v0.1.0 — Public Release

Fast. Precise. Intelligent.

Autonomous security reconnaissance engine with decision chaining — SQLi → users, LFI → files, CMD → shells, S3 → buckets, Upload → RCE

Install Now Quick Start Downloads

terminal — nice_scan hack example.com -R report.html

[0s] ▸ Passive Reconnaissance OK (3 endpoints)

[2s] ▸ Crawl Endpoints OK (47 paths)

[4s] ◈ SQL Injection !! CRITICAL — login.php

[5s] └ SQLi Data Extract OK (142 users dumped)

[7s] ◈ LFI !! CRITICAL — /etc/passwd

[8s] └ LFI File Read OK (12 files extracted)

[10s] ▸ Risk Score 10.0 / 10 — report.html saved

Features

Why NICE_SCAN?

Not just another scanner — an autonomous security agent that chains attacks, extracts real data, and generates professional reports.

Decision Engine

Forward-chaining AI scans for vulnerabilities and automatically spawns exploit modules — SQLi dumps user tables, LFI reads server files, CMD injection opens shells.

Attack Chaining

10 chain patterns — CORS+XSS, JWT→Admin, Secrets→Cloud, Upload→RCE. Each finding automatically triggers deeper exploitation across interconnected vectors.

Real Data Extraction

Goes beyond detection — extracts SQL databases, LFI files, S3 bucket contents, deploys web shells, and dumps everything to reports/ organized by target.

HTML Attack Reports

Professional dark-theme reports with risk scoring, findings timeline, capabilities graph, extracted data summary, and credential inventory. Shareable with -R report.html.

Trust Verification

All releases signed with GPG + Sigstore/cosign. SHA256 checksums verified. Supply-chain security with SLSA provenance and SPDX SBOM included every release.

14 Attack Modules

Passive recon, crawl, fuzz, JWT forge, login brute, XSS, SQLi, GraphQL, S3 enum, LFI, CMD injection, upload, OOB server, port scan — all with auto-spawning chains.

0 Exploit Modules

0 Chain Patterns

0 Attack Actions

0 Platforms

Installation

Get NICE_SCAN

Four ways to install, all with cryptographic verification.

🍺

Scoop

Windows package manager

📦

Winget

Windows native package manager

⚡

Go Install

Cross-platform source build

📥

Manual

Download from GitHub Releases

powershell

scoop bucket add nice-scan https://github.com/NICE-DEV226/nice-Scan
scoop install nice-scan/nice_scan

powershell

winget install --id NICE-DEV226.nice-Scan

bash

go install github.com/NICE-DEV226/nice-Scan/cmd/nice_scan@latest

bash

# Linux / macOS
curl -sSfL https://github.com/NICE-DEV226/nice-Scan/releases/latest/download/install.sh | sh

# Windows PowerShell
irm https://github.com/NICE-DEV226/nice-Scan/releases/latest/download/install.ps1 | iex

Usage

From Zero to Exploit

One command. Autonomous attack chaining. Real data extraction.

Quick Scan

Full autonomous attack against any target — detects vulnerabilities and automatically exploits them.

nice_scan hack example.com -R report.html

Interactive Shell

Persistent REPL reconnaissance shell with command history, session context, and live results.

nice_scan shell

Live Dashboard

Real-time TUI dashboard with progress bars, findings stream, and live severity updates.

nice_scan scan example.com -i

Time-Boxed Attack

Set a timeout to control engagement duration — ideal for bug bounties and CTFs.

nice_scan hack target.com --timeout 30s -R report.html

Reports

Professional HTML Reports

Dark-theme, risk-scored, evidence-backed — ready for client delivery or team collaboration.

◈ Attack Report — example.com 10.0 / 10

v0.1.0 • 14 actions • 8 chained steps • 25s elapsed

Findings

SQL Injection

Local File Inclusion

/etc/passwd, /etc/shadow, .env, config.php (12 files)

▸

CORS Misconfiguration

api.example.com — allows all origins

◈

JWT Weak Secret

alg=none accepted, secret brute-forced

Extracted Data

Users 142 records

Files 12 LFI + 3 config

Credentials 8 found

Endpoints 47 discovered

Shells 1 deployed

Trust

Supply Chain Security

Every release is cryptographically signed. Every install script verifies before extraction.

🔑

GPG Signatures

Checksum files signed with NICE-DEV226's GPG key. Verify with:

gpg --verify checksums.txt.sig checksums.txt

🛡️

Sigstore / cosign

Keyless signing via GitHub OIDC. SLSA provenance with cosign bundles.

cosign verify-blob --bundle checksums.sigstore.json checksums.txt

📋

SPDX SBOM

Software Bill of Materials for every release — full dependency transparency.

syft scan nice_scan --from-release NICE-DEV226/nice-Scan:v0.1.0

✅

SLSA Level 2

Build integrity verified through Sigstore. Non-falsifiable provenance attestations.

gh attestation verify nice_scan_0.1.0_linux_amd64.tar.gz \
  --repo NICE-DEV226/nice-Scan

Download the latest release and verify for yourself.

Latest Release