Web-Check: 34.8K-Star OSINT Tool Exposes Website Attack Surface in 30 Seconds

Overview

Web-Check is an open-source MIT-licensed OSINT and security audit tool developed by Alicia Sykes (lissy93) with 34.8K+ GitHub stars. It aggregates over 30 OSINT checks and security baseline audits into a single-page dashboard, allowing users to input a domain and receive comprehensive results within seconds.

Eight Analysis Modules

1. Basic Network & Domain Intelligence

IP Information : Resolves domain to IP, ASN, ISP — starting point for external reconnaissance.

Server Geolocation : Maps IP location with country, timezone, ISP for compliance assessment.

Whois Domain Info : Registration/expiry dates, nameservers; short registration often indicates phishing.

Tranco Global Traffic Rank : Multi-source dataset for quick traffic volume estimation.

2. DNS & Domain Security

Full DNS Records : Retrieves A, AAAA, MX, NS, CNAME, TXT, SOA. MX reveals email provider (Microsoft 365, Google Workspace); NS shows DNS host.

DNSSEC : Checks DNSSEC, DoH, DoT; missing DNSSEC enables cache poisoning.

Associated Hosts / Subdomain Enumeration : Finds subdomains, a common weak point for bug bounty hunters.

3. TLS/SSL Certificate & Encryption Audit

SSL Certificate Chain : Shows CA, issue/expiry dates, algorithms, SAN fields for other subdomains.

TLS Cipher Suites : Lists supported suites, flags weak algorithms like RC4, 3DES.

TLS Configuration Assessment : Grades Modern/Intermediate/Old per Mozilla TLS Observatory, with remediation.

Multi-client TLS Handshake Simulation : Simulates Chrome, Firefox, Safari, iOS, Android handshakes.

HSTS Check : Verifies HSTS enabled, max-age, includeSubDomains, preload status.

4. HTTP Security Configuration Audit

HTTP Response Headers : Identifies Server, X-Powered-By leaking version/framework.

OWASP Secure Headers Check : Validates CSP, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection.

Cookie Security Analysis : Parses each cookie for Secure, HttpOnly, SameSite attributes.

Redirect Chain Tracing : Tracks 301/302/307 redirects, spots HTTP downgrade risks.

WAF Identification : Detects Cloudflare, AWS WAF, ModSecurity, etc., crucial for pentest bypass planning.

5. Email Security (Key Differentiator)

BEC (Business Email Compromise) is the costliest cyber attack; SPF/DKIM/DMARC configuration determines domain spoofing risk.

SPF : Parses DNS TXT, checks authorized senders; +all allows anyone to spoof.

DKIM : Reads DKIM public key for content integrity verification.

DMARC : Reports policy: none (monitor only), quarantine, reject; many enterprises stay at p=none.

BIMI : Checks brand logo indicator for email security maturity.

6. Threat Intelligence

Malware & Phishing Detection : Queries URLHaus, PhishTank.

DNS Blocklist Check : Checks AdGuard, Quad9, CleanBrowsing, etc.

Wayback Machine Snapshots : Retrieves historical archives for deleted pages, old keys, abandoned admin panels.

7. Tech Stack & Host Reconnaissance

Wappalyzer Fingerprinting : Identifies CMS, web server, frontend frameworks, analytics, CDN via headers, HTML, JS, cookies.

Open Port Scanning : Probes common TCP ports; exposure of 8080, 3306, 6379 without auth is high risk. Note: scan takes 10–30 seconds, public instances may timeout.

Traceroute : Shows routing hops and latency, helps locate real IP behind CDN.

Page Screenshot : Headless Chromium render for visual identification of same-IP sites.

8. Content, Compliance & Special Indicators

robots.txt : Disallowed paths often hint at admin panels, test envs, sensitive paths.

Sitemap Parsing : Extracts public page inventory.

security.txt : Checks .well-known/security.txt for vulnerability reporting contacts, PGP keys.

Internal/External Link Analysis : Finds hijacked third-party resources, unprotected internal pages.

Social Meta Tags : Reads Open Graph, Twitter Card metadata.

Carbon Footprint Estimate : Estimates per-visit CO2 based on traffic and server energy model.

Four Practical Scenarios

Self-audit : Baseline snapshot before launch; re-scan after changes to catch certificate expiry, DNS anomalies, new open ports.

Email Security Audit : Batch check SPF/DKIM/DMARC/BIMI across business domains to reduce BEC risk.

Penetration Testing / SRC Recon : Single-page collection of IP, subdomains, WAF, TLS, headers, tech stack for rapid high-risk asset filtering.

Threat Intelligence & Suspicious Domain Triage : Quick assessment of registration age, blocklist status, DNS config, tech stack.

Tool Comparison

Compared to SecurityHeaders.com (HTTP headers only), Shodan (port/service search), and MXToolbox (DNS/email), Web-Check uniquely offers a unified 30+ check dashboard, no registration required, open-source (MIT), self-hostable, and includes email security (SPF/DKIM/DMARC/BIMI), full TLS audit, Wappalyzer tech fingerprinting, carbon footprint, and Wayback snapshots.

Deployment Options

1. Public Instances (Zero Install)

Visit https://web-check.xyz or https://web-check.as93.net. No registration or API key. Rate-limited, suitable for occasional scans.

2. Docker (Recommended for Private, Unlimited Use)

docker run -p 3000:3000 lissy93/web-check

Access at http://localhost:3000. Use docker-compose for auto-restart and environment variables.

3. Source Build

git clone https://github.com/Lissy93/web-check.git
cd web-check
yarn install
yarn build
yarn start

Requires Node.js ≥18.16.1, Git; optional Chromium, traceroute for some checks.

4. Serverless One-Click Deploy

Official buttons for Netlify, Vercel, Render — fork repo and deploy without server maintenance.

Optional API Keys for Enhanced Data

GOOGLE_CLOUD_API_KEY

: Unlocks Lighthouse performance metrics. REACT_APP_SHODAN_API_KEY: Enriches associated hosts/side-channel data (free tier limited). REACT_APP_WHO_API_KEY: More complete Whois records. SECURITY_TRAILS_API_KEY: Enhanced IP organization intelligence. URL_SCAN_API_KEY: Additional URLScan threat intel.

Core functionality works without any keys.

Limitations & Caveats

Port Scan Timeouts : Public instances often timeout; self-host for batch scans.

DNS Cache Staleness : Recent DNS changes may not reflect until TTL expires.

Shodan Dependency : Associated hosts/side-channel data requires API key.

Internal IP Handling : New versions auto-detect private IPs and skip external queries.

Configuration ≠ Vulnerability : Results show configuration state; human judgment needed for risk assessment.

Project repository: https://github.com/lissy93/web-check