Overview

In the world of web application penetration testing and bug bounty hunting, reconnaissance is the most crucial phase. Finding exposed subdomains, hidden directories, sensitive files, or misconfigured security headers often makes the difference between finding a critical bug and walking away empty-handed.

To streamline this process, I built Ghost Engine v3.2 — an all-in-one Python automation suite designed to execute fast, parallel reconnaissance, surface security vulnerabilities, and generate clean reports without needing complex multi-tool setups.

Key Features of Ghost Engine v3.2

• WAF Detection & OWASP Headers: Automatically identifies Cloudflare, Akamai, and AWS WAFs while flagging missing critical security headers (HSTS, CSP, X-Frame-Options).
• SSL/TLS Inspection: Audits domain SSL certificate validity and expiration details directly via sockets.
• Multithreaded Port Scanner: Scans high-value target service ports concurrently.
• Subdomain Enumeration & Takeover Checks: Resolves active subdomains and searches for dangling third-party service signatures (GitHub Pages, Heroku, AWS S3).
• GraphQL & OOB SSRF Probes: Detects exposed GraphQL introspection endpoints and injects callback headers to test for Server-Side Request Forgery.
• Path & Route Discovery: Bruteforces sensitive endpoints (/.env, /.git/HEAD, /admin/, /config.php) using worker threads.
• Automated Reporting: Compiles all findings into a structured local text file (ghost_engine_report.txt).

Installation & Setup

Clone the repository

git clone https://github.com/ghostprotocolsha/ghost_engine.git

Navigate into the folder

cd ghost_engine

Make the script executable

chmod +x ghost_engine.py

Install dependencies

pip install requests

How to Use Ghost Engine

#To run a complete surface scan against a target URL

python3 ghost_engine.py -u https://example.com

#To enumerate subdomains and identify takeover risks

python3 ghost_engine.py -sub example.com

#To brute-force directories using a custom wordlist

python3 ghost_engine.py -u https://example.com -w /path/to/wordlist.txt

⚠️ Disclaimer: This tool is strictly created for educational purposes, authorized security testing, and official bug bounty programs only.