The I2P Red-Team Scanner is the first dedicated penetration testing tool specifically designed for the Invisible Internet Project (I2P) network. Unlike conventional web application scanners that operate on the clearnet, this tool routes all traffic through the I2P proxy, allowing it to accurately assess the security posture of .i2p hidden services while detecting anonymity-layer vulnerabilities that traditional scanners miss.

Why This Matters

Standard security scanners cannot properly interact with I2P sites
The anonymity layer introduces unique attack vectors (DNS leaks, SSL/TLS misconfigurations, external resource loading)
Red teams and threat hunters need specialized tools to assess hidden services
I2P network security has historically lacked dedicated assessment tooling

Features

Core Assessment Modules

Security Headers Analysis - Detects missing X-Frame-Options, CSP, X-Content-Type-Options, and other critical security headers
Version Fingerprinting - Identifies server software versions and checks against a CVE database for known vulnerabilities
Data Leak Detection - Scans for exposed sensitive files (.git, .env, backup archives, configuration files)
Form Vulnerability Fuzzing - Tests for basic XSS and SQL injection vectors in web forms
SSL/TLS Leak Detection - Identifies HTTPS links, external domain references, and HSTS headers that can deanonymize both the server and visitors
Admin Path Bruteforce - Discovers hidden administrative panels and login portals
Anonymity Leak Testing - Detects external resource loading, SSRF vectors, and server information disclosure

Red-Team Focused

All traffic routes through I2P HTTP proxy (127.0.0.1:4444)
Color-coded terminal output for rapid vulnerability prioritization
Modular architecture for easy extension
CVE database covering nginx, Apache, Tomcat, lighttpd, and I2P-specific vulnerabilities

Requirements

System Requirements

Operating System: Linux (recommended), macOS, or Windows with WSL2
Python: Version 3.8 or higher
I2P Router: Running locally with HTTP proxy enabled

I2P Setup

Before using the scanner, you must have a functional I2P router:

# Verify I2P is running
~/i2p/i2prouter status

# If not running, start it
~/i2p/i2prouter start

The scanner expects the I2P HTTP proxy to be available at 127.0.0.1:4444.

Python Dependencies

Install the required packages:

pip install requests beautifulsoup4 colorama lxml

Installation

Clone the Repository

git clone https://git.churchofmalware.org/ek0mssavi0r/i2p_scanner.git
cd i2p_scanner

Make the Script Executable

chmod +x i2p_scanner.py

Verify Installation

python3 i2p_scanner.py

You should see the scanner banner and prompt for an I2P site URL.

Configuration

Setting Up the Callback Server (For Anonymity Testing)

To fully utilize the anonymity leak detection module, configure a callback server to catch external resource requests:

Set up a listener on a publicly accessible server:

# Using netcat
nc -lvnp 80

# Or using Python's HTTP server
python3 -m http.server 80

Update the scanner with your server's address:

CALLBACK_SERVER = "your-server-domain.com"  # Change this in i2p_scanner.py

The scanner will then inject test payloads that attempt to make the target site contact your callback server, revealing potential DNS leaks.

Customizing Scan Parameters

The following variables can be adjusted at the top of i2p_scanner.py:

MAX_PAGES = 15        # Maximum pages to crawl per site
TIMEOUT = 15          # Request timeout in seconds
USER_AGENT = "I2P-Scanner/1.0 (Red-Team)"  # User agent string

Usage

Basic Usage

python3 i2p_scanner.py

Interactive Session

The scanner will display a banner and warning message
Enter the I2P site when prompted:

Enter I2P site (or 'quit'): planet.i2p

The scanner will:
- Test the I2P connection
- Crawl the site (up to MAX_PAGES pages)
- Run all assessment modules
- Display a color-coded report

Example Output

============================================================
 RED-TEAM SCAN REPORT: http://planet.i2p
 Scan Time: 2026-07-16 09:23:38
============================================================

[+] SECURITY HEADERS:
  [!] Missing 'Content-Security-Policy' -> Mitigates XSS/data injection
  [!] Missing 'X-Content-Type-Options' -> Prevents MIME sniffing

[+] VERSION FINGERPRINTING:
  [!] No Server header found (information hiding)

[+] SSL/TLS LEAK DETECTION:
  [!] HTTPS link detected: https://github.com/username/repo
  [!] External domain referenced: http://external-site.com

Understanding the Results

Severity Levels

Color	Meaning
Red	High severity vulnerability requiring immediate attention
Yellow	Medium severity issue or informational finding
Green	No issues detected in this category

Common Findings and Their Implications

Security Headers Missing

Impact: Increased risk of XSS, clickjacking, and MIME-based attacks
Fix: Add appropriate headers in server configuration

DNS Leaks (HTTPS/External Links)

Impact: Deanonymization of server operators and visitors
Fix: Replace all clearnet links with .i2p equivalents; remove external resource loading

Exposed Files

Impact: Configuration files, credentials, and source code exposure
Fix: Restrict access to sensitive files via .htaccess or server configuration

Admin Panel Discovery

Impact: Increased attack surface; potential credential theft
Fix: Restrict access via IP allowlisting or strong authentication

Version Disclosure

Impact: Attackers can target known vulnerabilities
Fix: Hide server headers or keep software updated

Modules Explained

1. Security Headers (check_headers)

Checks for the presence of:

X-Frame-Options
Content-Security-Policy
X-Content-Type-Options
Referrer-Policy
Strict-Transport-Security (flagged as a risk on I2P)

2. Version Fingerprinting (check_version_fingerprinting)

Extracts server software and version from headers
Compares against CVE database
Flags known vulnerable versions

3. Data Leak (check_info_leak)

Scans for:

Version control files (.git/HEAD, .git/config)
Environment files (.env)
Backup archives (backup.zip)
Configuration files (config.ini, wp-config.php.bak)
Debug logs (debug.log, error.log)
PHP info files (phpinfo.php, info.php)

4. Form Vulnerabilities (check_form_vulns)

Inject XSS payloads (<script>alert(1)</script>)
Test SQL injection vectors (' OR '1'='1)
Check for reflected payloads in responses

5. SSL/TLS Leak (check_ssl_leak)

Detects HTTPS links in page content
Identifies external domain references
Flags meta refresh redirects to HTTPS
Identifies HSTS headers (misconfigured for I2P)

6. Admin Path Bruteforce (check_admin_paths)

Checks common administrative paths:

admin, administrator, admin.php
login, wp-admin
cpanel, webmail, phpmyadmin
mysql, database, backup

7. Anonymity Leak (test_anonymity_leak)

Detects external resources already loaded (images, scripts, CSS)
Identifies forms targeting external URLs
Discovers server information disclosure (PHP_SELF, SERVER_ADDR)
Optionally injects callback test payloads

Reporting Findings

Generating a Report File

python3 i2p_scanner.py > scan_report_$(date +%Y%m%d_%H%M%S).txt

Disclaimer: This tool is provided for educational and authorized security testing purposes only. The maintainers are not responsible for any misuse or illegal activities performed with this software.

README.md

I2P Red-Team Scanner

Table of Contents

Overview