Wednesday, July 24, 2024

Osmedeus – Fully Automated Offensive Security Tool for Reconnaissance & Vulnerability Scanning

Osmedeus is a fully automated tool that allows you to run the collection of awesome tools to reconnaissance and vulnerability scanning against the target.

How to use

If you have no idea what are you doing just type the command below or check out the Advance Usage.

./ -t

Installation in detail

For Kali Linux

git clone
cd Osmedeus

For *nix OS

Check out default shell and package manager in the install and you will be fine

git clone
cd Osmedeus

For MacOS

Install golang official or using homebrew and nmap, masscan. Setup your GOPATH like in the install file and you’re good to run. Most of those tools are work fine on MacOS but to install massdns you gonna need to change options to install it from make to make nolinux in

git clone
cd Osmedeus

This install only focus on Kali linux, check more install on Wiki page


  • Subdomain Scan.
  •  Subdomain TakeOver Scan.
  •  Screenshot the target.
  •  Basic recon like Whois, Dig info.
  •  IP Discovery.
  •  CORS Scan.
  •  SSL Scan.
  •  Headers Scan.
  •  Port Scan.
  •  Vulnerable Scan.
  •  Separate workspaces to store all scan output and details logging.
  •  REST API.
  •  SPA Web UI.
  •  Slack notifications.

Osmedeus will run as a Quick Speed:

  • Subdomain Scanning
  • ScreenShot the target
  • Subdomain TakeOver Scanning
  • Scanning for CorsScan
  • Discovery IP space
  • SSL Scan
  • Port Scanning and Vulnerable Scan

List all module

./ -M

Using specific module

Scanning subdomain and Subdomain TakeOver

./ -m subdomain -t

Screenshot the target

./ -m portscan -t

Port Scan and Vulnerable Scan on the target

./ -m portscan -t

Vulnerable Scan on the target

./ -m vuln -t

Doing directory search on the target

./ -m dir -t

Doing brute force on the service result from scanning service

./ -m brute -t

Git repo scanning

./ -m git --git

Doing some stuff with Burp State file

./ -m burp -t --burp yourburpstate.xml



Most of this tool done by the authors of the tool that you can see in the module folder. I just put all the pieces together, plus some extra boring stuff that we don’t wanna do everyday.

This tool is for educational purposes only. You are responsible for your own actions. If you mess something up or break any laws while using this software, it’s your fault, and your fault only.


Please take a look at


Please take a look at

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

ShadowRoot Ransomware Attacking Organizations With Weaponized PDF Documents

A rudimentary ransomware targets Turkish businesses through phishing emails with ".ru" domain sender addresses....

BreachForumsV1 Database Leaked: Private messages, Emails & IP Exposed

BreachForumsV1, a notorious online platform for facilitating illegal activities, has reportedly suffered a massive...

250 Million Hamster Kombat Players Targeted Via Android And Windows Malware

Despite having simple gameplay, the new Telegram clicker game Hamster Kombat has become very...

Beware Of Malicious Python Packages That Steal Users Sensitive Data

Malicious Python packages uploaded by "dsfsdfds" to PyPI infiltrated user systems by exfiltrating sensitive...

Chinese Hackers Using Shared Framework To Create Multi-Platform Malware

Shared frameworks are often prone to hackers' abuses as they have been built into...

BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world's fastest Android emulator and cloud...

Google Chrome 127 Released with a fix for 24 Security Vulnerabilities

Google has unveiled the latest version of its Chrome browser, Chrome 127, which is...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles