01 · Product name
Photon
Extracts URLs from a page you are allowed to request.
Published by s0md3v.
In short
Photon is a free crawler by s0md3v, licensed GPL-3.0. You point it at a URL. It collects in-scope and out-of-scope links, and it can also be asked for parameters, files, scripts, and other extractions. The README documents a --wayback switch that seeds from archive.org, and a level and delay so the crawl stays small. A URL in the output is a link the crawl saw. It is not a secret, and it is not a person. Do not point it at a host you are not allowed to request.
Product pricing strategy
02
Free
Photon is free. The README says the license is GPL-3.0, and the install it documents is a git clone and Python. There is no hosted seat and no credit pack on the repository or the usage wiki opened for this listing. You spend your own bandwidth and the target's. Delay, thread count, and crawl level are how you keep that small. Third-party options such as archive.org seeds or a DNS plugin call those services under their own terms. This listing does not quote a fee for them, because Photon does not sell them.
Utility and features
03
Photon is the OSINT crawler in github.com/s0md3v/Photon. The copy run here was 1.3.2. The README says it can extract URLs, URLs with parameters, intel such as emails and bucket names, files, secret keys, JavaScript endpoints, and subdomains. Those switches are separate. --only-urls skips the intel and key passes. --keys is how secret-key extraction is turned on. This listing's run did not use --keys.
- URLs first. --only-urls keeps the output to links. Intel, files, and key extraction are separate switches. Leave them off unless the question needs them.
- Depth is a choice. Level 1 reads the URLs hanging off the start page, plus robots and sitemap seeds. A higher level is more requests.
- Internal is not in scope. Photon marks a URL internal when it shares the host. Your authorization may be narrower than the host. Cut the list.
The command was python3 photon.py -u https://owasp.org -l 1 -t 2 -d 1 --only-urls. Level 1, two threads, one second of delay. It reported 7 URLs from robots.txt, 79 from sitemap.xml, 86 URLs at level 1, then 7 robots entries, 111 internal URLs, and 16 external URLs. It made 87 requests in 50 seconds. Internal rows included https://owasp.org/about/ and project paths on the same host. That is a link list from a public homepage, one level deep. It is not a map of the organization, and a deeper level would be a different decision.
- 1
Clone the repository and read the usage wiki before you add switches.
- 2
Run one level, with a delay, and --only-urls, against a site you are allowed to request.
- 3
Read the internal and external files. Drop anything outside the host or the authorization.
- 4
Turn on --keys or an intel pass only when you have a reason to handle whatever it writes to disk.
Caveats
04
Photon is a crawler. Level, threads, and delay decide how hard it hits the site. A one-level run of a public homepage is still a few dozen requests, which the owasp.org log counted. Do not point it at a host you are not allowed to request, and do not drop the delay because the machine is idle.
Internal does not mean authorized. Secret-key and intel switches exist and will write what they find to disk. This listing's run did not enable them. URLs from a sitemap include pages you have not read. Confirm a URL before you cite the page. Compare hostnames with Amass when the question is DNS rather than links.
Screenshots
05
Potential use cases
06
- You may request a public site and you want the links on the homepage, not a multi-hour crawl. Run Photon at level 1 with a delay and --only-urls. The owasp.org run reported 111 internal URLs, 16 external URLs, and 87 requests in 50 seconds, after reading robots.txt and the sitemap. Pivot hostnames into a passive Amass or Subfinder run instead of raising the level. A link is a link. It is not proof the page is still live.
- Someone asks for emails or keys from the same crawl. The README lists those extractions, and --keys is a separate switch. Leave it off unless the authorization covers collecting that material and you have a place to store it. The --only-urls run wrote internal and external URL files and did not write a keys file. Quote that limit. Do not rerun with every switch to see what happens.
- The internal file is longer than the scope. Photon calls a URL internal when it shares the host. An authorization may cover one path. Cut the file to that path before it becomes a target list. External URLs are other people's sites. They are not in scope because a homepage linked them.
Hard cases
The case where the first result is easy to over-read.
The URL list is treated as a site map of the whole organization
Level 1 plus a sitemap produced 111 internal URLs on owasp.org. That is the start page, robots, and the sitemap, not every host the organization owns. Do not brief it as the asset inventory. Hand the hostnames to a passive DNS tool, and keep Photon's files as the link evidence for the pages it actually requested. If a URL is outside the written scope, delete it from the working list even though Photon marked it internal.
Questions
Is Photon free?
Yes. It is GPL-3.0 software you run locally. The project does not sell a plan.
Does Photon dump secrets by default?
The README lists secret-key extraction as a feature. The --keys switch is what turns that pass on. A run with --only-urls did not write a keys file.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Photon repository
https://github.com/s0md3v/PhotonDocumentation
Photon README
https://github.com/s0md3v/Photon/blob/master/README.mdDocumentation
Photon usage wiki
https://github.com/s0md3v/Photon/wiki/Usage