Recon
Pull app-linked hosts without holding the APK
bevigil is the open-source command-line client for the BeVigil OSINT API, which indexes mobile applications to return a target's subdomains, URLs, hosts, parameters, and S3 buckets from a domain or app package.
installpip3 install bevigil-cli
Python · Apache-2.0 license
overview
What bevigil does
bevigil queries the BeVigil OSINT API, a dataset built by indexing mobile apps. Start from --domain for subdomains and urls, or from --package for hosts, params, s3, and wordlist. That surfaces infrastructure domain-only recon often misses.
Asset-type selects the lookup. Pair it with --domain, --package, --subdomain, or --keyword as the type requires. Every request needs a BeVigil API key supplied as a file input.
Public Library availability is not verified for this client. This page describes the upstream API job; its Agent handoff is not a published BeVigil Store entry or a promise that your account can run it. API access and quota belong to the BeVigil account.
use cases
Where bevigil fits
Pull subdomains and URLs for a domain
Query the subdomains or urls asset type for a domain to add app-sourced names and endpoints to a recon dataset that passive crawlers miss.
Recon a mobile app's backend
Look up hosts, parameters, and S3 buckets for an app package to map the infrastructure that mobile app talks to.
Find app-linked S3 buckets
Request the s3 asset type by keyword or package to surface storage buckets tied to the target, then hand them to a bucket scanner.
Seed parameter and wordlist discovery
Pull params and wordlist asset types for a package to seed fuzzing and parameter-discovery stages with target-specific values.
reference
bevigil inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| asset-type | STRING | · | Asset type: hosts, packages, params, s3, subdomains, urls, or wordlist. |
| domain | STRING | --domain | Domain to query (asset-type packages, subdomains, or urls). |
| package | STRING | --package | App package to request hosts for (asset-type host, params, s3, or wordlist). |
| subdomain | STRING | --subdomain | Subdomain to query (asset-type packages). |
| keyword | STRING | --keyword | Keyword to request S3 bucket info for (asset-type s3). |
| api_key | FILE | · | BeVigil API key file that authorizes the requests. |
Showing key inputs. bevigil exposes 6 inputs in total.
example
Run bevigil
# install and store the API key once (key from bevigil.com/osint-api)
pip3 install bevigil-cli
bevigil-cli init --api-key <API_KEY>
# app-sourced subdomains for a domain
bevigil-cli enum subdomains --domain example.com
# S3 buckets tied to a keyword
bevigil-cli enum s3 --keyword exampleguidance
Choosing bevigil
Use bevigil when you need app-sourced OSINT (subdomains, URLs, buckets, params) that domain-only tools miss. It requires a BeVigil API key. For passive subdomains without that API, use subfinder.
subfinder
Passive subdomain discovery across many free sources. bevigil adds the mobile-app angle behind an API key.
bbot
Modular OSINT engine that chains many sources. bevigil is a focused client for one rich dataset.
apkurlgrep
Pulls URLs from an APK on disk. Local sibling to bevigil's app-sourced URL data.
faq
bevigil questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run bevigil yourself
A domain feeds bevigil, which pulls app-sourced subdomains and URLs from the BeVigil API and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.