Who WebCheck-OSINT is for#
Security researchers profiling a domain before an assessment
Run a full 44-check scan to gather IP, SSL, DNS, open ports, headers, tech stack, firewall, and CVE data before engaging with a target. The unified dashboard saves the time of switching between half a dozen separate lookup tools.
Skip if:
Skip if you need continuous monitoring or historical DNS change tracking. WebCheck-OSINT produces a one-time snapshot, not a time-series view.
Developers auditing their own site for misconfigurations
Check HSTS headers, content security policy, mixed content warnings, DMARC and SPF records, and TLS grade in one scan. Useful before a production launch or after a configuration change to confirm nothing is misconfigured.
Skip if:
Skip if you need authenticated-session scanning. WebCheck-OSINT scans the public-facing view of a site and does not log in or test protected routes.
Website owners checking for third-party trackers
The Trackers and Third Parties check lists analytics tools, ad trackers, and other third-party scripts the page loads. Combined with the Cookies check, it gives a quick privacy inventory of what a first-time visitor's browser sends.
Skip if:
Skip if the site defers third-party tags via client-side JavaScript that loads after the initial render. Some dynamically injected trackers may not appear in the scan.
Penetration testers running OSINT in pre-engagement recon
Covers the standard OSINT data collection phase: IP and ASN, WHOIS, associated hosts, subdomains from CT logs, open ports, redirect chain, and DNS records. The tool consolidates this into a single structured output rather than requiring Shodan, WHOIS, and DNS lookup tools separately.
Skip if:
Skip if your engagement requires evidence-grade documentation with source citations. Export the results and document them separately; the tool does not produce a formatted recon report.
The problem it solves#
Manually auditing a website's security configuration requires checking DNS records, SSL chain details, HTTP headers, DNSSEC settings, open ports, firewall rules, and WHOIS data, usually across half a dozen separate tools. Each lookup is slow, and the results live in different tabs with no unified view.
Commercial OSINT tools like Shodan and SecurityTrails consolidate this reconnaissance but charge per query or require API subscriptions. For a developer doing a one-time audit or a security researcher running assessments regularly, those costs become hard to justify when most of the underlying data comes from public sources like certificate transparency logs, DNS resolvers, and WHOIS databases.
How it solves it#
44 Reconnaissance Checks in One Scan
Runs IP geolocation, SSL chain inspection, DNS record lookup, open port detection, HTTP header analysis, DNSSEC verification, HSTS check, tech stack fingerprinting, firewall detection, sitemap parsing, and more in a single request. The full list covers 44 distinct data points, from carbon footprint estimates to TLS client compatibility.
TLS Security Audit with SSL Labs Grade
Runs a live TLS handshake and reports the accepted TLS versions, cipher suite, and certificate details. A separate TLS Security Audit check pulls the SSL Labs grade for the server's configuration, and a TLS Client Compatibility check reports whether Chrome, Safari, older Android, and Java clients can still connect.
CVE and Vulnerability Lookup via Shodan
Queries Shodan's database for CVEs linked to the services running on the target host. This surfaces known vulnerabilities on the specific server without requiring a Shodan account on the caller's side, since the check runs server-side during the scan.
Data Breach and Malware Status Checks
Cross-references the domain against Have I Been Pwned for known data breaches and against common malware and phishing blocklists. Also checks privacy-focused, parental-control, and security resolvers to report whether any of them block the site.
Email Security Record Analysis
Reads MX, SPF, DKIM, and DMARC records for the domain and reports whether each is configured correctly. This helps website owners confirm their sending domain is protected against spoofing and that inbound mail is routed as expected.
Subdomain Discovery via Certificate Transparency
Pulls subdomains that have appeared in public Certificate Transparency logs. CT logs are a public record of every TLS certificate issued for a domain, so this surfaces subdomains without brute-force enumeration.
Strengths and trade-offs#
Strengths
- MIT License with No Usage RestrictionsThe MIT license lets you run WebCheck-OSINT on your own infrastructure, modify the code, and use it commercially without restriction. Unlike Shodan or SecurityTrails, which require API keys and charge per query, the self-hosted version has no per-scan cost once deployed.
- 44 Data Points in Under 20 SecondsThe tool parallelizes its checks server-side and returns a full dashboard view in roughly 20 seconds per domain. Replicating those checks manually across separate tools would take significantly longer, and the unified view means no copy-pasting between tabs.
- Four Self-Hosting PathsThe README documents Netlify one-click deployment, Vercel one-click deployment, Docker, and from-source installation. This gives teams flexibility to match the deployment model to their infrastructure, from a personal server to a managed platform.
- Public Data Sources, No Proprietary IndexWebCheck-OSINT queries publicly available sources: certificate transparency logs, WHOIS, DNS resolvers, the Shodan API for CVEs, Have I Been Pwned, and public malware blocklists. Results are as fresh as those sources and do not depend on a proprietary scanning network.
Trade-offs
- -No Historical Data or Trend MonitoringEach scan is a point-in-time snapshot. The tool does not store results or show how a domain's configuration has changed over weeks or months. Commercial tools like SecurityTrails keep historical DNS records and track infrastructure changes over time, which WebCheck-OSINT does not.
- -CVE Results Depend on Shodan CoverageThe vulnerability check queries what Shodan has indexed for the host IP. If Shodan has not scanned that IP recently, the CVE list will be empty or incomplete. This is a limitation of relying on Shodan as the data source rather than running a local vulnerability scan.
WebCheck-OSINT vs alternatives#
WebCheck-OSINT vs SecurityTrails
SecurityTrails is a DNS and domain intelligence service that stores historical records for billions of domains. It tracks how a domain's DNS configuration has changed over months and years, and exposes that history through an API.
| Feature | WebCheck-OSINT | SecurityTrails |
|---|---|---|
| License | MIT (open source) | Proprietary |
| Self-hosting | Yes | No |
| Historical DNS data | No | Yes |
| Live checks per scan | 44 | DNS-focused |
| Pricing | Free self-hosted | API subscription |
WebCheck-OSINT is the better fit when you need a point-in-time security snapshot of a domain covering SSL, TLS, headers, ports, and email config in a single run. SecurityTrails is the stronger choice when historical DNS change tracking is the primary requirement, for example, tracking when a domain's nameservers changed or reconstructing a target's infrastructure over time.
WebCheck-OSINT vs Shodan
Shodan maintains a continuously updated search index of internet-connected devices, mapping open ports, services, and known CVEs across the public internet. WebCheck-OSINT uses Shodan's API as one of its data sources for the CVE lookup check.
| Feature | WebCheck-OSINT | Shodan |
|---|---|---|
| License | MIT (open source) | Proprietary |
| Self-hosting | Yes | No |
| Continuous scanning | No | Yes |
| Bulk device search | No | Yes |
| Per-domain OSINT | 44 checks | Port/CVE focused |
| Pricing | Free self-hosted | Free (limited) / Paid |
Shodan is more powerful for bulk infrastructure research and continuous monitoring of internet-facing assets. WebCheck-OSINT is better for a quick, per-domain security assessment covering DNS, SSL, TLS, headers, email config, and breach history in one place. If you need Shodan's depth on a specific domain, WebCheck-OSINT surfaces the relevant subset without requiring a Shodan account.
Quick start#
Self-hosting deploys the Node.js server from source; one-click Netlify and Vercel options are also documented in the README.
```bash
git clone https://github.com/mwakidenis/WebCheck-OSINT
cd WebCheck-OSINT
npm install
npm start
```What it's built on#
- Languages
- JavaScriptTypeScript
- Frameworks
- ExpressReactSvelte
- Infrastructure
- Docker
FAQ#
Is WebCheck-OSINT free to use?
Yes. The tool is MIT licensed and free to self-host. You can run it on your own server, on Netlify, or on Vercel at no software cost. Some checks (such as the CVE lookup via Shodan) query third-party APIs server-side, but WebCheck-OSINT itself has no usage fees.
How does WebCheck-OSINT differ from Shodan?
Shodan is a search engine that maintains a continuously updated index of internet-connected devices and their open ports, services, and vulnerabilities. WebCheck-OSINT runs live checks against a specific domain on demand and uses Shodan's API as one of its data sources for CVE lookups. WebCheck-OSINT covers a broader set of checks (SSL, DNS, headers, TLS audit, email config, breach history) but does not provide Shodan's historical depth or bulk device search.
Can I run WebCheck-OSINT on any public website?
Yes, for any publicly accessible domain. The tool queries publicly available data sources: DNS records, certificate transparency logs, WHOIS, public blocklists, and publicly reachable server endpoints. It does not attempt to authenticate to protected areas or exploit vulnerabilities.
What does the TLS Security Audit check return?
It runs an SSL Labs audit against the server and returns the SSL Labs grade (A+, A, B, etc.) along with the accepted TLS versions, cipher suite used in a live handshake, and whether older clients such as Android 4.x or Java 7 can connect. This gives a quick compliance-level view of the server's TLS configuration.
Does WebCheck-OSINT store my scan results?
Results are not persisted server-side by default in the self-hosted version. Each scan runs live and returns data to the browser session. If you need to save results, export them from the dashboard before closing the tab.
Similar open-source tools#
Markdown Preview Editor
30 GitHub starsBrowser-only Markdown editor with live preview and strict privacy.
Alternative to
Typora
Falkon
494 GitHub starsSpeed-first browser for KDE Plasma with built-in ad blocking
Alternative to
Google Chrome
Floorp
8,452 GitHub starsFirefox fork with advanced privacy controls and UI customization
Alternative to
Brave Browser
REA (Reverse Engineer Anything)
345,900 GitHub starsAI-powered reverse engineering for binaries, apps, and assemblies.
Alternative to
RevEng.AI