Skip to content

Back to the catalog

Ashmmmm/crockTail
github.comrepo

Ashmmmm/crockTail

crockTail is a passive OSINT tool that, given a domain, aggregates DNS records, IP/ASN ownership, TLS certificate details, WHOIS data, and crt.sh certificate-transparency history into a single report. It layers analysis on top of the raw data: plain-language warning/info observations (near-expiry or expired certs, recently registered domains, unusual reissuance, historical subdomains from CT logs), multi-resolver (Google vs Cloudflare) DNS cross-verification to flag possible tampering, and a 0-100 confidence score per scan based on module success and cross-check agreement. It supports batch domain queries and query logging, and is explicitly limited to passive lookups and a standard TLS handshake, no port scanning or active probing.

TL;DR A Spring Boot/Vue tool that aggregates DNS, WHOIS, TLS cert, IP/ASN, and crt.sh data per domain into one report with risk flags, DNS cross-verification, and a confidence score.
Open original ↗
Document

What it is

crockTail is a Java 17 / Spring Boot backend with a Vue 3 frontend that runs five passive-recon modules per domain (DNS, IP/ASN, TLS cert, WHOIS, crt.sh) and returns one aggregated JSON ScanResult. The README states plainly it is a personal learning project built during a software-development internship — a maturity signal the summary omits: this is not a maintained security product.

How it works

The summary covers the analysis layer; the page adds the concrete constants behind it:

  • Observation thresholds — cert flagged when it expires in ≤15 days or is already expired; domain flagged when registered <30 days ago. Reissuance volume and CT-log historical subdomains surface as info-level tags.
  • DNS cross-check — the A record is queried against Google 8.8.8.8 and Cloudflare 1.1.1.1; disagreement raises a "DNS resolvers disagree" warning.
  • Confidence score — 0–100 (high/medium/low) derived from which modules succeeded, whether retries were needed, and whether the DNS cross-check agreed.
  • Retry — every external call is wrapped in 3 attempts with 800ms backoff to absorb transient third-party/API failures.

What to do

Requires Java 17+, Node.js, Maven (via wrapper). Run:

./mvnw spring-boot:run

Backend serves on http://localhost:8080. Frontend:

cd frontend
npm install
npm run dev

API surface: POST /scan (single), POST /scan/batch (list of results), and a log endpoint that appends a scan to query_log.txt, one JSON entry per line. Each result field carries a source attribution naming its upstream provider.

Caveats

Strictly passive: no port scanning, service/version fingerprinting, vuln scanning, or active probing beyond a standard TLS handshake. Historical change tracking and report export were deliberately deferred for lack of accumulated log data, so there is no trend/diffing capability yet. Intended for domains you own or have explicit permission to assess.

Technologies named here

Techniques named here

  • Passive OSINT reconnaissance
  • Certificate transparency log subdomain discovery
  • Multi-resolver DNS cross-verification
  • TLS handshake certificate inspection
  • Retry with backoff
  • Confidence scoring

Related in OSINT