for a domain to add app-sourced names and endpoints to a recon dataset that passive crawlers miss.
Recon a mobile app's backend
Look up hosts, parameters, and S3 buckets for an app package to map the infrastructure that mobile app talks to.
Find app-linked S3 buckets
Request the s3 asset type by keyword or package to surface storage buckets tied to the target, then hand them to a bucket scanner.
Seed parameter and wordlist discovery
Pull params and wordlist asset types for a package to seed fuzzing and parameter-discovery stages with target-specific values.
reference
bevigil inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| asset-type | STRING | · | Asset type: hosts, packages, params, s3, subdomains, urls, or wordlist. |
| domain | STRING | --domain | Domain to query (asset-type packages, subdomains, or urls). |
| package | STRING | --package | App package to request hosts for (asset-type host, params, s3, or wordlist). |
| subdomain | STRING | --subdomain | Subdomain to query (asset-type packages). |
| keyword | STRING | --keyword | Keyword to request S3 bucket info for (asset-type s3). |
| api_key | FILE | · | BeVigil API key file that authorizes the requests. |
Showing key inputs. bevigil exposes 6 inputs in total.
example
Run bevigil
# app-sourced subdomains for a domainbevigil subdomains --domain example.com # S3 buckets tied to a keywordbevigil s3 --keyword example[*] Requesting subdomains for example.com from the BeVigil OSINT API api.example.comassets.example.comm.example.comstaging.example.comvpn.example.com [*] 5 subdomains written to bevigil/subdomains.txtguidance
Choosing bevigil
Use bevigil when you need app-sourced OSINT (subdomains, URLs, buckets, params) that domain-only tools miss. It requires a BeVigil API key. For passive subdomains without that API, use subfinder.
subfinder
Passive subdomain discovery across many free sources. bevigil adds the mobile-app angle behind an API key.
bbot
Modular OSINT engine that chains many sources. bevigil is a focused client for one rich dataset.
apkurlgrep
Pulls URLs from an APK on disk. Local sibling to bevigil's app-sourced URL data.
faq
bevigil questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run bevigil yourself
A domain feeds bevigil, which pulls app-sourced subdomains and URLs from the BeVigil API and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.