WebCheck-OSINT

Open source alternative to Shodan, SecurityTrails, Censys, Netcraft, Detectify, Pentest-Tools.com and Intruder

343 stars
MIT
Active this week
Last commit 1 day ago

Last verified Oct 21, 2026

Analyze any website with 44 automated OSINT checks covering DNS, SSL, ports, TLS, CVEs, tech stack, and HTTP headers. MIT licensed, self-hostable.

Visit website GitHub343 Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who WebCheck-OSINT is for#

Security researchers doing pre-engagement reconnaissance

WebCheck-OSINT returns a full-domain snapshot including open ports, CVEs, TLS configuration, HTTP headers, tech stack, and WHOIS data in a single scan that takes about 20 seconds. That maps directly to the initial recon phase of a pentest or bug-bounty engagement without requiring separate lookups on each data point.

Skip if:

Skip if your engagement requires historical DNS changes or passive traffic data over time. Those use cases need a subscription to SecurityTrails or Censys, not an on-demand scanner.

Developers auditing their own site before launch

Developers can run a scan on their own domain to verify HSTS is configured, TLS is on an acceptable version, security headers are present, cookies have correct SameSite attributes, and robots.txt exposes only intended paths.

Skip if:

Skip if your site is behind a WAF or CDN that blocks probing traffic. Port scans and header inspections may return data about the CDN edge rather than your origin server.

DevSecOps teams running periodic domain audits

Teams that want to audit owned domains regularly can self-host WebCheck-OSINT on internal infrastructure, ensuring no query data about internal or pre-release domains reaches a third-party service. All 44 checks target only publicly available data; no agent is required on the target.

Skip if:

Skip if you need automated scheduled scans with diff-based alerting. WebCheck-OSINT has no built-in scheduler; invoking it on a schedule and handling alerts would require external tooling.

Red-team operators building target profiles

The associated hosts check, subdomain enumeration from Certificate Transparency logs, DNS records, social presence data, and tech stack fingerprinting together give an operator a structured picture of a target's web footprint faster than manual tool chaining.

Skip if:

Skip if your target is a large hardened network requiring IP-range scanning. Services like Censys and Shodan enterprise tiers offer broader network-wide indexed coverage than a per-domain scanner.

the problem

The problem it solves#

Security audits and OSINT reconnaissance on a domain typically require juggling multiple specialized services: querying Shodan for open ports and CVEs, checking SecurityTrails or Censys for DNS history, running a TLS audit against SSL Labs, looking up WHOIS data, and manually correlating the results. Each service has its own interface, access model, and in most cases a per-query or subscription cost.

For developers and security teams running audits at any scale, that fragmentation is a real pain point. Free tiers on commercial services are tightly capped, and paid tiers run from hundreds to thousands of dollars per month depending on query volume. There is no single place to get a complete domain snapshot without either stitching together API calls or paying for a managed service.

The result is that many teams skip the full audit, do it infrequently, or build ad hoc scripts that break whenever an upstream API changes its response schema. Self-hosted tooling that covers the full checklist in one run, with no per-query billing, removes the friction that keeps teams from auditing regularly.

how WebCheck-OSINT solves it

How it solves it#

44-check automated domain scan

A single URL input triggers 44 parallel checks covering DNS records, SSL chain, open ports, TLS configuration, HTTP headers, tech stack, DNSSEC, CAA records, HSTS, security.txt, and more. Results arrive in roughly 20 seconds without any API key setup on the user side.

CVE and vulnerability lookup

The Vulnerabilities check queries Shodan to find CVEs linked to the services running on the host's open ports. This surfaces known software vulnerabilities against the actual services the server is running, not just a theoretical attack surface based on port numbers alone.

TLS security audit and client compatibility

Three separate TLS checks run per scan: a live handshake inspection returning cipher suite and protocol version, an SSL Labs-style security audit grade, and a client compatibility table showing whether Chrome, Safari, Java, and older Android versions can still connect to the server.

Data breach and malware status

The scanner queries Have I Been Pwned for known data breaches linked to the domain and checks common malware and phishing blocklists. Block detection tests whether privacy, malware, and parental-control DNS resolvers block the site.

Tech stack and tracker fingerprinting

The Tech Stack check identifies frameworks, analytics services, and third-party integrations the site loads. The Trackers and Third Parties check separately lists analytics scripts, ad trackers, and other third-party resources, showing what the page phones home to on each load.

Quality metrics and carbon footprint

Quality Metrics runs a Lighthouse audit returning performance, accessibility, SEO, and best-practices scores. The Carbon Footprint check estimates CO2 from the data required to load the page, which is useful for sustainability audits alongside security ones.

strengths · trade-offs

Strengths and trade-offs#

Strengths

MIT license with no per-query billingThe tool is MIT licensed, so you can run it on your own infrastructure, modify the source, and use it commercially without restriction. Unlike Shodan or SecurityTrails, there is no per-query cost and no rate cap on how many domains you scan per day.
No external database requiredAll 44 checks run at query time against public APIs and DNS resolvers. There is no Postgres, no Redis, and no persistent data store to operate. This keeps the deployment footprint small and removes an entire class of infrastructure maintenance.
Four deployment paths documentedThe README documents Netlify, Vercel, Docker, and direct source as deployment options. Docker is the most portable; Vercel and Netlify cover zero-infrastructure hosting. Multiple deployment targets reduce operational lock-in to any single platform.
TypeScript codebase with active maintenanceThe codebase is TypeScript throughout, with the last repository push recorded on 2026-10-21. Only 1 open issue is tracked as of the last GitHub metadata snapshot. Active maintenance reduces the risk of checks breaking against upstream APIs that change their response formats.

Trade-offs

-Depends on third-party public APIsSeveral checks query Shodan, Have I Been Pwned, the Wayback Machine, and similar public services. These services may be rate-limited or temporarily unavailable, and checks such as CVE lookups and Global Ranking will return empty results for domains not yet indexed by those services. There is no fallback for unavailable upstream sources.
-No continuous monitoring or alertingWebCheck-OSINT is an on-demand scanner, not a monitoring platform. It does not alert you when a certificate expires, when a new port opens, or when a new CVE maps to a running service. Paid platforms like Detectify and Intruder offer scheduled scanning and real-time alerts that this tool does not.
-Small community for a security toolThe repository has 345 stars and 45 forks as of the last metadata fetch. For a security-critical tool, a smaller community means fewer reviewers examining check logic and fewer contributors maintaining API integrations when upstream services change their response formats.

versus alternatives

WebCheck-OSINT vs alternatives#

WebCheck-OSINT vs Shodan

Shodan and WebCheck-OSINT overlap most visibly on open-port and CVE data, since WebCheck-OSINT's Vulnerabilities check pulls from Shodan's API directly. The tools serve different purposes. Shodan is a continuous internet-wide scanner with a searchable index of billions of hosts; WebCheck-OSINT is an on-demand single-domain scanner that aggregates Shodan data alongside 43 other checks.

Feature	WebCheck-OSINT	Shodan
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
Historical data	No	Yes
Per-query cost	None (self-hosted)	Credits-based
Coverage	Single domain, 44 checks	Internet-wide indexed
Continuous monitoring	No	Yes

WebCheck-OSINT is the better choice when you want a free, self-hosted tool for on-demand reconnaissance on a specific domain, with DNS, TLS, header, and tech-stack data included alongside port and CVE data. Shodan is the better choice when you need historical host data, want to search across large IP ranges, or need alerting on infrastructure changes over time.

WebCheck-OSINT vs SecurityTrails

SecurityTrails specializes in historical DNS and IP data, letting you trace how a domain's DNS records changed over time and which other domains share a hosting IP. WebCheck-OSINT returns current DNS records but has no historical view.

Feature	WebCheck-OSINT	SecurityTrails
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
Historical DNS	No	Yes
Current DNS checks	Yes	Yes
TLS audit	Yes	No
Per-query cost	None (self-hosted)	Subscription

WebCheck-OSINT covers the present-tense DNS picture with added context from TLS, headers, and 40 other checks. SecurityTrails is more useful when passive DNS history matters, for instance when tracing whether a domain pointed to a different IP during a past campaign or tracking infrastructure changes over time.

WebCheck-OSINT vs Censys

Censys maintains a continuously updated database of internet-wide TLS certificate and port scan data. Like Shodan, it offers search across its own indexed dataset rather than on-demand per-domain scans.

Feature	WebCheck-OSINT	Censys
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
TLS certificate data	Current (live handshake)	Indexed, historical
On-demand scan	Yes	No
Per-query cost	None (self-hosted)	Subscription

For teams that need a single domain's current TLS posture, HTTP headers, and tech stack without a subscription, WebCheck-OSINT is the faster option. Censys has an advantage when you need to correlate TLS certificate data across large IP blocks or track certificate issuance events over time.

install · quick start

Quick start#

bash

Self-hosting from source requires Node.js; deploy to Vercel or Netlify for zero-infrastructure hosting.
```bash
git clone https://github.com/mwakidenis/WebCheck-OSINT
cd WebCheck-OSINT
npm install
npm run dev
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaScriptTypeScript
Frameworks: ExpressReactSvelte
Infrastructure: Docker

frequently asked

FAQ#

Is WebCheck-OSINT free to use?

Yes. The tool is MIT licensed and free to self-host on your own infrastructure with no license fee and no per-scan cost. Some checks query external services like Shodan or Have I Been Pwned, which have their own free-tier limits, but those limits apply to the upstream service rather than to WebCheck-OSINT itself.

How is WebCheck-OSINT different from Shodan?

Shodan is a continuous internet-wide scanner that indexes hosts and services over time, giving you historical data and real-time search across its full index. WebCheck-OSINT is an on-demand tool that scans a single domain on request, pulling data from Shodan's API alongside 43 other checks. It is a reconnaissance aggregator, not a replacement for Shodan's internet-wide indexed coverage.

Can I deploy WebCheck-OSINT using Docker?

Yes. The README lists Docker as one of four supported deployment options alongside Netlify, Vercel, and running from source. The deployment requires no external database; the application is stateless and all checks run at query time.

What data does the hosted version of WebCheck-OSINT collect?

The web-check.xyz hosted version offers opt-in anonymous error monitoring and basic page-view counts with no personal data attached, with a clear opt-out available in settings. Self-hosted deployments give you full control over logging, since you operate the server. No query data is sent to any third party beyond the individual public APIs each check calls.

Does WebCheck-OSINT work on internal or non-public domains?

The scanner can query any reachable domain, but checks that depend on public indexes like Shodan, Have I Been Pwned, or the Wayback Machine will return no results for domains those services have not indexed. DNS lookups, port checks, and header inspections work against any host that is network-reachable from the server running WebCheck-OSINT.

also worth a look

Similar open-source tools#

Markdown Preview Editor

Alternative toTypora

Browser-only Markdown editor with live preview and strict privacy.

30 GitHub stars
Licence MIT

Obtainium

InIT Management

Android app updates direct from GitHub and F-Droid

20,630 GitHub stars
Licence GPL-3.0

limen

Alternative toAuth0

Composable authentication for modern Go backends

551 GitHub stars
Licence MIT

Falkon

Alternative toGoogle Chrome

Speed-first browser for KDE Plasma with built-in ad blocking

494 GitHub stars
Licence GPL-3.0

Floorp

Alternative toBrave Browser

Firefox fork with advanced privacy controls and UI customization

8,452 GitHub stars
Licence MPL-2.0

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

345,900 GitHub stars
Licence MIT

by category

Open source tools in these categories#

126

Run WebCheck-OSINT on your own server

Self-host WebCheck-OSINT on a Hostinger VPS.

Deploy on Hostinger

Featured

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

WebCheck-OSINT vs Shodan

Feature	WebCheck-OSINT	Shodan
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
Historical data	No	Yes
Per-query cost	None (self-hosted)	Credits-based
Coverage	Single domain, 44 checks	Internet-wide indexed
Continuous monitoring	No	Yes

WebCheck-OSINT vs SecurityTrails

Feature	WebCheck-OSINT	SecurityTrails
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
Historical DNS	No	Yes
Current DNS checks	Yes	Yes
TLS audit	Yes	No
Per-query cost	None (self-hosted)	Subscription

WebCheck-OSINT vs Censys

Feature	WebCheck-OSINT	Censys
License	MIT (self-hosted)	Proprietary
Self-hosting	Yes	No
TLS certificate data	Current (live handshake)	Indexed, historical
On-demand scan	Yes	No
Per-query cost	None (self-hosted)	Subscription

Who WebCheck-OSINT is for#

Security researchers doing pre-engagement reconnaissance

Skip if:

Developers auditing their own site before launch

Skip if:

DevSecOps teams running periodic domain audits

Skip if:

Red-team operators building target profiles

Skip if:

The problem it solves#

How it solves it#

44-check automated domain scan

CVE and vulnerability lookup

TLS security audit and client compatibility

Data breach and malware status

Tech stack and tracker fingerprinting

Quality metrics and carbon footprint

Strengths and trade-offs#

Strengths

Trade-offs

WebCheck-OSINT vs alternatives#

WebCheck-OSINT vs Shodan

WebCheck-OSINT vs SecurityTrails

WebCheck-OSINT vs Censys

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

Web Development

Find open source alternatives to paid software

Who WebCheck-OSINT is for#

Security researchers doing pre-engagement reconnaissance

Skip if:

Developers auditing their own site before launch

Skip if:

DevSecOps teams running periodic domain audits

Skip if:

Red-team operators building target profiles

Skip if:

The problem it solves#

How it solves it#

44-check automated domain scan

CVE and vulnerability lookup

TLS security audit and client compatibility

Data breach and malware status

Tech stack and tracker fingerprinting

Quality metrics and carbon footprint

Strengths and trade-offs#

Strengths

Trade-offs

WebCheck-OSINT vs alternatives#

WebCheck-OSINT vs Shodan

WebCheck-OSINT vs SecurityTrails

WebCheck-OSINT vs Censys

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

Web Development

Find open source alternatives to paid software