Two tools. One lifecycle.

From attack surface to evidence

Kumo Recon

Kage DFIR

Kumo takes a domain and gives you back everything reachable from the outside — 26 modules running at once, streaming as they land. Kage takes a suspect Windows host and gives you back one sealed chain — collection, timeline, verdicts, indicators, a score you can argue with.

Flip the switch. The whole page changes with it.

One domain. One command. Everything.

Drop a name in and Kumo fans out across DNS, ports, certificates, subdomains, archived paths, leaked credentials and infostealer infections at the same time. No key needed for any of it — keys only make the results richer.

kumo.py

$ python3 kumo.py corp.com

  [dns]        DMARC missing — anyone can spoof @corp.com
  [ports]      6379/tcp Redis — PONG, no auth required
  [endpoints]  /.env  200  ← credentials exposed
  [subs]       52 found · 34 alive · 8 sensitive
  [breach]     3 employee machines infected — RedLine
  [vuln]       Log4Shell RCE (CVE-2021-44228) confirmed

  26 modules · elapsed 41s

One host, eleven steps, one chain

Point Kage at a machine and it runs the whole triage in one chain: CyLR collects, Hayabusa correlates the event logs against Sigma, THOR Lite scans for YARA matches, VirusTotal and AbuseIPDB qualify the indicators. Each step streams live, seals what it produced, and can be replayed alone.

The gap between the two is where incidents live

Kumo answers what is exposed. Kage answers what happened. The same organisation needs both, usually in that order, and usually months apart.

Where each one earns its place

Neither tool replaces an analyst. They remove the hours between having a target and having something worth reading.

Both are open source, MIT, and run locally

Nothing is sent anywhere you did not configure. Kumo works without a single API key; Kage marks unconfigured steps skipped, never failed.

蜘蛛

Kumo

Domain OSINT & reconnaissance. Python 3.8+, CLI and web UI, results streaming in real time.

python3 kumo.py target.com View on GitHub 影

Kage

Windows host DFIR triage console. Python 3.10+, administrator, 115 tests. Linux chain in progress.

python -m dfirconsole View on GitHub

Neither tool needs a real target to learn on. Kage ships a demonstration mode — python -m dfirconsole --demo builds a synthetic intrusion and runs the whole chain on it, touching nothing on your machine. This site carries the same idea: the live demo is the two interfaces themselves — Kumo's web UI out of web.py and Kage's triage console out of dfirconsole/web, unmodified, in front of a scripted backend. Kage's side replays an actual --demo run captured from the tool.