// Documentation

CLI Reference

// Installation

# Clone

$git clone https://github.com/rounakneema/Revealr.git && cd Revealr

# Build

$go build -o revealr ./cmd/revealr

# Run

$./revealr -target 192.168.1.1 -p 1-1024

⚠️ Note: Raw socket access requires elevated privileges on Linux. Run with sudo or grant capabilities: sudo setcap cap_net_raw+ep ./revealr

// Flags

Flag	Type	Description
-target, -t	string	Target IP, CIDR range, or hostname. (e.g. 192.168.1.0/24)
-ports, -p	string	Port range to scan. Default: 1-65535. (e.g. 22,80,443 or 1-1024)
--rate	int	Packets per minute dispatch rate. Default: 10000.
--profile	string	Scan profile: paranoid \| stealthy \| polite \| aggressive. Default: polite.
--resume	bool	Resume the last interrupted scan session for this target.
--diff	bool	Show diff against the last scan. Outputs new/changed/removed services.
--plugins	string	Path to Python plugin directory. Plugins are auto-discovered.
--output, -o	string	Output format: json \| stdout \| file. Default: stdout.
--timeout	int	Per-port connection timeout in milliseconds. Default: 1000.
--db	string	Path to SQLite database file. Default: ~/.revealr/state.db.
--verbose, -v	bool	Enable verbose logging.
--version	bool	Print Revealr version and exit.

// Example Workflows

Full subnet scan with drift detection

$./revealr -target 192.168.1.0/24 --rate 50000 --diff --output json > report.json

Scans a full /24 subnet at maximum rate and compares results against the last stored scan, outputting the diff in JSON format.

Stealthy top-1000 port scan

$./revealr -target 10.10.11.15 -p 1-1000 --profile stealthy

Scans the 1000 most common ports using the Stealthy profile, which randomizes port order and injects timing jitter to minimize IDS triggering.

Resume an interrupted scan

$./revealr -target 192.168.1.0/24 --resume

Revealr reads the last incomplete scan session from the SQLite state database and continues from where it left off.

Scan with Python vulnerability plugins

$./revealr -target 10.0.0.1 --plugins ./plugins/ --output json

Runs the scan and passes each discovered service through all Python plugins in the ./plugins/ directory, enriching the output with custom vulnerability data.

// Python Plugin API

Plugins are Python scripts placed in the plugin directory. Each plugin receives a JSON payload on stdin and must write a JSON response to stdout.

// Input Payload (stdin)

{
  "host": "192.168.1.15",
  "port": 8080,
  "protocol": "tcp",
  "service": "http",
  "banner": "HTTP/1.1 200 OK\nServer: nginx/1.18.0",
  "version": "nginx/1.18.0"
}

// Expected Output (stdout)

{
  "plugin": "nginx-vuln-check",
  "findings": [
    {
      "cve": "CVE-2021-XXXX",
      "severity": "medium",
      "description": "..."
    }
  ],
  "metadata": {
    "checked_at": "2024-01-01T00:00:00Z"
  }
}

← Security Changelog →