sif(1)

📦 version 0-unstable-2026-10, in nixpkgs unstable

✨ sif(1) — the manual, but make it cute ✨

okay so bestie, listen 💖 this is sif — the blazing-fast pentesting suite — and this page is literally everything you need to know about it. it's sif(1) in the manual, and yes it slays.

🎀 SYNOPSIS 🎀

sif -u url [scans] [options]
sif -f file [scans] [options]
targets | sif [scans] [options]
sif {patchnote|version}

🦋 DESCRIPTION 🦋

sif is a modular recon and exploitation suite. it runs multiple scan types concurrently against one or more targets, and — the fun part — you can extend it with yaml modules 🧚

about urls, here's the vibe check:

  • a scheme-less target defaults to https:// (she just assumes, respectfully)
  • an explicit http:// or https:// is kept exactly as you wrote it
  • any other scheme is rejected 💀 no cap

🌸 TARGETS 🌸

  • -u, --urls list — comma-separated list of urls to scan.
  • -f, --file path — file with one url per line.
  • stdin — when stdin is a pipe, one target per line is read from it, alongside any -u / -f targets. this is the whole point: it lets sif slot into a unix pipeline (e.g. subfinder | sif -silent | notify). pipeline girlies rise up 🫶

💅 SCANS 💅

so many scans. an icon. a legend. here we go:

  • -dirlist size — directory and file fuzzing (small/medium/large).
  • -mc codes — dirlist: match only these status codes (comma list, e.g. 200,301).
  • -fc codes — dirlist: filter out these status codes (comma list).
  • -fs sizes — dirlist: filter out responses of these body sizes (comma list).
  • -fw counts — dirlist: filter out responses with these word counts (comma list).
  • -fr regex — dirlist: filter out responses whose body matches this regex.
  • -ac — dirlist: auto-calibrate the soft-404 wildcard baseline so catch-all 200s are dropped. genuinely so satisfying ✨
  • -w path|url — dirlist: custom wordlist (local file or url); overrides the -dirlist size.
  • -e exts — dirlist: extensions appended to each word (comma list, e.g. php,bak,env).
  • -dnslist size — subdomain enumeration (small/medium/large).
  • -ports scope — port scanning (common/full).
  • -nuclei — vulnerability scanning with nuclei templates.
  • -dork — automated google dorking.
  • -js — javascript analysis + secret and endpoint extraction.
  • -c3 — cloud storage misconfiguration scan.
  • -headers — dump the target's response headers.
  • -sh, --security-headers — flag missing or weak security headers and headers that leak server internals.
  • -st — subdomain takeover detection (requires -dnslist).
  • -cms — cms detection.
  • -whois — whois lookup.
  • -git — exposed git repository detection.
  • -shodan — shodan host lookup (requires SHODAN_API_KEY).
  • -securitytrails — domain discovery and target expansion (requires SECURITYTRAILS_API_KEY).
  • -sql — sql reconnaissance (admin panels, error disclosure).
  • -lfi — local file inclusion reconnaissance.
  • -jwt — jwt discovery plus offline weakness analysis (alg:none, weak hmac secret, missing/expired exp, sensitive plaintext claims).
  • -openapi — openapi/swagger spec exposure probe; enumerates paths, methods and unauthenticated operations.
  • -favicon — favicon hash fingerprinting (shodan-style mmh3); matches bundled tech and prints the http.favicon.hash pivot query. iykyk 👑
  • -cors — cors misconfiguration probe (reflected/permissive origins).
  • -redirect — open redirect probe.
  • -xss — reflected xss probe.
  • -framework — framework detection with cve lookup.
  • -crawl — web crawler; spiders same-host links, scripts and forms, respecting robots.txt.
  • -crawl-depth n — max crawl recursion depth (default 2).
  • -passive — passive subdomain and historical url discovery from third-party feeds (zero traffic to the target 🕵️).
  • -probe — live-host probe; reports liveness, final status, page title, server header and the redirect chain.
  • -noscan — skip the base url scan (robots.txt, etc).

🔥 OPTIONS 🔥

  • -d, --debug — enable debug logging.
  • -t, --timeout duration — per-request timeout (default 10s).
  • -l, --log dir — directory to write logs to.
  • --threads n — number of concurrent workers (default 10). values below 1 are clamped to 1 (she's not letting you go to zero, bestie 💀).
  • --template name — sif runtime template to use.
  • -config path — load flags from a yaml config file (default ~/.config/sif/config.yaml). mutually exclusive with --template.
  • -profile name — select a named profile block from the config file.
  • -proxy url — route every request through a proxy. accepts http, https or socks5 urls.
  • -H, --header string — custom header to send with every request, as Key: Value. repeatable or comma-separated.
  • -cookie string — cookie header to send with every request.
  • -rate-limit n — cap outbound requests per second (0 = unlimited, default 0).
  • -sarif file — write a sarif 2.1.0 report of the run to file.
  • -md, --markdown file — write a markdown report of the run to file.
  • -silent — plain output for pipelines: route all chrome to stderr and print one normalized finding per line to stdout as [severity] target module title. implies non-interactive (no spinners).
  • -diff — diff mode: snapshot each target's findings to a json file and, on a re-scan, print only the delta against the last snapshot (+ new for findings that appeared, - gone for ones that vanished), then overwrite the snapshot. the first run for a target reports everything as new.
  • -store dir — snapshot directory for -diff. defaults to the -log dir if set, otherwise <user-config>/sif/state. one sanitized file per target.
  • -notify — ship findings to every configured provider (slack, discord, telegram, generic webhook) after the scan. providers are configured env-first and overridable by a yaml file; with nothing configured this is a silent no-op 🤫
  • -notify-severity level — minimum severity to send: info, low, medium, high or critical (default medium). findings below the floor are dropped.
  • -notify-config file — path to a notify-compatible yaml config whose values override the env vars.
  • -api — emit json results and suppress the interactive output.

🧚 MODULES 🧚

  • -m, --modules ids — comma-separated module ids to run.
  • -mt, --module-tags tags — run modules matching these tags.
  • -am, --all-modules — run all loaded modules.
  • -lm, --list-modules — list available modules and exit.

⭐ COMMANDS ⭐

  • sif patchnote — fetch the latest github release and print its notes. also available as -pn.
  • sif version — print the sif version and exit.

🌈 ENVIRONMENT 🌈

  • SHODAN_API_KEY — api key used by -shodan.
  • SECURITYTRAILS_API_KEY — api key used by -securitytrails.
  • SLACK_WEBHOOK_URL — slack incoming webhook used by -notify (yaml key slack_webhook_url).
  • DISCORD_WEBHOOK_URL — discord webhook used by -notify (yaml key discord_webhook_url).
  • TELEGRAM_BOT_TOKEN — telegram bot token used by -notify (yaml key telegram_api_key); requires TELEGRAM_CHAT_ID too.
  • TELEGRAM_CHAT_ID — telegram destination chat used by -notify (yaml key telegram_chat_id).
  • NOTIFY_WEBHOOK_URL — generic json webhook used by -notify (yaml key webhook_url).
  • SIF_NO_PATCHNOTES — set to any value to suppress the once-per-version patch note shown at startup.

🍓 FILES 🍓

  • ~/.config/sif/modules/ — user-defined yaml modules.
  • ~/.config/sif/seen_version — records the last release whose notes were shown at startup.

💜 EXAMPLES 💜

run a few scans against a host:

sif -u https://example.com -headers -sh -cms -framework

fuzz directories and enumerate subdomains:

sif -u https://example.com -dirlist medium -dnslist medium

scan a list of targets and write logs:

sif -f targets.txt -headers -l ./logs

👑 SEE ALSO 👑

project page: https://github.com/vmfunc/sif — go follow, it's giving main character energy 🦋

🫶 AUTHORS 🫶

vmfunc, xyzeva, and the lunchcat contributors. absolute icons, all of them 💖

ngl, if you only remember one thing: -silent + a pipe = the pipeline of your dreams. periodt.

xoxo, that's the whole page 💅 — source sif, dated 2026-06-10, filed under manual section sif(1). now go break (responsibly) and slay ✨🎀

📦 where this page comes from