Fast. Precise. Intelligent.
Modern Security Reconnaissance Engine — Autonomous Attack Chaining & Real Data Extraction

Overview

NICE_SCAN is a professional-grade offensive security tool that combines high-performance HTTP scanning, intelligent technology fingerprinting, and an autonomous Decision Engine that chains attacks, extracts real data, and generates professional HTML reports — all from a single command.

# ── Full autonomous hack ────────────────────────────
nice_scan hack example.com -R report.html

# ── One-line install ────────────────────────────────
curl -sfL https://raw.githubusercontent.com/NICE-DEV226/nice-Scan/main/scripts/install.sh | sh

Features

Autonomous Hack Agent

Run nice_scan hack target.com and the Decision Engine autonomously executes 14 attack actions with forward-chaining:

🔍 Reconnaissance Passive recon (crt.sh, Wayback Machine — zero target requests) Web crawl (BFS discovery: pages, forms, JS files) Fuzzing (42 paths, 16 params) Concurrent port scan (20 goroutines, 30 ports × 3 hosts) S3 bucket enumeration (20 candidates)	💥 Exploitation & Chaining SQLi detection + auto data extraction (user tables) LFI detection + auto file read (/etc/passwd, configs) CMD injection + auto shell execution File upload + auto web shell deployment JWT forge (alg=none + 40 common secrets) XSS, GraphQL introspection, login brute-force
🧠 Decision Engine 10 attack chain patterns (CORS→XSS, JWT→Admin, Secrets→Cloud, Upload→RCE) Forward-chaining: each finding auto-spawns exploit modules Thread-safe dynamic planner with priority queue Session management (persistent cookies, tokens, JWT) Knowledge base with auto-capability derivation	📊 Professional Output HTML attack reports (dark theme, risk scoring, findings timeline) Extracted data saved to reports/{target}/ (SQL dumps, LFI files, shell output, S3 buckets) Real-time TUI dashboard with progress bars + findings stream Interactive REPL shell (command history, session context) JSON output for CI/CD pipelines

Quick Start

# Full autonomous hack — 14 actions, auto-chaining, HTML report
nice_scan hack example.com -R report.html

# Interactive reconnaissance shell
nice_scan shell

# Real-time dashboard with live findings
nice_scan scan example.com -i

# Time-boxed engagement (ideal for bug bounties)
nice_scan hack target.com --timeout 30s -R report.html

# Exploitation modules
nice_scan exploit https://example.com --login --idor 1-100

# Technology fingerprinting
nice_scan tech https://example.com

# JSON output
nice_scan scan https://example.com --json

Installation

Package managers: this project today ships via GitHub Releases and go install only. No Scoop bucket, Winget identity or Homebrew tap is published — commands circulating elsewhere (including winget install --id NICE-DEV226.nice-Scan or scoop install nice-scan/nice_scan) target package IDs this project does not own and may install unrelated software.

The installer is fail-closed: it resolves one release tag, verifies the SHA256 checksums and the GPG signature first, and aborts with nothing installed if any step fails.

Linux / macOS (installs to ~/.local/bin)

curl -sfL https://raw.githubusercontent.com/NICE-DEV226/nice-Scan/main/scripts/install.sh | sh

Or with Go 1.24+ (builds from the pinned release tag):

go install github.com/NICE-DEV226/nice-Scan/cmd/nice_scan@vX.Y.Z

Windows (PowerShell 7+, installs to %LOCALAPPDATA%\nice_scan)

Invoke-WebRequest https://raw.githubusercontent.com/NICE-DEV226/nice-Scan/main/scripts/install.ps1 -OutFile install.ps1
powershell -ExecutionPolicy RemoteSigned -File install.ps1

Direct Install

Go Install (cross-platform, requires Go 1.24+)

Anchored builds only — replace X.Y.Z with the current release tag. @latest is accepted by the Go toolchain but is not the installer's contract; the official installer resolves and pins one tag.

go install github.com/NICE-DEV226/nice-Scan/cmd/nice_scan@vX.Y.Z

One-liner Installer (macOS / Linux)

curl -sfL https://raw.githubusercontent.com/NICE-DEV226/nice-Scan/main/scripts/install.sh | sh

One-liner Installer (Windows PowerShell 7+)

powershell -ExecutionPolicy Bypass -c "iex \"& { $(irm https://raw.githubusercontent.com/NICE-DEV226/nice-Scan/main/scripts/install.ps1) }\""

Manual — download from GitHub Releases

Download the latest binary for your platform from the Releases page, verify the checksums, and extract.

# Example: Linux amd64
curl -sSfL https://github.com/NICE-DEV226/nice-Scan/releases/latest/download/nice_scan_latest_linux_amd64.tar.gz | tar xz
sudo mv nice_scan /usr/local/bin/

Build from Source

git clone https://github.com/NICE-DEV226/nice-Scan.git
cd nice-Scan
make build
# or: go build -o nice_scan ./cmd/nice_scan

Attack Walkthrough

$ nice_scan hack example.com --timeout 15s -R report.html

  ◈ NICE HACKER — DECISION ENGINE
  Target: https://example.com
  Actions loaded: 14

    Step 1  [0s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ Passive Reconnaissance                         │
  └────────────────────────────────────────────────┘
  ▸ INFO     crt.sh subdomains: 3 found (+ wayback)

    Step 2  [2s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ Crawl Endpoints                                │
  └────────────────────────────────────────────────┘
  ▸ INFO     Paths discovered: 47

    Step 3  [4s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ SQL Injection  Checking 16 params              │
  └────────────────────────────────────────────────┘
  !! CRITICAL SQLi: login.php (param: id)
  ◈ Spawned: SQLi Data Extractor

    Step 4  [5s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ SQLi Data Extraction  Dump user tables         │
  └────────────────────────────────────────────────┘
  !! CRITICAL Users extracted: 142 records

    Step 5  [7s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ Local File Inclusion                           │
  └────────────────────────────────────────────────┘
  !! CRITICAL LFI: /etc/passwd via page= param
  ◈ Spawned: LFI File Reader

    Step 6  [8s]  ──────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ LFI File Read  Extract sensitive files         │
  └────────────────────────────────────────────────┘
  !! CRITICAL Files: 12 (passwd, shadow, .env, config...)

    Step 7  [10s]  ─────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ Attack Chain Detection                         │
  └────────────────────────────────────────────────┘
  ◈ CORS + XSS Chain: api allows all origins
  ◈ JWT + Admin Chain: weak secret forgeable
  ◈ Secrets + Cloud Chain: 8 credentials in extracted files

    Step 8  [12s]  ─────────────────────────────────
  ┌────────────────────────────────────────────────┐
  │ Report Generation                              │
  └────────────────────────────────────────────────┘
  ✓ Risk Score: 10.0 / 10
  ✓ Report: report.html

  ── Extraction Summary ──
  📁 reports/example.com/
  ├── sql_dump/users.sql          (142 records)
  ├── lfi_files/passwd
  ├── lfi_files/shadow
  ├── lfi_files/config.php
  └── credentials.txt             (8 credentials)

Trust & Supply Chain Security

Actual state — verified inventory (not marketing):

Layer	Actual State	Verification Command
Binary Integrity	SHA256 checksums published per release	sha256sum --check checksums.txt --ignore-missing
Release Authenticity	GPG-signed checksums.txt when signing keys are configured	gpg --verify checksums.txt.sig checksums.txt
Code Integrity	Commits are not systematically GPG-signed	check individually: git log --show-signature
Build Provenance (SLSA/cosign)	GitHub build-provenance attestations + cosign keyless bundles emitted at release time (releases cut after 2026-10-24; nothing retroactive)	gh attestation verify <file> -R NICE-DEV226/nice-Scan
SBOM	syft SBOM intended per release — check the release assets	verify presence before relying on it
Distribution	GitHub Releases + go install <tag> (no brew/winget/scoop packages today)	—

The installers (scripts/install.sh, scripts/install.ps1) are fail-closed: a missing checksum file, an uncovered archive or a failed signature aborts with nothing installed. The go install path anchors strictly to the resolved release tag — no @latest, no main HEAD.

Quick Verification

# Download release assets
gh release download v0.1.0 --pattern "checksums*" -R NICE-DEV226/nice-Scan

# Verify SHA256
sha256sum --check nice_scan_0.1.0_checksums.txt --ignore-missing

# Verify GPG signature (when signing is configured)
gpg --verify nice_scan_0.1.0_checksums.txt.sig nice_scan_0.1.0_checksums.txt

# Most trustworthy: build from a pinned tag (audit the code you run)
git clone --branch v0.1.0 https://github.com/NICE-DEV226/nice-Scan.git && cd nice-Scan && go build ./cmd/nice_scan

Note: the maintainer GPG key is imported on first use from keyserver.ubuntu.com (hkps) and must match the pinned fingerprint 4CE466095C5B3185883288C593FBFE29F62FA4DB (verified out-of-band on the same keyserver; published in SECURITY.md) — a mismatched key makes install.sh abort. For a hardcoded chain of trust, clone and build from source.

See SECURITY.md for the full security policy, including the scanner's risk-honesty statement (verified evidence vs. remote-text hints).

Commands

Command	Description
hack <target>	Full autonomous attack chain — 14 actions, auto-chaining, data extraction
scan <target>	Standard reconnaissance scan (headers, TLS, fingerprint, endpoints)
tech <target>	Technology fingerprinting only (165 signatures)
tls <target>	TLS/SSL analysis (ciphers, certs, protocol versions)
exploit <target>	Active exploitation modules (login brute, IDOR, privesc, token)
shell	Interactive REPL reconnaissance shell
--version	Display version
--help	Display help

Development

# Build
make build

# Run with args
make run ARGS="hack example.com --timeout 10s"

# Test with race detection
make test

# Cross-compile (linux + windows + darwin, amd64 + arm64)
make build-all

# Lint
make lint

# Vet
make vet

# Goreleaser snapshot
make snapshot

# Full release
make release

Architecture

cmd/nice_scan/          CLI entry point (Cobra commands)
internal/
  hacker/               Decision Engine (types, planner, chaining, knowledge, brain)
  engine/               Analysis modules (SQLi, XSS, CORS, TLS, tokens, auth, etc.)
  exploit/              Exploitation modules (login, IDOR, privesc, token, session)
  fingerprint/          Technology fingerprinting (165+ signatures)
  transport/            HTTP client (connection pooling, retries, H2)
  shell/                Interactive REPL shell
  tui/                  Terminal UI (live dashboard)
  output/               Output renderers (terminal, JSON, HTML)
  types/                Shared types
scripts/                Install scripts (install.sh, install.ps1)
docs/                   Landing page & documentation

Documentation

• Architecture Overview
• Transport Layer
• ARCHITECTURE.md — Detailed system design
• CONTRIBUTING.md — Development workflow & conventions
• SECURITY.md — Security policy & vulnerability reporting

Legal

This tool is intended exclusively for authorized security testing of systems you own or have explicit permission to test. Unauthorized use may violate applicable laws. The authors assume no liability and are not responsible for any misuse or damage caused by this tool.

---

_{Built with Go · Cobra · BubbleTea · LipGloss
Released under MIT License · © 2026 NICE-DEV226}