Dheerajmadhukar/karma_v2

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1020 stars · 187 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

karma_v2 is a Bash-based passive OSINT reconnaissance framework that automates Shodan queries to enumerate assets, exposed services, CVEs, and leaks for a target domain. It requires a Shodan Premium API key and outputs results to the screen and to files/directories.

Use cases

• find all exposed assets and IPs for a target domain passively
• discover WAF/CDN bypassed origin IPs
• enumerate open ports, banners, and services on target infrastructure
• find publicly exposed leaks like S3 buckets, dashboards, and default credentials
• collect CVEs associated with a target's exposed technologies
• perform ASN and BGP neighbor reconnaissance
• identify technologies via favicon hashing and nuclei templates

When to choose

• you have a Shodan Premium API key and need automated passive recon for bug bounty or pentesting
• you want a single script that aggregates Shodan dorks, SSL fingerprint matching, and leak detection
• you need in-scope/out-of-scope IP separation with SSL/TLS issuer verification

When to avoid

• you only have a free Shodan API key
• you need active scanning rather than passive intelligence gathering
• you need a supported, licensed tool - the repo has no license file
• you work on Windows outside WSL or on macOS without adaptation

Facets

cli-tool · maturity active

osint security workflow-automation web-scraping developer-tools security osint penetration-testing cli reconnaissance shodan bugbounty passive-recon attack-surface-discovery bash-script cve-lookup favicon-hashing command-line automation linux bash

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Dheerajmadhukar/karma_v2")