Scanners
Run custom signatures against live web targets
Signature-driven web application scanner.
overview
What jaeles does
jaeles fires a selected signature set at each target and records matches. Each signature is one request plus one detection condition, so you swap rules per engagement without rewriting the engine.
Reach for it when you have live URLs or a Burp --raw export and a curated --signs selector. Use --exclude and --level to trim the set; --json and --html write structured findings and a report folder.
Trickest provides jaeles as a managed Scanners node. Targets in, findings folder out. Chain after httpx or a crawler. Prefer nuclei when you want a large community template library instead of your own signatures.
use cases
Where jaeles fits
Run custom signatures against a target
Select a signature set with the --signs selector and scan a URL or URL file so each rule sends its request and reports the matches as findings.
Replay authenticated Burp requests
Feed a raw request exported from Burp with --raw so jaeles tests real, authenticated traffic against your signatures instead of an unauthenticated guess.
Scan a large surface in chunks
Enable chunk mode on a big URL list so jaeles splits the input with --chunk and runs signatures in batches without overloading one pass.
Produce a report for the writeup
Store output as JSON and generate an HTML report so findings land in a shareable artifact alongside the rest of the workflow results.
reference
jaeles inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | URL of the target to scan. |
| urls | FILE | --urls | File of target URLs for bulk scanning. |
| raw | FILE | --raw | Raw request exported from Burp, used as the origin request. |
| signatures | STRING | --signs | Signature selector for the rules to run. Multiple selectors are accepted. |
| exclude | STRING | --exclude | Exclude a signature selector. Multiple flags are accepted. |
| level | STRING | --level | Filter signatures by level so only rules at or above the threshold run (default 1). |
| json | BOOLEAN | --json | Store output as JSON. |
| html | BOOLEAN | --html | Generate an HTML report after the scan finishes. |
Showing key inputs. jaeles exposes 50 inputs in total.
Full flag reference (50 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| raw | FILE | --raw | Raw request from Burp for origin |
| url | STRING | --url | URL of target |
| html | BOOLEAN | --html | Generate an HTML report after the scan finishes |
| json | BOOLEAN | --json | Store output as JSON |
| urls | FILE | --urls | URLs file of target |
| chunk | BOOLEAN | --chunk | Enable chunk running against big input |
| debug | BOOLEAN | --debug | Enable debug output |
| delay | STRING | --delay | Delay time between requests |
| found | STRING | --found | Run a host OS command when a vulnerability is found |
| level | STRING | --level | Filter signature by level (default 1) |
| local | BOOLEAN | --local | Enable local analyze (accept input as a local path) |
| no-db | BOOLEAN | --no-db | Disable the database |
| proxy | STRING | --proxy | HTTP proxy to route requests through |
| quiet | BOOLEAN | --quiet | Quiet output |
| retry | STRING | --retry | HTTP retry count |
| title | STRING | --title | Report title name |
| config | FILE | --config | Config file (default is $HOME/.jaeles/config.yaml) |
| inline | STRING | --inline | Inline detections |
| params | STRING | --params | Custom params -p='foo=bar' (multiple -p flags are accepted) |
| report | STRING | --report | Report name |
| scanID | STRING | --scanID | Scan ID |
| single | BOOLEAN | --single | Disable parallel mode (use this when a signature needs single-threaded logic) |
| exclude | STRING | --exclude | Exclude signature selector (multiple flags are accepted) |
| headers | STRING | --headers | Custom headers (e.g: -H 'Referer: {{.BaseURL}}') (multiple flags are accepted) |
| passive | BOOLEAN | --passive | Turn on passive detections |
| refresh | STRING | --refresh | Refresh time for background task (default 10) |
| rootDir | FOLDER | --rootDir | Root project (default "~/.jaeles/") |
| signDir | FOLDER | --signDir | Folder containing default signatures (default "~/.jaeles/base-signatures/") |
| threads | STRING | --threads | Set the concurrency level inside a single signature (default 10) |
| timeout | STRING | --timeout | HTTP timeout (default 20) |
| verbose | BOOLEAN | --verbose | Verbose output |
| base-url | BOOLEAN | --ba | Shortcut to take raw input as {{.BaseURL}} |
| save-raw | BOOLEAN | --save-raw | Save the raw request |
| chunk-dir | STRING | --chunk-dir | Temp directory to store the chunk directory |
| no-output | BOOLEAN | --no-output | Do not store output |
| chunk-size | STRING | --chunk-size | Chunk size (default 20000) |
| signatures | STRING | --signs | Signature selector (multiple -s flags are accepted) |
| always-true | BOOLEAN | --at | Enable Always True detection to observe the response |
| chunk-limit | STRING | --chunk-limit | Limit size to trigger a chunk run (default 200000) |
| concurrency | STRING | --concurrency | Set the concurrency level (default 20) |
| local-proxy | BOOLEAN | --lc | Shortcut for '--proxy http://127.0.0.1:8080' |
| quietFormat | STRING | --quietFormat | Format for quiet output (default "{{.VulnURL}}") |
| format-input | BOOLEAN | --format-input | Enable special input format |
| selectorFile | FILE | --selectorFile | Signature selector from a file |
| chunk-threads | STRING | --chunk-threads | Number of chunk threads (default 2) |
| no-background | BOOLEAN | --no-background | Do not run background task (default true) |
| store-verbose | BOOLEAN | --sverbose | Store verbose info in the summary file |
| filtering-mode | BOOLEAN | --fi | Enable filtering mode (to use Diff() detection) |
| passive-selector | STRING | --sp | Selector for passive detections (default "*") |
| disable-replicate-request | BOOLEAN | --dr | Shortcut to disable replicate request (avoid sending many requests to timeout) |
example
Run jaeles
# run custom signatures against live URLs, store JSON and an HTML reportjaeles scan --urls live-urls.txt --signs 'common/.*' --level 2 --json --html[*] Loaded 1042 signatures[*] Start scanning 37 URLs from live-urls.txt[High][GET] Spring Boot Actuator env exposure - https://api.example.com/actuator/env[Medium][GET] Open Redirect - https://app.example.com/out?url=//198.51.100.24[Low][GET] Exposed .git directory - https://staging.example.com/.git/config[*] Done. 3 findings written to jaeles-report/[*] HTML report: jaeles-report/index.htmlguidance
Choosing jaeles
Use jaeles when live hosts need a curated custom-signature pass, especially with --raw Burp replay for authenticated flows. It tests; it does not discover. Feed httpx or crawler output first. For broader community templates, nuclei is the usual peer.
nuclei
Template-driven scanner with a large community library. jaeles centers on custom signatures and Burp --raw replay.
nikto
Classic web server scanner with fixed checks. jaeles is signature-driven and easier to extend per engagement.
wapiti
Black-box crawler that injects as it walks. jaeles runs your chosen detection rules against known targets.
faq
jaeles questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
nikto
Bundled web server checks for dangerous files and outdated software.
Run jaeles yourself
A URL list is probed by httpx, then jaeles runs its signatures against the live hosts and writes the findings folder for triage.
Facts on this page come from the live Trickest tool library.