Metadata-Version: 2.4
Name: webamon-cli
Version: 0.3.1
Summary: Webamon Search CLI - The Google of Threat Intelligence.
Author-email: Webamon <info@webamon.com>
License-Expression: Apache-2.0
Project-URL: Homepage, https://webamon.com
Project-URL: Repository, https://github.com/webamon-org/webamon-cli
Project-URL: Bug Tracker, https://github.com/webamon-org/webamon-cli/issues
Project-URL: Documentation, https://github.com/webamon-org/webamon-cli#readme
Project-URL: Webamon Search, https://intel.webamon.com
Keywords: webamon,threat-intelligence,osint,security,threat,hunting,cli,cybersecurity,search,intel
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Topic :: Security
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: System :: Networking :: Monitoring
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Environment :: Console
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click>=8.0.0
Requires-Dist: requests>=2.25.0
Requires-Dist: rich>=10.0.0
Requires-Dist: pydantic>=1.8.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-cov>=4.0; extra == "dev"
Dynamic: license-file

# Webamon Search CLI

**The Google of Threat Intelligence**

A powerful command-line interface for the Webamon Search API. Search & Threat Hunt across the web at scale. Returning unbiased & unfiltered results.

**What you can do:**

- 🔎 **Search** the scan corpus by domain, IP, URL, hash or tag — or with full Lucene queries
- 🛰️ **Scan** any URL on demand and pull the report or screenshot
- 🔑 **Infostealers** — hunt compromised credentials by domain
- 🎯 **Campaigns** — tracked phishing/malware estates: domain inventories, change history, analyst tags and stats *(Pro)*
- 📡 **Clusters** — the emerging-threat radar: auto-detected fingerprint clusters not yet promoted to campaigns *(Pro)*
- 📤 **Export** any result set to JSON, CSV or Markdown

## Installation

### From PyPI

```bash
pip install webamon-cli
```

> **Webamon Search** - The Google of Threat Intelligence. Access millions of scanned domains, IPs, and threat indicators.

### Global Installation (Linux/macOS)

**Recommended: Install via Package Manager**
```bash
# Ubuntu/Debian
sudo apt update && sudo apt install pipx
pipx install webamon-cli
pipx ensurepath

# Fedora/CentOS/RHEL
sudo dnf install pipx
pipx install webamon-cli
pipx ensurepath

# macOS
brew install pipx
pipx install webamon-cli
pipx ensurepath

# Arch Linux
sudo pacman -S python-pipx
pipx install webamon-cli
pipx ensurepath
```

**Alternative: Install from Source**

If you need the latest development version or package managers don't work:

1. Install pipx first:
```bash
# Ubuntu/Debian: sudo apt install pipx
# Fedora/CentOS: sudo dnf install pipx  
# macOS: brew install pipx
# Arch: sudo pacman -S python-pipx
```

2. Clone and install:
```bash
git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
pipx install .
pipx ensurepath
```

**Verify Installation:**
```bash
# Test the installation
webamon --help

# If command not found, add to PATH:
export PATH="$HOME/.local/bin:$PATH"
# Then restart your terminal or run:
source ~/.bashrc  # Linux
# or
source ~/.zshrc   # macOS
```

### Development Installation

For development work:
```bash
git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -e .
```

## Quick Start

**Install globally:**
```bash
# Ubuntu/Debian
sudo apt install pipx && pipx install webamon-cli

# Fedora/CentOS  
sudo dnf install pipx && pipx install webamon-cli

# macOS
brew install pipx && pipx install webamon-cli
```

**🚀 Start searching immediately - it's that simple!**

Use the explicit search command:
```bash
webamon search example.com       # Search for example.com
webamon search malware          # Search for malware
webamon search nrd_20250801     # Search latest domain registrations
```

**Other commands:**
```bash
webamon search example.com     # Explicit search command
webamon configure             # Configure API key for pro features
webamon status               # Test connection
webamon scan https://example.com  # Scan a website
```

## Usage

### API Endpoints

**Webamon Search - The Google of Threat Intelligence**

The CLI automatically uses the appropriate endpoint:
- **Free tier**: `search.webamon.com` (no API key required)
- **Pro tier**: `pro.webamon.com` (requires API key)

### Configuration

The CLI can be configured in several ways:

1. **Interactive configuration:**
```bash
webamon configure
```

2. **Environment variables:**
```bash
export WEBAMON_API_KEY="your-api-key"  # Optional, enables pro features
```

3. **Command-line options:**
```bash
webamon --api-key your-key search example.com domain.name
```

4. **Configuration file:**
The CLI looks for configuration in:
- `~/.webamon/config.json`
- `.webamon.json` in current directory

### Commands

#### Search

Search the Webamon threat intelligence database:

```bash
# Search for domains, IPs, URLs, etc:
webamon search example.com           # Search for example.com
webamon search malware              # Search for malware  
webamon search 1.1.1.1             # Search for IP address
webamon search nrd_20250801 tag     # Search in specific field
```

**How it works:**
- `webamon search <SEARCH_TERM>` - Basic search
- `webamon search <SEARCH_TERM> <RESULTS>` - Search in specific fields
- `SEARCH_TERM`: What you're searching for (domain, IP, URL, hash, etc.)
- `RESULTS`: Comma-separated list of fields to search within
  - **Default search fields**: `page_title,domain.name,resolved_url,dom,tag`
  - **Custom search fields**: Specify your own field list
- `--fields`: Comma-separated list of fields to return (separate from search fields)
  - **Default return fields**: Same as search fields when not specified

💡 **Search matches are highlighted with yellow background in table view.**

**Examples:**
```bash
# Basic search
webamon search example.com

# Search in specific fields
webamon search example.com domain.name,resolved_url

# Custom return fields  
webamon search example.com --fields page_title,domain.name

# Both custom search and return fields
webamon search example.com tag --fields page_title,domain.name

# Different output formats
webamon search example.com --format json
webamon search example.com --format csv

# Export results
webamon search example.com --export results.json
webamon search example.com --format csv --export analysis.csv
```

**Pagination (Pro Users Only):**
```bash
# Limit results with default fields
webamon search example.com --size 25

# Use offset for pagination with default fields
webamon search example.com --from 25 --size 25

# Use offset with custom fields
webamon search example.com domain.name,resolved_url --from 25 --size 25

# Skip first 100 results with default fields
webamon search example.com --from 100 --size 50

# Navigate large result sets
webamon search "*.bank.com" --from 0 --size 100
```

**Lucene Search:**
```bash
# Advanced Lucene queries
webamon search --lucene 'domain.name:"bank*" AND scan_status:success' --index scans

# Specify fields to return
webamon search --lucene 'domain.name:"example.com"' --index scans --fields domain.name,page_title
```

#### Scan
Initiate website scans:
```bash
# Scan a domain
webamon scan example.com

# Scan and automatically fetch the report
webamon scan example.com --fetch-report

# Scan a full URL
webamon scan https://example.com/login

# JSON output with automatic report fetch
webamon scan example.com --format json --fetch-report
```

#### Report
Get a specific scan report by ID:
```bash
# Get report details (JSON format by default)
webamon report bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb

# Table format for readable summary
webamon report bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb --format table
```

#### Infostealers
Search for compromised credentials by domain:
```bash
# Search for compromised credentials
webamon infostealers example.com

# Search domain with hyphens (automatically quoted)
webamon infostealers bank-site.com

# Get more results (Pro users)
webamon infostealers example.com --size 50

# Specify fields to return
webamon infostealers example.com --fields domain,username,password

# JSON output
webamon infostealers example.com --format json

# CSV output (auto-exports to file)
webamon infostealers example.com --format csv

# Export to custom file
webamon infostealers example.com --export compromised_creds
webamon infostealers example.com --format csv --export creds.csv
```

#### Screenshot
Retrieve scan screenshots:
```bash
# Get screenshot info
webamon screenshot bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb

# Save screenshot to file
webamon screenshot bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb --save screenshot.png

```

#### Status
Check API connectivity:
```bash
webamon status
```

#### Fields
Discover available scan fields:
```bash
# Show all available fields
webamon fields

# Search for specific fields
webamon fields --search domain

# Show fields by category
webamon fields --category certificate

# Get fields as a simple list
webamon fields --search ip --format list
```

#### Campaigns

Campaign intelligence — tracked phishing and malware-delivery estates, their
domain inventories, change history and analyst tags.

> 🔑 **Requires a Pro API key on a Research Lab or SOC plan.** On the Researcher
> tier, campaigns are available through the web console at
> [intel.webamon.com](https://intel.webamon.com).

```bash
# List tracked campaigns
webamon campaigns list
webamon campaigns list --search clickfix        # free-text filter
webamon campaigns list --tag phishing           # filter by analyst tag
webamon campaigns list --size 50 --from 50      # paginate

# Full detail for one campaign (by id or exact name)
webamon campaigns show 337271a6...
webamon campaigns show "ClickFix Fake-Cloudflare"

# Domain inventory for a campaign
webamon campaigns domains 337271a6...
webamon campaigns domains 337271a6... --online true        # live domains only
webamon campaigns domains 337271a6... --q login            # substring filter
webamon campaigns domains 337271a6... --sort last_seen --order desc
webamon campaigns domains 337271a6... --since 2026-07-01   # date window

# Change history
webamon campaigns changes 337271a6...                      # one campaign
webamon campaigns changes                                  # all campaigns (stream)
webamon campaigns changes --dim domains --since 2026-07-01 # only new domains
webamon campaigns changes 337271a6... --exclude-baseline

# Analyst tags in use, with campaign counts
webamon campaigns tags
webamon campaigns tags --q click

# Estate statistics
webamon campaigns stats                 # global: domains, liveness, top TLDs
webamon campaigns stats 337271a6...     # scoped to one campaign
```

| Subcommand | What it does |
|---|---|
| `list` | Tracked campaigns, newest activity first |
| `show` | One campaign in full — seed query, totals, samples |
| `domains` | Paginated domain inventory with liveness and date filters |
| `changes` | Change history for a campaign, or the estate-wide stream |
| `tags` | Every analyst tag with the number of campaigns carrying it |
| `stats` | Domain counts, online/offline split, TLD breakdown |

All list-style subcommands support `--format table|json` and `--export FILE`
(`.json`, `.csv`, or `.md` depending on format).

#### Clusters

Emerging clusters — auto-detected fingerprint groupings the detector has
spotted that are **not yet tracked campaigns**. New, 50–10k domains, boilerplate
filtered. These are your promotion candidates.

> 🔑 Same access requirement as campaigns.

```bash
# The live radar (bare command lists them)
webamon clusters
webamon clusters list

# Triage by severity
webamon clusters list --severity critical
webamon clusters list --severity high --sort recent_7d

# Filter by fingerprint type and size band
webamon clusters list --type links --min-domains 1000
webamon clusters list --type ssl --max-domains 500

# Date windows
webamon clusters list --since 2026-07-19 --date-field first_seen
webamon clusters list --sort detected_at --include-stale

# Enumerate the entire live feed in one call (max page size)
webamon clusters list --size 1000 --format json --export radar

# Radar totals by severity and fingerprint type
webamon clusters summary

# One cluster in full - by cluster_id, fingerprint, or prefix
webamon clusters show ssl:abc123def456
webamon clusters show abc123

# Just the Lucene seed, ready to promote
webamon clusters show abc123 --seed-only
```

**Filters** — `--severity` (`critical`/`high`/`watch`), `--type`
(`links`/`ssl`/`dom`/`asn`/`scripts`/`tech`/`domains`), `--min-domains`,
`--max-domains`, `--since`/`--until` with `--date-field`
(`first_seen`/`last_seen`/`detected_at`), `--sort` (`unique_domains`,
`delta_24h`, `recent_7d`, `first_seen`, `last_seen`, `detected_at`, `severity`),
`--order`, `--size` (default 50, max 1000), `--from`, `--include-stale`.

The table view shows severity, fingerprint type, domain count, 24h and 7d
growth, first seen, the sample lure, and the fingerprint — with a severity
breakdown underneath. Use `clusters show` for the full object including sample
domains, top TLDs and the growth series.

### Global Options

- `--api-key`: Override API key  
- `--config-file`: Use specific config file
- `--verbose, -v`: Enable verbose output

## Example Workflows

### Security Research
```bash
# Search for subdomains
webamon search "*.example.com"

# Scan suspicious domains
webamon scan suspicious-domain.com

# Get screenshots of flagged sites
webamon screenshot <report-id> --save evidence.png
```

### Domain Intelligence
```bash
# Basic domain lookup
webamon search example.com domain.name,resolved_url,page_title

# Advanced search with Lucene
webamon search --lucene 'domain.name:"example.com" AND scan_status:success' --index scans

# Bulk domain analysis
for domain in $(cat domains.txt); do
  webamon search $domain >> results.json
done
```

### Campaign Triage *(Pro)*
```bash
# What moved across the estate in the last day?
webamon campaigns changes --since 2026-07-28

# Which campaign is growing fastest? Then dig in.
webamon campaigns list --size 20
webamon campaigns show 337271a6...
webamon campaigns stats 337271a6...

# Pull the live domains for blocking
webamon campaigns domains 337271a6... --online true --size 1000 \
  --format json --export blocklist
```

### Promoting an Emerging Cluster *(Pro)*
```bash
# 1. Check the radar, worst first
webamon clusters summary
webamon clusters list --severity critical --sort recent_7d

# 2. Inspect a candidate - sample domains, TLDs, growth curve
webamon clusters show ssl:abc123def456

# 3. Grab its seed query to promote it to a tracked campaign
webamon clusters show abc123 --seed-only
# -> fingerprint.ssl:"abc123def456"

# 4. Snapshot the whole radar for reporting
webamon clusters list --size 1000 --format json --export radar-$(date +%F)
```

## Quotas and Pricing

### Free Tier
- **20 daily API calls**
- **10 results per response**
- Basic search functionality
- Limited infostealer data access

### Pro Plans
When you hit the daily quota, the CLI will suggest upgrading to Pro for expanded access:

- **Founding Analyst**: 1,000+ daily calls, up to 100 results per response
- **Enterprise**: 10,000+ daily calls, up to 500 results per response
- **All plans**: Complete infostealer data access, pagination, priority support

For current pricing and features, visit: https://webamon.com/pricing

If you exceed your quota, you'll see a helpful error message with upgrade information.

## Configuration File Format

```json
{
  "api_key": "your-api-key-here",
  "verbose": false
}
```

## Development

### Setup Development Environment

```bash
# Clone and install
git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -e .
```

### Building

```bash
python -m build
```


## Uninstall

### Global Installation (pipx)
```bash
pipx uninstall webamon-cli
```

### PyPI Installation
```bash
pip uninstall webamon-cli
```

### Development Installation
```bash
# If installed with pip install -e .
pip uninstall webamon-cli

# Remove the repository
rm -rf webamon-cli
```

## License

Apache License 2.0

Copyright 2025 Webamon

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

## Contributing

We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines on:

- Setting up your development environment
- Code style and testing requirements  
- Submitting bug reports and feature requests
- Pull request process and code review

Quick start: Fork → Branch → Code → Test → Pull Request

## Security

Security is important to us. Please see [SECURITY.md](SECURITY.md) for:

- Reporting security vulnerabilities
- Security best practices for users
- API key and data protection guidelines
- Incident response procedures
