Metabigor OSINT reconnaissance commands for infrastructure discovery

Metabigor's infrastructure discovery scope

Metabigor addresses a specific reconnaissance problem: collecting facts about an organization's exposed internet footprint from several source types without requiring a separate API key for each source. Its intended users are security researchers, bug bounty practitioners, and other defenders who need to move from a seed target to related infrastructure. A starting point can be an ASN, organization name, domain, or IP address. From there, the command set is designed to produce candidate network ranges, subdomains, exposed services, related domains, CDN or WAF addresses, and URLs collected from web archives.

The project is not a general vulnerability scanner. Its IP enrichment uses Shodan InternetDB to return ports, hostnames, and CVE references. Its code search uses grep.app to find matching repositories, paths, and, when requested, matching code. These distinctions matter because the tool aggregates and formats reconnaissance data rather than deciding whether an exposed service is exploitable. The README does not document exploitation, authentication testing, or an automated finding-verification workflow.

Metabigor also provides a common command model across the different discovery modes. That is useful for scripts because a result from one command can become input to another. The README documents examples that connect network discovery to IP enrichment, related-domain discovery to certificate transparency, and domain data to CDN analysis. This makes it more than a collection of unrelated scripts, although it remains a focused reconnaissance utility rather than a full security operations platform.

Metabigor command data flow and source selection

The core mechanism is a set of Cobra-based commands with consistent input and output conventions. Targets can be supplied as command arguments, through `-i`, through `-I` pointing to a file, or on standard input. The README states that these methods can be combined and that the resulting target list is deduplicated. Standard input is read only when no target was supplied through another route, which prevents a command such as `metabigor net AS13335` from waiting for input in a script or CI job.

The `net` command uses a bundled offline database by default. It can expand an ASN into announced CIDRs, identify the ASN and organization associated with an IP, search by organization, or query live sources with `--live`. The `cluster` command also works offline, grouping IPs and CIDRs by owning ASN. These offline paths are separate from commands that contact web services. `cert` queries certificate transparency through crt.sh, while `ip` uses Shodan InternetDB. `github` uses grep.app and requires Chrome or Chromium because the README says plain HTTP clients receive a bot challenge.

Output is handled consistently. The default `text` format is intended for terminal reading, `flat` emits the primary value for pipelines, `json` emits one JSON object per line, and `csv` writes rows behind a header. Results go to stdout and logs go to stderr, which keeps piping clean. The `-o` option writes results to a file as well, while `--append` preserves existing content. The README states that output files are rewritten only after a result exists, so a failed or empty run does not destroy earlier output.

Installing Metabigor and running a first reconnaissance pipeline

The README offers prebuilt installation paths for macOS, Linux, and Windows. The npm package installs the command globally, while Homebrew uses the `j3ssie/tap` tap. Both routes ship a platform binary, so a Go toolchain is not required for those installation methods. A source build is also documented through the repository clone and `make build`.

Install the command with npm:

npm install -g @j3ssie/metabigor

After installation, run a documented discovery command. The `cert` example returns one domain per line from certificate transparency data for `hackerone.com`:

metabigor cert hackerone.com

For a first pipeline, begin with an ASN and emit bare values for the next command. The `net` output is piped into `ip`, which uses the InternetDB-backed enrichment path:

metabigor net AS13335 -f flat | metabigor ip -f flat

The first command produces network-related primary values, and the second accepts those values for IP enrichment. The README does not claim that every CIDR or IP will yield enrichment data, so an empty or partial result is possible.

Projects can also be built from source with the documented Makefile workflow:

git clone https://github.com/j3ssie/metabigor.git
cd metabigor
make build

The README states that the resulting binary is at `./bin/metabigor`. The Makefile also defines `make install` for a Go installation into `GOBIN_PATH`, which resolves to the Go workspace binary directory. For routine use, the prebuilt package is simpler because it avoids local Go setup.

Metabigor's OSINT source coverage and service constraints

The source choices explain both Metabigor's convenience and its limitations. Certificate transparency can reveal names associated with a domain or organization, but it reports certificate-log data rather than proving that a hostname is currently hosted, reachable, or owned by the same operator. The `cert` command supports `--clean` to remove `*.` prefixes, `--wildcard` to retain only wildcard entries, and `--detail` to add certificate IDs, issuers, and validity dates. Those flags improve filtering and record inspection, but they do not turn certificate data into an ownership determination.

InternetDB supplies the documented `ip` enrichment fields. IPs unknown to that service are skipped unless `--all` is passed. CIDRs expand to hosts, which can produce a large number of requests and results for a broad range. The `-c` flag is documented for the IP command, while the GitHub command runs searches one at a time regardless of `-c` to respect grep.app's rate limit. This difference reflects two separate operational constraints: bulk IP processing and public code search have different service behavior.

Related-domain discovery can pivot through certificate logs, reverse WHOIS, and analytics IDs. CDN or WAF detection can separate protected addresses from candidate origins. The README does not explain the exact confidence model for those classifications, so operators should inspect results before treating a candidate origin as an internal or exposed host. Web archive collection can return every URL the archives have seen, including endpoints mined from WARCs. That is useful for endpoint inventory, but historical URLs may be stale and should be validated separately.

Metabigor limitations and the wrong operating context

Metabigor has several boundaries that are visible in the README. The `github` command requires Chrome or Chromium. That dependency affects container images, minimal servers, and automated environments that do not provide a browser. The README gives no separate browser installation or configuration procedure beyond stating the requirement, so deployment planning must account for it separately.

The `net` command's default database is bundled and offline. That can make repeated collection predictable, but freshness is not established by the README. Use `--live` only when querying live sources is appropriate and accepted. The documentation does not specify update intervals for the bundled database, so a stale local result cannot be distinguished from a recent one through the README alone.

Output volume is another constraint. CIDRs expand into hosts, and `flat` output can feed large address sets into another command. Broad ranges may also be unrelated to a specific target. The project does not document authorization checks, scope enforcement, or target validation. It is therefore wrong as an unattended scanner for arbitrary internet addresses unless the operator applies scope controls before execution.

A real alternative is a separate staged pipeline such as DNS resolution plus archive inventory. For example, the README shows `dnsx` consuming domain output and then passing resolved addresses into `metabigor cdn --exclude`. In this example, `dnsx` handles the DNS stage before `metabigor cdn --exclude` analyzes the resulting addresses. This is a concrete difference in approach: DNS-first tooling is narrower, while Metabigor coordinates discovery and enrichment across ASN, certificate, IP, code, domain, and archive inputs.

Metabigor releases, licensing, and maintenance cost

Metabigor is released under the MIT License, according to the repository information. That permits use and modification under the license's conditions, but this article does not provide legal advice. Users should review the repository's `LICENSE` file for the applicable notices and obligations when distributing a binary or incorporating code.

The repository is not archived, and the last push was on 2026-08-08. Recent release history includes `v2.2.0` on 2026-08-08, `v2.1.0` with the release title "Metabigor v2.1.0 - Architecture Rewrite" on 2026-02-15, and `v2.0.1` on 2025-06-29. The architecture rewrite and later releases indicate that upgrades may involve more than a routine patch. The README does not provide a migration guide, compatibility matrix, or rollback procedure, so an operator cannot infer from the available documentation how existing scripts should be changed.

The main upgrade cost is operational. Command output formats are part of the automation interface, and the release history includes an architecture rewrite. Teams using `-f flat`, JSON, CSV, file output, or chained commands should compare expected output before replacing an existing binary. The project also depends on external services, so an upgrade can change command behavior even when the local Go build succeeds. The `Makefile` provides build, test, formatting, vetting, linting, end-to-end, data-update, and release targets, but the README excerpt does not describe their full execution requirements.

Choosing Metabigor for a reproducible reconnaissance workflow

Metabigor is most useful when the first reconnaissance question is broader than a single DNS lookup. A security researcher can start with an ASN or organization, collect CIDRs, enrich selected IPs, and pivot through certificate or related-domain data. The shared `-f` flag makes intermediate data easy to inspect in a terminal or pass into other command-line programs. The decision is less attractive when the workflow needs guaranteed freshness, a browser-free code-search environment, or a documented authorization model.

The repository's toolchain also gives adopters a source-build path rather than forcing package-manager use. `go.mod` identifies the module as `github.com/j3ssie/metabigor` and declares Go 1.26. The Makefile derives the displayed version from `internal/core/constants.go`, copies a built binary to `./bin/metabigor`, and provides a Go workspace installation target. Those details matter for CI images and internal builds, but the repository does not claim that a particular build is bit-for-bit reproducible across systems.

The concrete adoption test is small but specific. Install the package, run `metabigor net AS13335 -f flat | metabigor ip -f flat`, and inspect whether the output format matches the scripts that will consume it. Check Chrome or Chromium before scheduling `github` jobs, validate InternetDB coverage before relying on `ip`, and inspect the freshness of the bundled database before trusting default `net` results. If those checks pass, Metabigor provides a useful pipeable OSINT layer for authorized infrastructure discovery.

Editorial conclusion

Metabigor suits security researchers and bug bounty practitioners who need a command-line reconnaissance pipeline built from free OSINT sources. It is a poor fit for workflows that require guaranteed coverage, offline results for every command, or a browserless GitHub Code Search process. Evaluate it first by checking whether your targets are permitted, whether Chrome or Chromium is available for `github`, whether InternetDB covers the relevant IPs, and whether the bundled network database meets your freshness requirements. With those constraints understood, the tool is a practical composition layer for reconnaissance data rather than a complete assessment platform.

Frequently asked questions

Official sources

1. Issues
2. j3ssie/metabigor on GitHub
3. License: MIT
4. README
5. Releases