vigolium kit is a family of small, stateless primitives carved out of the scanner’s own engine — no database, no project scope, no scan pipeline. Each one is a single transform or probe: it reads files or stdin, honours -j/--json for machine output, and gates via exit codes.
Added in v0.4.1. They exist because the useful parts of a scanner are often wanted outside a scan — grepping a repo for leaked credentials, unminifying one bundle, cracking one JWT — and shelling out to five separate tools to do it is the wrong shape.
These are primitives: they do one job and report raw output, never a vulnerability verdict. They touch no project database, so nothing is persisted — pipe the output where you need it. For findings that persist, use
vigolium scan or the agent modes.The commands
Every command reads
- (or no argument) as stdin and takes -j/--json for a single structured object on stdout. Human notes go to stderr, so a pipe stays clean.
secret-scan
Scan bytes for leaked secrets with the embedded detection catalog (~12k kingfisher + Vigolium rules, pure Go, no network). Positional arguments are files or directories, walked recursively; - or no argument reads stdin.
JSON shape:
{files_scanned, count, matches:[{rule_id, rule_name, confidence, secret, entropy, file, line, start, end}]}.
Reports where a secret is, never whether it is exploitable. Obvious placeholders (…EXAMPLE, 123456… sequences) are safelisted away, so test with realistic-looking values.
js-beautify
Unminify and unpack minified or bundled JavaScript with the embedded jstangle tool (webcrack — no eval-based deobfuscation). The argument is a local file, an http(s):// URL that gets fetched, or -/no argument for stdin.
--extract also runs endpoint extraction; under -j the result carries {changed, format, module_count, content, endpoints?}.
oast (new / poll)
Generate interactsh out-of-band callback URLs, and later poll for the DNS/HTTP/SMTP interactions they received — the primitive behind blind SSRF/XXE/RCE/Log4Shell confirmation.
State lives in a session file, so minting and polling are separate fire-and-forget invocations with no long-running process between them.
poll JSON: {server, session, count, interactions:[{protocol, unique_id, full_id, remote_address, timestamp, raw_request, raw_response}]}.
harvest
Collect historically-known URLs for one or more domains from public archives and indexes — the same source set as the scan’s external-harvest phase. Wayback, Common Crawl, AlienVault OTX and Arquivo are keyless and on by default; urlscan and VirusTotal join when their key is configured under external_harvester.
A URL argument is reduced to its host; - reads domains one per line from stdin.
-j yields {domains, sources, count, urls}.
jwt-crack
Brute-force a JWT’s HMAC signing secret (HS256/384/512) against a wordlist. A token declaring an asymmetric algorithm (RS*/ES*/PS*) is additionally tried under every HMAC variant — the algorithm-confusion attack — and a match is labelled as such. The token is a positional argument or -/stdin; a leading Bearer is stripped.
JSON:
{alg, cracked, secret, matched_alg, candidates_tried, wordlist, header, payload}. The recovered secret is printed in full — that is the point of the command.
wordlist
List the embedded wordlists, or print one to stdout so it can be piped into another tool.
jwt alias. Built-ins: dir-short, dir-long, file-short, file-long, fuzz, jwt.secrets.list.
payload
Print the built-in fuzzing payloads for one or more classes, one per line — the same catalog behind vigolium fuzz --class.
cmdi, crlf, lfi, open_redirect, path_traversal, sqli, ssrf, ssti, xss, xxe, plus aliases (sql → sqli, traversal → path_traversal). JSON: {classes, count, payloads}.
Gotchas
- Stateless by design. Nothing lands in the project database — pipe or redirect the output yourself.
oast newdoes not tear down the session. Closing an interactsh client deregisters it server-side, sonewmints, saves and exits without closing; the session stays alive forpoll. Usepoll --deregisterto destroy it explicitly when you’re done.oast --intervalis auto-shrunk below--wait(the poll ticker only fires after one full interval), so even a short--waitpolls at least twice.secret-scansafelists placeholders.AKIA…EXAMPLEand123456-sequence tokens are treated as benign.- Exit 3 is a gate, not an error.
secret-scan --fail-on-matchandjwt-crack --fail-on-crackexit3on a hit; otherwise the usual0success /1error /2usage error applies. See the exit-code table.