85 security plugins · 30+ recon tools · OWASP 2025 · CVSS v4.0 · PDF/MD/JSON reports
One command to enumerate, scan, exploit, analyze, and generate compliance-ready pentest reports.
Built for red teamers, bug bounty hunters, and DevSecOps engineers.

🇺🇸 English · 🇧🇷 Português (Brasil)

Website · Install · Why Cascavel · Architecture · Plugins · CLI · Reports · Security · Contributing

_{Cinematic boot sequence · Auto-detects 30+ tools · Preloader with security intel tips}

_{Split-screen live dashboard · Real-time severity tracking · Rotating security intelligence}

Most pentest workflows involve 20+ separate tools, each with its own syntax, output format, and report style. You manually merge results, format reports, and lose hours to context-switching.

Cascavel replaces the entire workflow:

┌─────────────────────────────────────────────────────────┐
│  $ python3 cascavel.py -t target.com --pdf              │
│                                                         │
│  ┌──────────┐  ┌────────┐  ┌──────────┐  ┌──────────┐  │
│  │ DISCOVER │→ │ PROBE  │→ │  ATTACK  │→ │ ANALYZE  │  │
│  └──────────┘  └────────┘  └──────────┘  └──────────┘  │
│   Subdomains    Ports       XSS,SQLi      JWT,CORS     │
│   DNS,WHOIS     Banners     SSRF,RCE      CSP,CSRF     │
│   Cloud enum    Headers     SSTI,XXE      OAuth,IDOR    │
│                                                         │
│  ┌──────────┐  ┌──────────────────────────────────────┐ │
│  │  DETECT  │→ │         REPORT (PDF/MD/JSON)         │ │
│  └──────────┘  └──────────────────────────────────────┘ │
│   Docker,K8s    CVSS v4.0 · OWASP · PTES · LGPD        │
│   Redis,S3      Legal disclaimers · SHA-256 integrity   │
│   CI/CD         Compliance mapping · Risk matrix        │
└─────────────────────────────────────────────────────────┘

curl -fsSL https://raw.githubusercontent.com/glferreira-devsecops/Cascavel/main/install.sh | bash

One command. That's it. Works on macOS, Linux (Debian/Ubuntu/Kali/Parrot/Fedora/Arch/Alpine/SUSE), WSL2, and Docker. The installer auto-detects your OS, installs git + python3 if missing, clones the repo, creates a venv, installs all 85 plugins + 30 tools, and registers the cascavel global command. Zero manual steps.

# Git clone
git clone https://github.com/glferreira-devsecops/Cascavel.git && cd Cascavel && bash install.sh

# Download tarball (no git needed)
curl -fsSL https://github.com/glferreira-devsecops/Cascavel/archive/main.tar.gz | tar xz && cd Cascavel-main && bash install.sh

# Docker (isolated)
docker run -it --rm python:3.12-slim bash -c "apt update && apt install -y git && git clone https://github.com/glferreira-devsecops/Cascavel.git /app && cd /app && bash install.sh"

# Manual
git clone https://github.com/glferreira-devsecops/Cascavel.git && cd Cascavel
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt && python3 cascavel.py -t target.com

The installer v2.4.0 includes 15 security hardenings: trap cleanup, mktemp -d TOCTOU isolation, anti-symlink lock, SHA-256 requirements.txt integrity, CVE version enforcement (6 packages), umask 077, PATH prefix sanitization (rejects . and relative paths), container detection (Docker/Podman/LXC), WSL2 kernel detection, Python ssl module verification, stale venv recovery, chmod 700/600 on sensitive paths, GOPATH/GOBIN export validation, locale UTF-8 enforcement, and absolute paths for critical binaries.

cascavel.py (3000+ lines)                    report_generator.py (1400+ lines)
├── ANSI Escape Sanitizer                     ├── _NumberedCanvas (two-pass "Page X of Y")
│   └── Blocks CSI/OSC/DCS injection          ├── Diagonal "CONFIDENCIAL" watermark
├── Preloader Engine                          ├── QR Code → rettecnologia.org
│   └── 5-stage cinematic boot                ├── Widows/orphans paragraph control
├── Plugin Orchestrator                       ├── Table splitOn + repeatRows=1
│   └── Dynamic load, SIGALRM timeout         ├── Risk Matrix (5×5 heat map)
├── Split-Screen Dashboard                    ├── 9 compliance frameworks
│   └── Rich Live (scan + intel panel)        ├── 20-term security glossary
├── External Tools Pipeline                   ├── Prioritized remediation summary
│   └── 30+ tools, shlex.quote()              └── SHA-256 document integrity
├── Report Engine (PDF/MD/JSON)
└── Signal Handler (async-signal-safe)

Enterprise-grade reports signed by RET Tecnologia, compliant with Brazilian and international frameworks:

Report features: "Página X de Y" two-pass numbering · diagonal CONFIDENCIAL watermark · widows/orphans paragraph control · intelligent table splitting with repeatRows=1 · clickable links to rettecnologia.org on every page.

cascavel -t target.com --pdf       # Generate PDF report
cascavel -t target.com -o json     # JSON output for CI/CD pipelines
cascavel -t target.com -o md       # Markdown for documentation

Zero false-positive tolerance. Standardized run() interface. Each plugin returns structured results with severity classification.

xss_scanner · sqli_scanner · ssti_scanner · rce_scanner · blind_rce · nosql_scanner · cve_2021_44228_scanner

ssrf_scanner · xxe_scanner · lfi_scanner · path_traversal

jwt_analyzer · oauth_scanner · csrf_detector · idor_scanner · session_fixation · password_policy

http_smuggling · http2_smuggle · websocket_scanner · grpc_scanner

cors_checker · csp_bypass · clickjacking_check · host_header_injection · web_cache_poison · rate_limit_check · waf_bypass

graphql_probe · graphql_injection · api_enum · api_versioning

mass_assignment · race_condition · prototype_pollution · deserialization_scan · open_redirect · crlf_scanner

docker_exposure · k8s_exposure · redis_unauth · mongodb_unauth · elastic_exposure · cicd_exposure · cloud_metadata · cloud_enum

subdomain_hunter · subdomain_takeou · dns_deep · dns_rebinding · network_mapper · email_harvester · email_spoof_check · shodan_recon · wayback_enum · whois_recon · traceroute_mapper

tech_fingerprint · js_analyzer · param_miner · info_disclosure · secrets_scraper · git_dumper · admin_finder

dir_bruteforce · nikto_scanner · katana_crawler · http_methods · wps_scanmini · nuclei_scanner · fast_webshell

s3_bucket · saml_scanner

ssl_check · security_headers · waf_detec · profiler_bundpent · nmap_advanc · auto_exploit

ssh_brute · ftp_brute · smb_ad · smpt_enum · heartbleed_scanner · domain_transf

📖 Full documentation: PLUGINS.md

python3 cascavel.py -t example.com           # Full scan (all plugins + tools)
python3 cascavel.py                           # Interactive mode
python3 cascavel.py -t example.com --pdf      # Generate PDF report
python3 cascavel.py -t example.com -o json    # JSON output (CI/CD integration)
python3 cascavel.py -t example.com -q         # Quiet mode (no animations)
python3 cascavel.py --plugins-only            # Skip external tools
python3 cascavel.py --list-plugins            # List all 85 plugins
python3 cascavel.py --check-tools             # Check installed tools

All optional — Cascavel auto-detects and skips missing tools gracefully.

💡 install.sh detects your OS and installs all available tools automatically.

Cascavel is hardened against modern attack vectors targeting security tools themselves:

Cascavel/
├── cascavel.py           # Core engine (3000+ lines)
├── report_generator.py   # PDF reports (ReportLab Platypus)
├── install.sh            # Universal installer (v2.4.0, 15 hardenings)
├── plugins/              # 85 security plugins
│   ├── xss_scanner.py    #   └── 85 plugins, standardized run() interface
│   ├── jwt_analyzer.py
│   └── ...
├── docs/                 # Screenshots and assets
├── reports/              # Generated reports (auto-created)
├── exports/              # Exported data (auto-created)
├── wordlists/            # Fuzzing wordlists
├── nuclei-templates/     # Custom Nuclei templates
├── requirements.txt      # Python dependencies
├── PLUGINS.md            # Full plugin documentation
├── CONTRIBUTING.md       # Contribution guide
├── CHANGELOG.md          # Version history
├── SECURITY.md           # Vulnerability disclosure policy
└── LICENSE               # MIT

Cascavel ships with 8 GitHub Actions workflows enforcing security on every push and PR:

Cascavel handles Unix signals for robust operation in all environments:

See CONTRIBUTING.md for the full guide.

Plugin interface — drop a file in plugins/ and it's auto-discovered:

def run(target: str, ip: str, open_ports: list, banners: dict) -> dict:
    """
    Args:
        target:     Domain or IP being scanned
        ip:         Resolved IPv4/IPv6 address
        open_ports: List of open port numbers (from naabu)
        banners:    Dict mapping port -> banner string

    Returns:
        {
            "plugin": "my_plugin",
            "resultados": [...],      # Findings list or summary string
            "severidade": "ALTO",     # CRITICO | ALTO | MEDIO | BAIXO | INFO
        }
    """
    return {"plugin": "my_plugin", "resultados": "Limpo", "severidade": "INFO"}

MÉTODO CASCAVEL™
_{A product of RET Tecnologia — Engenharia de Software & Cibersegurança Ofensiva
Gabriel L. Ferreira · Fundador & DevSecOps Lead}

🌐 cascavel.pages.dev · 🏢 rettecnologia.org

_{Making the web safer, one target at a time. 🐍}