> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Scilla: Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration
- URL: https://darkwebinformer.com/scilla-information-gathering-tool-dns-subdomains-ports-directories-enumeration/
- Published: 2025-08-05T17:19:27.000Z
- Updated: 2025-09-04T22:20:42.000Z
- Author: Dark Web Informer
- Tags: OSINT, Tools

---

GitHub: <https://github.com/edoardottt/scilla>

---

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/08/9874569872635867923.gif)

## Installation 📡

[](https://github.com/edoardottt/scilla#installation-)

### Homebrew

[](https://github.com/edoardottt/scilla#homebrew)brew install scilla

### Snap

[](https://github.com/edoardottt/scilla#snap)sudo snap install scilla

### Golang

[](https://github.com/edoardottt/scilla#golang)go install -v github.com/edoardottt/scilla/cmd/scilla@latest

### Building from source

[](https://github.com/edoardottt/scilla#building-from-source)

You need [Go](https://go.dev/) (>=1.23)

Building from source for Linux and Windows

#### 

### Using Docker

[](https://github.com/edoardottt/scilla#using-docker)docker build -t scilla .  
docker run scilla help

## Examples 💡

[](https://github.com/edoardottt/scilla#examples-)

- DNS enumeration:
  - `scilla dns -target example.com`
  - `scilla dns -oj output -target example.com`
  - `scilla dns -oh output -target example.com`
  - `scilla dns -ot output -target example.com`
  - `scilla dns -plain -target example.com`
- Subdomains enumeration:
  - `scilla subdomain -target example.com`
  - `scilla subdomain -w wordlist.txt -target example.com`
  - `scilla subdomain -oj output -target example.com`
  - `scilla subdomain -oh output -target example.com`
  - `scilla subdomain -ot output -target example.com`
  - `scilla subdomain -i 400 -target example.com`
  - `scilla subdomain -i 4** -target example.com`
  - `scilla subdomain -c -target example.com`
  - `scilla subdomain -db -target example.com`
  - `scilla subdomain -plain -target example.com`
  - `scilla subdomain -db -no-check -target example.com`
  - `scilla subdomain -db -vt -target example.com`
  - `scilla subdomain -db -bw -target example.com`
  - `scilla subdomain -ua "CustomUA" -target example.com`
  - `scilla subdomain -rua -target example.com`
  - `scilla subdomain -dns 8.8.8.8 -target example.com`
  - `scilla subdomain -alive -target example.com`
- Directories enumeration:
  - `scilla dir -target example.com`
  - `scilla dir -w wordlist.txt -target example.com`
  - `scilla dir -oj output -target example.com`
  - `scilla dir -oh output -target example.com`
  - `scilla dir -ot output -target example.com`
  - `scilla dir -i 500,401 -target example.com`
  - `scilla dir -i 5**,401 -target example.com`
  - `scilla dir -c -target example.com`
  - `scilla dir -plain -target example.com`
  - `scilla dir -nr -target example.com`
  - `scilla dir -ua "CustomUA" -target example.com`
  - `scilla dir -rua -target example.com`
- Ports enumeration:
  - Default (all ports, so 1-65635) `scilla port -target example.com`
  - Specifying ports range `scilla port -p 20-90 -target example.com`
  - Specifying starting port (until the last one) `scilla port -p 20- -target example.com`
  - Specifying ending port (from the first one) `scilla port -p -90 -target example.com`
  - Specifying single port `scilla port -p 80 -target example.com`
  - Specifying output format (json)`scilla port -oj output -target example.com`
  - Specifying output format (html)`scilla port -oh output -target example.com`
  - Specifying output format (txt)`scilla port -ot output -target example.com`
  - Specifying multiple ports `scilla port -p 21,25,80 -target example.com`
  - Specifying common ports `scilla port -common -target example.com`
  - Print only results `scilla port -plain -target example.com`
- Full report:
  - Default (all ports, so 1-65635) `scilla report -target example.com`
  - Specifying ports range `scilla report -p 20-90 -target example.com`
  - Specifying starting port (until the last one) `scilla report -p 20- -target example.com`
  - Specifying ending port (from the first one) `scilla report -p -90 -target example.com`
  - Specifying single port `scilla report -p 80 -target example.com`
  - Specifying output format (json)`scilla report -oj output -target example.com`
  - Specifying output format (html)`scilla report -oh output -target example.com`
  - Specifying output format (txt)`scilla report -ot output -target example.com`
  - Specifying directories wordlist `scilla report -wd dirs.txt -target example.com`
  - Specifying subdomains wordlist `scilla report -ws subdomains.txt -target example.com`
  - Specifying status codes to be ignored in directories scanning `scilla report -id 500,501,502 -target example.com`
  - Specifying status codes to be ignored in subdomains scanning `scilla report -is 500,501,502 -target example.com`
  - Specifying status codes classes to be ignored in directories scanning `scilla report -id 5**,4** -target example.com`
  - Specifying status codes classes to be ignored in subdomains scanning `scilla report -is 5**,4** -target example.com`
  - Use also a web crawler for directories enumeration `scilla report -cd -target example.com`
  - Use also a web crawler for subdomains enumeration `scilla report -cs -target example.com`
  - Use also a public database for subdomains enumeration `scilla report -db -target example.com`
  - Specifying multiple ports `scilla report -p 21,25,80 -target example.com`
  - Specifying common ports `scilla report -common -target example.com`
  - No follow redirects `scilla report -nr -target example.com`
  - Use VirusTotal as subdomains source `scilla report -db -vt -target example.com`
  - Set the User Agent `scilla report -ua "CustomUA" -target example.com`
  - Generate a random user agent for each request `scilla report -rua -target example.com`
  - Set DNS IP to resolve the subdomains `scilla report -dns 8.8.8.8 -target example.com`
  - Check also if the subdomains are alive `scilla report -alive -target example.com`

## Get Started 🎉

[](https://github.com/edoardottt/scilla#get-started-)

`scilla help` prints the help in the command line.

```
usage: scilla subcommand { options }

   Available subcommands:
       - dns [-oj JSON output file]
             [-oh HTML output file]
             [-ot TXT output file]
             [-plain Print only results]
             -target <target (URL/IP)> REQUIRED
       - port [-p <start-end> or ports divided by comma]
              [-oj JSON output file]
              [-oh HTML output file]
              [-ot TXT output file]
              [-common scan common ports]
              [-plain Print only results]
              -target <target (URL/IP)> REQUIRED
       - subdomain [-w wordlist]
                   [-oj JSON output file]
                   [-oh HTML output file]
                   [-ot TXT output file]
                   [-i ignore status codes]
                   [-c use also a web crawler]
                   [-db use also a public database]
                   [-plain Print only results]
                   [-db -no-check Don't check status codes for subdomains]
                   [-db -vt Use VirusTotal as subdomains source]
                   [-db -bw Use BuiltWith as subdomains source]
                   [-ua Set the User Agent]
                   [-rua Generate a random user agent for each request]
                   [-dns Set DNS IP to resolve the subdomains]
                   [-alive Check also if the subdomains are alive]
                   -target <target (URL)> REQUIRED
       - dir [-w wordlist]
             [-oj JSON output file]
             [-oh HTML output file]
             [-ot TXT output file]
             [-i ignore status codes]
             [-c use also a web crawler]
             [-plain Print only results]
             [-nr No follow redirects]
             [-ua Set the User Agent]
             [-rua Generate a random user agent for each request]
             -target <target (URL/IP)> REQUIRED
       - report [-p <start-end> or ports divided by comma]
                [-ws subdomains wordlist]
                [-wd directories wordlist]
                [-oj JSON output file]
                [-oh HTML output file]
                [-ot TXT output file]
                [-id ignore status codes in directories scanning]
                [-is ignore status codes in subdomains scanning]
                [-cd use also a web crawler for directories scanning]
                [-cs use also a web crawler for subdomains scanning]
                [-db use also a public database for subdomains scanning]
                [-common scan common ports]
                [-nr No follow redirects]
                [-db -vt Use VirusTotal as subdomains source]
                [-ua Set the User Agent]
                [-rua Generate a random user agent for each request]
                [-dns Set DNS IP to resolve the subdomains]
                [-alive Check also if the subdomains are alive]
                -target <target (URL)> REQUIRED
       - help
       - examples

```

## Changelog 📌

[](https://github.com/edoardottt/scilla#changelog-)

Detailed changes for each release are documented in the [release notes](https://github.com/edoardottt/scilla/releases).

## Contributing 🛠

[](https://github.com/edoardottt/scilla#contributing-)

Just open an [issue](https://github.com/edoardottt/scilla/issues) / [pull request](https://github.com/edoardottt/scilla/pulls).

Before opening a pull request, download [golangci-lint](https://golangci-lint.run/usage/install/) and run

golangci-lint run

If there aren't errors, go ahead :)

**To do:**

- Add more tests
- Tor support
- Proxy support

## In the news 📰

[](https://github.com/edoardottt/scilla#in-the-news-)

- [Kali Linux Tutorials](https://kalilinuxtutorials.com/scilla/)
- [GeeksForGeeks.org](https://www.geeksforgeeks.org/scilla-information-gathering-dns-subdomain-port-enumeration/)
- [Brisk Infosec](https://www.briskinfosec.com/tooloftheday/toolofthedaydetail/Scilla)
- [Kalitut](https://kalitut.com/scilla-nformation-gathering-tool/)

## License 📝

[](https://github.com/edoardottt/scilla#license-)

This repository is under [GNU General Public License v3.0](https://github.com/edoardottt/scilla/blob/main/LICENSE).  
[edoardottt.com](https://edoardottt.com/) to contact me.