Search workflow BETA

Send "search" in your chat and the model replies with the web-discovery workflow and its exact syntax — search the web for a phrase and get a ranked list of domains to feed straight into recon.

These workflows are new and may have bugs.

• search <phrase> [--limit N] [--lang xx] [--source …]

  Searches the web for a phrase (like a Google query) and returns the top-ranked domains, deduplicated — the starting point of a whole scan pipeline. Default 10 domains, up to 50 with --limit; --lang biases results to a language; --source forces one engine (ddg or searxng).

  searxngduckduckgo

  How it works

  1. Uses our SearXNG metasearch (Google, Bing, Brave and DuckDuckGo aggregated) when it is available, and falls back to DuckDuckGo otherwise.
  2. Reduces every result to a registrable domain, normalizes internationalized domains to punycode, merges the sources by rank and removes duplicates, keeping the top N.
  3. Saves the ranked list to a uniquely named list in your machine's findings database, and registers it so search:list can find it later.
  4. Replies with the list name and the domains, plus a ready-to-send "recon:domain --list <name>" command to scan them all, one at a time.
• search:list

  Shows every list saved on your machine — from search and from recon — so you can pick one to scan or exploit.

  findings

  How it works

  1. Reads the list registry and prints a table: name, the query behind it, the stage (search or recon), how many entries it holds, and when it was created.
  2. Give it a name — "search:list <name>" — to see that list's entries and the command to run it.

The search runs live on your Kali machine (DuckDuckGo needs no key or setup; SearXNG is our hosted metasearch). Rent one in the Virtual Machines section.

Search is the front of a pipeline: search a phrase → "recon:domain --list <name>" scans every domain and produces a filtered after-recon list → "attack --list <name>" confirms the findings on each. Nothing runs automatically — each step hands you the next command to send, so you stay in control of what gets scanned.

Your lists live inside the findings database on the machine, so "findings export" then "findings import" on a new Kali machine carries every list — and all your findings — across.